打印流程分析笔记

本地打印的流程:

 

1.    应用程序

2.   GDI引擎

3.   本地打印提供者(localspl.dll

4.  如果是EMF格式交给EMF打印处理器(winprint.dll)转成RAW格式下面是到打印处理的函数栈

063df19c73d542b7 05f3e188 063df30c 00000000winprint!PrintDocumentOnPrintProcessor(FPO: [Non-Fpo])

063df1bc 6149c35c 0663737c063df30c 00b06a4aPrintIsolationProxy!sandbox::PrintProcessor::PrintDocThroughPrintProcessor+0x49(FPO: [Non-Fpo])

063df228 6149b052 00ad6744 063df30c00b06a4alocalspl!sandbox::PrintProcessorExecuteObserver::PrintDocThroughPrintProcessor+0x84(FPO: [Non-Fpo])

063df244 61499d20 00ad6744 063df30c00b06a4alocalspl!sandbox::PrintProcessorAdapterImpl::PrintDocumentOnPrintProcessor+0x27(FPO: [Non-Fpo])

063df270 61460400 00aa3960 063df30c0018c938localspl!sandbox::PrintProcessorAdapter::PrintDocumentOnPrintProcessor+0x77(FPO: [Non-Fpo])

063df950 614615fe 00aa4f20063df970 00000000 localspl!PrintDocumentThruPrintProcessor+0x3bd (FPO:[Non-Fpo])

063dfbb0 76161174 00aa4f20063dfbfc 77d1b3f5localspl!PortThread+0x41c(FPO: [Non-Fpo])

063dfbbc 77d1b3f5 00aa4f20 70896cd8 00000000 kernel32!BaseThreadInitThunk+0xe(FPO: [Non-Fpo])

063dfbfc 77d1b3c8614611e2 00aa4f2000000000 ntdll!__RtlUserThreadStart+0x70 (FPO: [Non-Fpo])

063dfc14 00000000 614611e2 00aa4f2000000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])

5.   本地打印提供者SplWriterPrinter函数

ChildEBP RetAddr  Args toChild             

063de2f000db9295 05f3cba8 01b70000 00002b64 localspl!SplWritePrinter(FPO: [Non-Fpo])

063de308 00da8f7e 05f20620 01b70000 00002b64spoolsv!WritePrinter+0x2c (FPO:[Non-Fpo])

063de324 738bc27a 05f20620 01b70000 00002b64spoolsv!YWritePrinter+0x2b (FPO: [Non-Fpo])

063de374 738c150e003991f4 000000007b03d19b winspool!FlushBuffer+0xee (FPO: [Non-Fpo])

063de3c46d57cf9f 003991f4 00000000 00000002 winspool!GetJobW+0x36 (FPO:[Non-Fpo])

WARNING: Stack unwind information not available. Following frames maybe wrong.

063de57c6d57de7e 00d40008 063de598 00d40008 hpvpldrv09+0xcf9f

063de5a4 6d577f25 00d40008 06c30034 ffffffff hpvpldrv09+0xde7e

063de5c064e5ee13 00d40008 06c30034ff7fffff hpvpldrv09+0x7f25

063de5d8 64e5fcc4 00d40008 06c3003406499738 UNIDRV!DrvEnableDriver+0x5401

063de5f8 763d1a16 00d40008 06c30034 063def08 UNIDRV!DrvEnableDriver+0x62b2

063de630 77e43829 063dee98 063de648 00000004GDI32!GdiPrinterThunk+0x753 (FPO: [Non-Fpo])

063dee80 77d0642e 063dee98 0000001c063def20 USER32!__ClientPrinterThunk+0x28 (FPO: [Non-Fpo])

063deeb0 76406825 763f7c2cb42103eb 00000000 ntdll!KiUserCallbackDispatcher+0x2e (FPO: [0,0,0])

063deeb4 763f7c2cb42103eb 00000000 063def08 GDI32!NtGdiDoBanding+0xc (FPO: [4,0,0])

