{"id":122333,"date":"2026-11-04T18:24:41","date_gmt":"2026-11-04T10:24:41","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/122333.html"},"modified":"2026-11-04T18:24:41","modified_gmt":"2026-11-04T10:24:41","slug":"01-06-windows-%e8%bd%af%e4%bb%b6%e4%bd%93%e7%b3%bb-%e7%ba%b5%e5%90%91%e5%85%b3%e7%b3%bb%e9%93%be%e7%a9%bf%e9%80%8f%e6%9c%ba%e5%88%b6%e4%bb%8e%e5%ba%94%e7%94%a8%e5%88%b0%e7%a1%ac%e4%bb%b6%ef%bc%88","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/122333.html","title":{"rendered":"01-06 Windows \u8f6f\u4ef6\u4f53\u7cfb - \u7eb5\u5411\u5173\u7cfb\u94fe\u7a7f\u900f\u673a\u5236\u4ece\u5e94\u7528\u5230\u786c\u4ef6\uff08\u4e0a\uff09"},"content":{"rendered":"<p>        \/* MD \/ \u5bcc\u6587\u672c\u4e2d\u7684 .toc\uff08\u542b\u535a\u5ba2\u56ed\u642c\u5bb6\u7b49\u5d4c\u5957\u7ed3\u6784\uff09\uff1b.toc-box \u5728\u4fa7\u680f\uff0c\u4e0d\u53d7\u5f71\u54cd *\/<br \/>\n        #content_views .toc,<br \/>\n        \/* \u7f16\u8f91\u5668\u5e38\u5728\u76ee\u5f55\u524d\u540e\u63d2\u5165\u7a7a p\uff08:empty \u4ecd\u5360 20px\uff09\uff0c\u4e00\u5e76\u53bb\u6389\u907f\u514d\u9876\u7a7a\u9699 *\/<br \/>\n        #content_views.markdown_views &gt; p:empty:has(+ .toc),<br \/>\n        #content_views.markdown_views &gt; .toc + p:empty,<br \/>\n        \/* \u5bcc\u6587\u672c\u65e7\u7248\u76ee\u5f55\u6807\u8bb0 *\/<br \/>\n        #content_views.htmledit_views #main-toc,<br \/>\n        #content_views.htmledit_views #hr-toc,<br \/>\n        #content_views.htmledit_views p[id*=\\&#8221;-toc\\&#8221;] {<br \/>\n          display: none !important;<br \/>\n        }<br \/>\n        \/* \u76ee\u5f55\u53bb\u6389\u540e\uff0c\u7d27\u8ddf\u7684\u9996\u4e2a\u6807\u9898\u4e0d\u518d\u591a\u51fa\u4e00\u5757\u4e0a\u8fb9\u8ddd *\/<br \/>\n        #content_views.markdown_views &gt; .toc + h1,<br \/>\n        #content_views.markdown_views &gt; .toc + h2,<br \/>\n        #content_views.markdown_views &gt; .toc + h3,<br \/>\n        #content_views.markdown_views &gt; .toc + h4,<br \/>\n        #content_views.markdown_views &gt; .toc + p:empty + h1,<br \/>\n        #content_views.markdown_views &gt; .toc + p:empty + h2,<br \/>\n        #content_views.markdown_views &gt; .toc + p:empty + h3,<br \/>\n        #content_views.markdown_views &gt; .toc + p:empty + h4 {<br \/>\n          margin-top: 0 !important;<br \/>\n        }<\/p>\n<h2>\u7eb5\u5411\u5173\u7cfb\u94fe\u7a7f\u900f\u673a\u5236&#xff1a;\u4ece\u5e94\u7528\u5230\u786c\u4ef6<\/h2>\n<p>Windows \u8f6f\u4ef6\u4f53\u7cfb\u5168\u94fe\u8def\u62c6\u89e3\u7cfb\u5217 \u00b7 \u7b2c 01-06 \u7bc7<\/p>\n<p>\u672c\u6587\u6df1\u5165\u5256\u6790 Windows \u64cd\u4f5c\u7cfb\u7edf\u4e2d\u4e00\u4e2a I\/O \u8bf7\u6c42\u4ece\u5e94\u7528\u7a0b\u5e8f\u5c42\u9010\u5c42\u7a7f\u900f\u81f3\u7269\u7406\u786c\u4ef6\u7684\u5b8c\u6574\u673a\u5236\u3002\u6211\u4eec\u5c06\u6cbf\u7740\u5341\u5c42\u5173\u7cfb\u94fe\u6a21\u578b&#xff0c;\u9010\u5c42\u62c6\u89e3\u6bcf\u4e00\u5c42\u7684\u5c01\u88c5\u8fb9\u754c\u3001\u7a7f\u900f\u65b9\u5f0f\u3001\u53c2\u6570\u8f6c\u6362\u4e0e\u6570\u636e\u7ed3\u6784\u53d8\u5316&#xff0c;\u5e76\u901a\u8fc7\u6c47\u7f16\u7ea7\u4ee3\u7801\u3001\u5185\u6838\u6570\u636e\u7ed3\u6784\u548c Mermaid \u56fe\u8868\u8fdb\u884c\u7cbe\u786e\u8fd8\u539f\u3002<\/p>\n<hr \/>\n<h3>\u76ee\u5f55<\/h3>\n<ul>\n<li>1. \u5173\u7cfb\u94fe\u603b\u89c8<\/li>\n<li>2. \u7eb5\u5411\u7a7f\u900f\u7684\u5b9a\u4e49\u4e0e\u672c\u8d28<\/li>\n<li>3. \u7b2c1\u5c42\u7a7f\u900f&#xff1a;\u5e94\u7528\u7a0b\u5e8f\u2192\u7f16\u7a0b\u8bed\u8a00<\/li>\n<li>4. \u7b2c2\u5c42\u7a7f\u900f&#xff1a;\u7f16\u7a0b\u8bed\u8a00\u2192\u8fd0\u884c\u65f6\u5e93<\/li>\n<li>5. \u7b2c3\u5c42\u7a7f\u900f&#xff1a;\u8fd0\u884c\u65f6\u5e93\u2192Windows API<\/li>\n<li>6. \u7b2c4\u5c42\u7a7f\u900f&#xff1a;Windows API\u2192NT API<\/li>\n<li>7. \u7b2c5\u5c42\u7a7f\u900f&#xff1a;NT API\u2192syscall<\/li>\n<li>8. \u7b2c6\u5c42\u7a7f\u900f&#xff1a;syscall\u2192\u5185\u6838<\/li>\n<li>9. \u7b2c7\u5c42\u7a7f\u900f&#xff1a;\u5185\u6838\u2192\u9a71\u52a8<\/li>\n<li>10. \u7b2c8\u5c42\u7a7f\u900f&#xff1a;\u9a71\u52a8\u2192HAL<\/li>\n<li>11. \u7b2c9\u5c42\u7a7f\u900f&#xff1a;HAL\u2192\u786c\u4ef6<\/li>\n<li>12. \u5b8c\u6574\u7a7f\u900f\u6848\u4f8b&#xff1a;CreateFile \u5168\u94fe\u8def<\/li>\n<li>13. \u7a7f\u900f\u7684\u5c01\u88c5\u5c42\u6b21\u603b\u7ed3<\/li>\n<li>14. \u7a7f\u900f\u6027\u80fd\u5206\u6790<\/li>\n<li>15. \u603b\u7ed3<\/li>\n<\/ul>\n<hr \/>\n<h3>1. \u5173\u7cfb\u94fe\u603b\u89c8<\/h3>\n<h4>1.1 \u5341\u5c42\u6a21\u578b\u6982\u8ff0<\/h4>\n<p>\u5728 Windows \u64cd\u4f5c\u7cfb\u7edf\u4e2d&#xff0c;\u5f53\u4e00\u4e2a\u5e94\u7528\u7a0b\u5e8f\u6267\u884c\u4e00\u4e2a\u770b\u4f3c\u7b80\u5355\u7684\u64cd\u4f5c\u2014\u2014\u4f8b\u5982\u8bfb\u53d6\u4e00\u4e2a\u6587\u4ef6\u3001\u7ed8\u5236\u4e00\u4e2a\u7a97\u53e3\u3001\u53d1\u9001\u4e00\u4e2a\u7f51\u7edc\u5305\u2014\u2014\u8fd9\u4e2a\u8bf7\u6c42\u5e76\u975e\u76f4\u63a5\u5230\u8fbe\u7269\u7406\u786c\u4ef6\u3002\u5b83\u9700\u8981\u7a7f\u8d8a\u4e00\u6761\u7531\u5341\u5c42\u62bd\u8c61\u6784\u6210\u7684\u7eb5\u5411\u5173\u7cfb\u94fe\u3002\u6bcf\u4e00\u5c42\u90fd\u4e3a\u4e0a\u4e00\u5c42\u63d0\u4f9b\u5c01\u88c5&#xff0c;\u540c\u65f6\u5411\u4e0b\u4e00\u5c42\u4f20\u9012\u8bf7\u6c42\u3002\u8fd9\u6761\u5173\u7cfb\u94fe\u662f Windows \u8f6f\u4ef6\u4f53\u7cfb\u67b6\u6784\u7684\u810a\u6881&#xff0c;\u7406\u89e3\u5b83\u5c31\u7406\u89e3\u4e86 Windows \u7684\u8fd0\u884c\u672c\u8d28\u3002<\/p>\n<p>\u5341\u5c42\u6a21\u578b\u4ece\u6700\u9ad8\u5c42\u7684\u7528\u6237\u4ee3\u7801\u5230\u6700\u4f4e\u5c42\u7684\u7269\u7406\u786c\u4ef6&#xff0c;\u4f9d\u6b21\u4e3a&#xff1a;<\/p>\n<p>\u5e94\u7528\u7a0b\u5e8f \u2192 \u7f16\u7a0b\u8bed\u8a00 \u2192 \u8fd0\u884c\u65f6\u5e93 \u2192 \u6846\u67b6 \u2192 Windows API \u2192 NT API \u2192 syscall \u2192 \u5185\u6838 \u2192 \u9a71\u52a8 \u2192 HAL \u2192 \u786c\u4ef6<\/p>\n<h4>1.2 \u5404\u5c42\u7b80\u8981\u804c\u8d23<\/h4>\n<p>\u4e0b\u9762\u9010\u4e00\u8bf4\u660e\u6bcf\u4e00\u5c42\u7684\u6838\u5fc3\u804c\u8d23\u3001\u8fd0\u884c\u73af\u5883\u548c\u5178\u578b\u7ec4\u4ef6\u3002<\/p>\n<h5>\u7b2c1\u5c42&#xff1a;\u5e94\u7528\u7a0b\u5e8f&#xff08;Application&#xff09;<\/h5>\n<p>\u5e94\u7528\u7a0b\u5e8f\u662f\u7528\u6237\u76f4\u63a5\u7f16\u5199\u7684\u4e1a\u52a1\u4ee3\u7801&#xff0c;\u8fd0\u884c\u5728\u7528\u6237\u6001&#xff08;Ring 3&#xff09;\u3002\u5b83\u8868\u8fbe\u7684\u662f&#034;\u505a\u4ec0\u4e48&#034;&#xff08;What