063deee0 763f9aedb42103eb 063def08 a3ccdf2a GDI32!NextBand+0x1d (FPO: [Non-Fpo])

063def30 73784a81003260f8 00000001 00a9fd78 GDI32!GdiEndPageEMF+0x93 (FPO:[Non-Fpo])

063def74 737852bc 003260f8b42103eb 00000000 winprint!PrintOneSideReverseEMF+0x1be (FPO: [Non-Fpo])

063defb4 7378533c003260f8 b42103eb 737848c3winprint!PrintEMFInPredeterminedOrder+0xc8 (FPO: [Non-Fpo])

063defdc 737854ba 003260f8b42103eb 063df0a4winprint!PrintEMFSingleCopy+0x4d (FPO: [Non-Fpo])

063df058 737859a9003260f8 b42103eb063df0a4winprint!BPrintEMFJobNow+0x175 (FPO: [Non-Fpo])

063df18c737834db 05f3e188 00326134063df1bc winprint!PrintEMFJob+0x48f(FPO: [Non-Fpo])

063df19c73d542b7 05f3e188 063df30c00000000 winprint!PrintDocumentOnPrintProcessor+0x3c (FPO: [Non-Fpo])

063df1bc 6149c35c 0663737c063df30c 00b06a4aPrintIsolationProxy!sandbox::PrintProcessor::PrintDocThroughPrintProcessor+0x49(FPO: [Non-Fpo])

063df228 6149b052 00ad6744 063df30c00b06a4alocalspl!sandbox::PrintProcessorExecuteObserver::PrintDocThroughPrintProcessor+0x84(FPO: [Non-Fpo])

063df244 61499d20 00ad6744 063df30c00b06a4alocalspl!sandbox::PrintProcessorAdapterImpl::PrintDocumentOnPrintProcessor+0x27(FPO: [Non-Fpo])

063df270 61460400 00aa3960 063df30c0018c938localspl!sandbox::PrintProcessorAdapter::PrintDocumentOnPrintProcessor+0x77(FPO: [Non-Fpo])

063df950 614615fe 00aa4f20063df970 00000000 localspl!PrintDocumentThruPrintProcessor+0x3bd (FPO:[Non-Fpo])

063dfbb0 76161174 00aa4f20063dfbfc 77d1b3f5localspl!PortThread+0x41c(FPO: [Non-Fpo])

063dfbbc 77d1b3f5 00aa4f20 70896cd8 00000000kernel32!BaseThreadInitThunk+0xe (FPO: [Non-Fpo])

063dfbfc 77d1b3c8614611e2 00aa4f2000000000 ntdll!__RtlUserThreadStart+0x70 (FPO: [Non-Fpo])

063dfc14 00000000 614611e2 00aa4f2000000000 ntdll!_RtlUserThreadStart+0x1b (FPO:[Non-Fpo])

6.结束打印

ChildEBP RetAddr  Args toChild             

063def30 00db9436 05f3cba8 063def4c00da92ca localspl!SplEndDocPrinter(FPO: [Non-Fpo])

063def3c00da92ca 05f20620 003991f4 063def94spoolsv!EndDocPrinter+0x1d (FPO: [Non-Fpo])

063def4c738bcd32 05f20620 000000007b03ddcb spoolsv!YEndDocPrinter+0x22 (FPO: [Non-Fpo])

063def94 7640591b 003991f406496450 063defc0 winspool!EndDocPrinter+0xfe (FPO: [Non-Fpo])

063defa4 763f522006830290 003991f4 00000000GDI32!EndDocPrinterEx+0x5c (FPO:[Non-Fpo])

063defc0 763f9c00 b42103eb a3ccdfee 05f3e188 GDI32!EndDoc+0xa2 (FPO:[Non-Fpo])

063deff4 73785503 003260f87b0f985c 00000001 GDI32!GdiEndDocEMF+0x37 (FPO: [Non-Fpo])

063df058 737859a9003260f8 b42103eb063df0a4winprint!BPrintEMFJobNow+0x1be (FPO: [Non-Fpo])

063df18c 737834db05f3e188 00326134063df1bc winprint!PrintEMFJob+0x48f(FPO: [Non-Fpo])

063df19c73d542b7 05f3e188 063df30c 00000000 winprint!PrintDocumentOnPrintProcessor+0x3c (FPO: [Non-Fpo])

063df1bc 6149c35c 0663737c063df30c 00b06a4aPrintIsolationProxy!sandbox::PrintProcessor::PrintDocThroughPrintProcessor+0x49(FPO: [Non-Fpo])

063df228 6149b052 00ad6744 063df30c00b06a4alocalspl!sandbox::PrintProcessorExecuteObserver::PrintDocThroughPrintProcessor+0x84(FPO: [Non-Fpo])

063df244 61499d20 00ad6744 063df30c00b06a4alocalspl!sandbox::PrintProcessorAdapterImpl::PrintDocumentOnPrintProcessor+0x27(FPO: [Non-Fpo])

063df270 61460400 00aa3960 063df30c0018c938localspl!sandbox::PrintProcessorAdapter::PrintDocumentOnPrintProcessor+0x77(FPO: [Non-Fpo])

063df950 614615fe 00aa4f20063df970 00000000 localspl!PrintDocumentThruPrintProcessor+0x3bd (FPO:[Non-Fpo])

063dfbb0 76161174 00aa4f20063dfbfc 77d1b3f5localspl!PortThread+0x41c(FPO: [Non-Fpo])

063dfbbc 77d1b3f5 00aa4f20 70896cd8 00000000kernel32!BaseThreadInitThunk+0xe (FPO: [Non-Fpo])

063dfbfc 77d1b3c8614611e2 00aa4f2000000000 ntdll!__RtlUserThreadStart+0x70 (FPO: [Non-Fpo])

063dfc14 00000000 614611e2 00aa4f2000000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])

 

 

 

远程打印的流程:

1.    应用程序

2.   GDI引擎

3.   远程打印提供者(win32spl.dll

0104f83c 7424e042 0093db68 010e7008 0000f670 win32spl!WritePrinter (FPO:[Non-Fpo])

0104f86c 01008411 010e7008 00000390 00000000 SPOOLSS!SplCommitSpoolData+0x11b(FPO: [Non-Fpo])

0104f8a0 01007fa5 010d0aa8 00000558 0000f670spoolsv!YCommitSpoolData2+0x5a(FPO: [Non-Fpo])

0104f8c0 77e59dc9 010d0aa8 00000558 0000f670spoolsv!RpcCommitSpoolData2+0x1b (FPO: [Non-Fpo])

WARNING: Stack unwind information notavailable. Following frames may be wrong.

0104f8e8 77ed321a 01007f8a 0104f8fc00000005 RPCRT4!CheckVerificationTrailer+0x75

0104fcf8 77ed36ee 00000000 00000000000d7edc RPCRT4!NdrStubCall2+0x215

0104fd14 77e5988c 000d7edc 0009c970000d7edc RPCRT4!NdrServerCall2+0x19

0104fd48 77e597f1 01002c6d000d7edc 0104fdf0 RPCRT4!NdrGetTypeFlags+0x1c9

0104fd9c 77e5971d 0000005e 00000000 0100d1f0 RPCRT4!NdrGetTypeFlags+0x12e

0104fdc0 77e5bd0d 000d7edc 000000000100d1f0RPCRT4!NdrGetTypeFlags+0x5a

0104fdfc 77e5bb6a 00101670 0009c6d8000bcaf0 RPCRT4!NdrConformantArrayFree+0x42e

0104fe20 77e56784 0009c714 0104fe38 000bcaf0 RPCRT4!NdrConformantArrayFree+0x28b

0104ff80 77e56c22 0104ffa8 77e56a3b0009c6d8RPCRT4!I_RpcBCacheFree+0x14c

0104ff88 77e56a3b 0009c6d80134fa54 00000002 RPCRT4!I_RpcBCacheFree+0x5ea

0104ffa8 77e56c0a0009a8a0 0104ffec 7c80b50b RPCRT4!I_RpcBCacheFree+0x403

0104ffb4 7c80b50b 000b6470 0134fa54 00000002RPCRT4!I_RpcBCacheFree+0x5d2

0104ffec 00000000 77e56bf0 000b647000000000 kernel32!GetModuleFileNameA+0x1b4

4.        由远程打印提供者发送到远端进行打印,远端的栈是这样的

0295f13c 00db9295 05f3c8a8 02b2dac0 0000f670localspl!SplWritePrinter (FPO: [Non-Fpo])

0295f154 00da8f7e 00aac040 02b2dac0 0000f670 spoolsv!WritePrinter+0x2c(FPO: [Non-Fpo])

0295f170 00da5800 00aac04002b2dac0 0000f670spoolsv!YWritePrinter+0x2b (FPO: [Non-Fpo])

0295f198 7621fc8f 00aac040 02b2dac0 0000f670 spoolsv!RpcWritePrinter+0x40(FPO: [Non-Fpo])

0295f1bc 76284c53 00da57c0 0295f3a8 00000004 RPCRT4!Invoke+0x2a

0295f5c4 7628430e 00000000 00000000 0658636c RPCRT4!NdrStubCall2+0x2d6

0295f5e0 7621f34a0658636c a764c675 0031e0f0 RPCRT4!NdrServerCall2+0x19

0295f61c 7621f4da762842f5 0658636c 0295f6cc RPCRT4!DispatchToStubInCNoAvrf+0x4a

0295f674 7621f3c60031e0f0 00000000 00000000RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x16c

0295f69c 76203e40 00000000 00000000 0295f6cc RPCRT4!RPC_INTERFACE::DispatchToStub+0x8b

0295f734 76203d3c 065862a8065862a8 00000dccRPCRT4!OSF_SCALL::DispatchHelper+0x24d

0295f74c 76203b50 00000000 06492f5000000000 RPCRT4!OSF_SCALL::DispatchRPCCall+0x101

0295f780 7623e476 06492f50 00000000 0000000c RPCRT4!OSF_SCALL::ProcessReceivedPDU+0x650

0295f7e0 76206157 0652a5b0 00000000 06492f50RPCRT4!OSF_SCONNECTION::ProcessReceiveComplete+0x207

0295f7fc 762060f4 00392c58 0000000c00000000 RPCRT4!DispatchIOHelper+0xcf

0295f844 76205fff 0295f930 00000000 0652a730 RPCRT4!CO_ConnectionThreadPoolCallback+0x141

0295f86c 75f327cb0295f930 00000000 0652a730RPCRT4!CO_NmpThreadPoolCallback+0x7c

0295f890 77cce7af 0295f930 00392db0 0652a730 KERNELBASE!BasepTpIoCallback+0x2f (FPO: [Non-Fpo])

0295f8ec 77cf0748 0295f930 003cd7f8 0652a730ntdll!TppIopExecuteCallback+0x1c5(FPO: [Non-Fpo])

0295fa54 76161174 00310238 0295faa0 77d1b3f5 ntdll!TppWorkerThread+0x5a4 (FPO: [Non-Fpo])

0295fa60 77d1b3f500310238 74216d84 00000000 kernel32!BaseThreadInitThunk+0xe (FPO: [Non-Fpo])

0295faa0 77d1b3c877ced63e 00310238 00000000 ntdll!__RtlUserThreadStart+0x70 (FPO: [Non-Fpo])

0295fab8 00000000 77ced63e 00310238 00000000ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])

5.        远端再调用EMF的打印处理器

0225ef78 73d542b7 05f56fa8 0225f0e8 00000000 winprint!PrintDocumentOnPrintProcessor(FPO: [Non-Fpo])

0225ef98 6149c35c 0663737c0225f0e8 00b06a4cPrintIsolationProxy!sandbox::PrintProcessor::PrintDocThroughPrintProcessor+0x49(FPO: [Non-Fpo])

0225f004 6149b052 00ad69c4 0225f0e800b06a4clocalspl!sandbox::PrintProcessorExecuteObserver::PrintDocThroughPrintProcessor+0x84(FPO: [Non-Fpo])

0225f020 61499d20 00ad69c4 0225f0e800b06a4clocalspl!sandbox::PrintProcessorAdapterImpl::PrintDocumentOnPrintProcessor+0x27(FPO: [Non-Fpo])

0225f04c 61460400 00a9dec80225f0e8 0018c938localspl!sandbox::PrintProcessorAdapter::PrintDocumentOnPrintProcessor+0x77(FPO: [Non-Fpo])

0225f72c 614615fe 00aa4f200225f74c 00000000localspl!PrintDocumentThruPrintProcessor+0x3bd (FPO: [Non-Fpo])

0225f98c 76161174 00aa4f200225f9d8 77d1b3f5 localspl!PortThread+0x41c (FPO: [Non-Fpo])

0225f998 77d1b3f5 00aa4f20 74916efc 00000000kernel32!BaseThreadInitThunk+0xe (FPO: [Non-Fpo])

0225f9d8 77d1b3c8 614611e2 00aa4f20 00000000 ntdll!__RtlUserThreadStart+0x70 (FPO:[Non-Fpo])

0225f9f0 00000000 614611e2 00aa4f20 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO:[Non-Fpo])

6.        结束打印

0134f8b4 7424504f 0093db68 0134f8d001004d86 win32spl!RemoteEndDocPrinter(FPO: [Non-Fpo])

0134f8c0 01004d86 010d0aa8 0134f9080134f8e0SPOOLSS!EndDocPrinter+0x29 (FPO: [Non-Fpo])

0134f8d0 01007add 010d0aa800000001 0134f8f8 spoolsv!YEndDocPrinter+0x1a (FPO: [Non-Fpo])

0134f8e0 77e59dc9 010d0aa802020202 00000001 spoolsv!RpcEndDocPrinter+0xf (FPO: [Non-Fpo])

WARNING: Stack unwind information not available. Following frames maybe wrong.

0134f8f8 77ed321a01007ace 0134f90c 00000001 RPCRT4!CheckVerificationTrailer+0x75

0134fcf8 77ed36ee 00000000 00000000 000d7edc RPCRT4!NdrStubCall2+0x215

0134fd14 77e5988c000d7edc 0009c970 000d7edcRPCRT4!NdrServerCall2+0x19

0134fd48 77e597f1 01002c6d 000d7edc 0134fdf0RPCRT4!NdrGetTypeFlags+0x1c9

0134fd9c77e5971d 00000017 00000000 0100d1f0RPCRT4!NdrGetTypeFlags+0x12e

0134fdc0 77e5bd0d 000d7edc 00000000 0100d1f0 RPCRT4!NdrGetTypeFlags+0x5a

0134fdfc 77e5bb6a 000c8920 0009c6d8 000bcaf0 RPCRT4!NdrConformantArrayFree+0x42e

0134fe20 77e56784 0009c7140134fe38 000bcaf0 RPCRT4!NdrConformantArrayFree+0x28b

0134ff80 77e56c220134ffa8 77e56a3b 0009c6d8 RPCRT4!I_RpcBCacheFree+0x14c

0134ff88 77e56a3b 0009c6d8 00000048 0100212eRPCRT4!I_RpcBCacheFree+0x5ea

0134ffa8 77e56c0a 0009a8a0 0134ffec 7c80b50b RPCRT4!I_RpcBCacheFree+0x403

0134ffb4 7c80b50b000b2e98 00000048 0100212e RPCRT4!I_RpcBCacheFree+0x5d2

0134ffec 00000000 77e56bf0 000b2e98 00000000kernel32!GetModuleFileNameA+0x1b4

 虚拟打印Microsoft Document Imaging的功能实现是在mdippr.dll中,是它的打印处理器中实现的。其它有的是在打印端器监视器实现的。

你可能感兴趣的:(windows,打印管理)