to do&#xff09;&#xff0c;\u800c\u975e&#034;\u600e\u4e48\u505a&#034;&#xff08;How to do&#xff09;\u3002\u5e94\u7528\u7a0b\u5e8f\u7684\u4ee3\u7801\u53ef\u4ee5\u662f C# \u7684\u6309\u94ae\u70b9\u51fb\u4e8b\u4ef6\u5904\u7406\u5668\u3001C&#043;&#043; \u7684\u4e1a\u52a1\u903b\u8f91\u51fd\u6570\u3001Python \u7684\u6570\u636e\u5904\u7406\u811a\u672c\u7b49\u3002\u6b64\u5c42\u5173\u6ce8\u7684\u662f\u4e1a\u52a1\u9886\u57df\u903b\u8f91&#xff0c;\u4f8b\u5982&#034;\u8bfb\u53d6\u914d\u7f6e\u6587\u4ef6&#034;\u3001\u201c\u4fdd\u5b58\u7528\u6237\u6570\u636e\u201d\u3001&#034;\u663e\u793a\u62a5\u8868&#034;\u7b49&#xff0c;\u5b8c\u5168\u4e0d\u6d89\u53ca\u5e95\u5c42\u5b9e\u73b0\u7ec6\u8282\u3002<\/p>\n<ul>\n<li>\u8fd0\u884c\u73af\u5883&#xff1a;\u7528\u6237\u6001\u8fdb\u7a0b\u5730\u5740\u7a7a\u95f4<\/li>\n<li>\u5178\u578b\u7ec4\u4ef6&#xff1a;\u4e1a\u52a1\u903b\u8f91\u4ee3\u7801\u3001UI \u4e8b\u4ef6\u5904\u7406\u5668\u3001\u6570\u636e\u8bbf\u95ee\u5c42<\/li>\n<li>\u5730\u5740\u7a7a\u95f4&#xff1a;\u8fdb\u7a0b\u79c1\u6709\u865a\u62df\u5730\u5740\u7a7a\u95f4&#xff08;\u4f4e 2TB \u7528\u6237\u533a&#xff0c;x64 \u4e0b\u7406\u8bba\u4e0a\u53ef\u8fbe 128TB&#xff09;<\/li>\n<li>\u7279\u6743\u7ea7\u522b&#xff1a;Ring 3&#xff08;CPL&#061;3&#xff09;<\/li>\n<\/ul>\n<h5>\u7b2c2\u5c42&#xff1a;\u7f16\u7a0b\u8bed\u8a00&#xff08;Programming Language&#xff09;<\/h5>\n<p>\u7f16\u7a0b\u8bed\u8a00\u5c42\u8d1f\u8d23\u5c06\u5f00\u53d1\u8005\u7f16\u5199\u7684\u9ad8\u7ea7\u8bed\u8a00\u4ee3\u7801\u7ffb\u8bd1\u4e3a\u673a\u5668\u53ef\u6267\u884c\u7684\u6307\u4ee4\u3002\u5bf9\u4e8e\u7f16\u8bd1\u578b\u8bed\u8a00&#xff08;C\/C&#043;&#043;\/Rust&#xff09;&#xff0c;\u8fd9\u4e00\u6b65\u7531\u7f16\u8bd1\u5668\u5728\u7f16\u8bd1\u65f6\u5b8c\u6210&#xff1b;\u5bf9\u4e8e\u89e3\u91ca\u578b\u8bed\u8a00&#xff08;Python\/Ruby&#xff09;&#xff0c;\u7531\u89e3\u91ca\u5668\u5728\u8fd0\u884c\u65f6\u9010\u884c\u7ffb\u8bd1&#xff1b;\u5bf9\u4e8e JIT \u578b\u8bed\u8a00&#xff08;C#\/Java&#xff09;&#xff0c;\u5148\u7f16\u8bd1\u4e3a\u4e2d\u95f4\u8bed\u8a00&#xff08;IL\/\u5b57\u8282\u7801&#xff09;&#xff0c;\u518d\u5728\u8fd0\u884c\u65f6\u7531 JIT \u7f16\u8bd1\u5668\u7ffb\u8bd1\u4e3a\u673a\u5668\u7801\u3002\u6b64\u5c42\u662f\u6e90\u4ee3\u7801\u5230\u673a\u5668\u6307\u4ee4\u7684\u6865\u6881\u3002<\/p>\n<ul>\n<li>\u8fd0\u884c\u73af\u5883&#xff1a;\u7f16\u8bd1\u65f6&#xff08;\u79bb\u7ebf&#xff09;\u6216\u8fd0\u884c\u65f6&#xff08;JIT\/\u89e3\u91ca\u5668&#xff09;<\/li>\n<li>\u5178\u578b\u7ec4\u4ef6&#xff1a;MSVC \u7f16\u8bd1\u5668&#xff08;cl.exe&#xff09;\u3001Roslyn \u7f16\u8bd1\u5668\u3001GCC\u3001LLVM<\/li>\n<li>\u8f93\u51fa\u4ea7\u7269&#xff1a;\u673a\u5668\u7801&#xff08;x86\/x64 \u6307\u4ee4&#xff09;\u3001IL \u5b57\u8282\u7801\u3001Python \u5b57\u8282\u7801<\/li>\n<\/ul>\n<h5>\u7b2c3\u5c42&#xff1a;\u8fd0\u884c\u65f6\u5e93&#xff08;Runtime Library&#xff09;<\/h5>\n<p>\u8fd0\u884c\u65f6\u5e93\u63d0\u4f9b\u7f16\u7a0b\u8bed\u8a00\u6807\u51c6\u5e93\u7684\u5177\u4f53\u5b9e\u73b0\u3002C\/C&#043;&#043; \u7684 CRT&#xff08;C Runtime Library&#xff09;\u5b9e\u73b0\u4e86 fopen\u3001fread\u3001printf\u3001malloc \u7b49\u6807\u51c6\u51fd\u6570&#xff1b;.NET \u7684 BCL&#xff08;Base Class Library&#xff09;\u5b9e\u73b0\u4e86 File\u3001Stream\u3001Console \u7b49\u7c7b&#xff1b;Python \u7684\u6807\u51c6\u5e93\u5b9e\u73b0\u4e86 open()\u3001print() \u7b49\u3002\u8fd0\u884c\u65f6\u5e93\u5c06\u8bed\u8a00\u6807\u51c6\u5b9a\u4e49\u7684\u62bd\u8c61\u63a5\u53e3\u6620\u5c04\u4e3a\u64cd\u4f5c\u7cfb\u7edf API \u8c03\u7528\u3002<\/p>\n<ul>\n<li>\u8fd0\u884c\u73af\u5883&#xff1a;\u7528\u6237\u6001&#xff0c;\u4ee5\u52a8\u6001\u94fe\u63a5\u5e93&#xff08;DLL&#xff09;\u6216\u9759\u6001\u5e93&#xff08;.lib&#xff09;\u5f62\u5f0f\u5b58\u5728<\/li>\n<li>\u5178\u578b\u7ec4\u4ef6&#xff1a;ucrtbase.dll&#xff08;Universal CRT&#xff09;\u3001msvcrt.dll\u3001corelib.dll&#xff08;.NET&#xff09;\u3001python3x.dll<\/li>\n<li>\u6838\u5fc3\u804c\u8d23&#xff1a;\u5b9e\u73b0\u8bed\u8a00\u6807\u51c6\u5e93\u51fd\u6570&#xff0c;\u6865\u63a5\u8bed\u8a00\u62bd\u8c61\u4e0e OS API<\/li>\n<\/ul>\n<h5>\u7b2c4\u5c42&#xff1a;\u6846\u67b6&#xff08;Framework&#xff09;<\/h5>\n<p>\u6846\u67b6\u5c42&#xff08;\u5982 WPF\u3001WinForms\u3001ASP.NET\u3001MFC&#xff09;\u5728\u8fd0\u884c\u65f6\u5e93\u4e4b\u4e0a\u63d0\u4f9b\u66f4\u9ad8\u5c42\u6b21\u7684\u9886\u57df\u62bd\u8c61\u3002WPF \u5c06&#034;\u521b\u5efa\u7a97\u53e3&#034;\u5c01\u88c5\u4e3a Window \u7c7b\u7684\u5b9e\u4f8b\u5316&#xff1b;MFC \u5c06 Win32 \u6d88\u606f\u5faa\u73af\u5c01\u88c5\u4e3a CWinApp::Run()\u3002\u5e76\u975e\u6240\u6709\u5e94\u7528\u90fd\u7ecf\u8fc7\u6846\u67b6\u5c42\u2014\u2014\u63a7\u5236\u53f0\u7a0b\u5e8f\u901a\u5e38\u76f4\u63a5\u8c03\u7528\u8fd0\u884c\u65f6\u5e93\u548c Win32 API\u3002\u4f46\u73b0\u4ee3\u5e94\u7528\u5927\u591a\u4f7f\u7528\u6846\u67b6\u6765\u7b80\u5316\u5f00\u53d1\u3002<\/p>\n<ul>\n<li>\u8fd0\u884c\u73af\u5883&#xff1a;\u7528\u6237\u6001&#xff0c;\u4ee5 DLL \u6216 NuGet \u5305\u5f62\u5f0f\u5b58\u5728<\/li>\n<li>\u5178\u578b\u7ec4\u4ef6&#xff1a;PresentationCore.dll&#xff08;WPF&#xff09;\u3001System.Windows.Forms.dll\u3001mfc140u.dll<\/li>\n<li>\u6838\u5fc3\u804c\u8d23&#xff1a;\u63d0\u4f9b\u9886\u57df\u7ea7\u62bd\u8c61&#xff0c;\u7b80\u5316\u5e38\u7528\u64cd\u4f5c\u6a21\u5f0f<\/li>\n<\/ul>\n<h5>\u7b2c5\u5c42&#xff1a;Windows API&#xff08;Win32 API&#xff09;<\/h5>\n<p>Windows API&#xff08;\u53c8\u79f0 Win32 API&#xff09;\u662f\u5fae\u8f6f\u516c\u5f00\u7684\u3001\u9762\u5411\u7528\u6237\u6001\u5e94\u7528\u7a0b\u5e8f\u7684\u7cfb\u7edf\u7f16\u7a0b\u63a5\u53e3\u3002\u5b83\u7531 kernel32.dll\u3001user32.dll\u3001gdi32.dll\u3001advapi32.dll \u7b49\u5bfc\u51fa\u3002CreateFileW\u3001ReadFile\u3001WriteFile\u3001CloseHandle \u7b49\u51fd\u6570\u6784\u6210\u4e86 Windows \u7f16\u7a0b\u7684\u57fa\u7840\u3002Win32 API \u5728\u5185\u90e8\u8c03\u7528 NT API \u5b8c\u6210\u5b9e\u9645\u5de5\u4f5c&#xff0c;\u5e76\u8d1f\u8d23\u53c2\u6570\u683c\u5f0f\u8f6c\u6362\u548c\u9519\u8bef\u7801\u6620\u5c04\u3002<\/p>\n<ul>\n<li>\u8fd0\u884c\u73af\u5883&#xff1a;\u7528\u6237\u6001&#xff0c;DLL \u5bfc\u51fa\u51fd\u6570<\/li>\n<li>\u5178\u578b\u7ec4\u4ef6&#xff1a;kernel32.dll\u3001user32.dll\u3001gdi32.dll\u3001advapi32.dll\u3001ole32.dll<\/li>\n<li>\u6838\u5fc3\u804c\u8d23&#xff1a;\u63d0\u4f9b\u9762\u5411\u5e94\u7528\u7684\u516c\u5171 API&#xff0c;\u5c01\u88c5 NT API \u7684\u590d\u6742\u7ec6\u8282<\/li>\n<\/ul>\n<h5>\u7b2c6\u5c42&#xff1a;NT API&#xff08;Native API&#xff09;<\/h5>\n<p>NT API \u662f Windows NT \u5185\u6838\u7684\u539f\u751f\u63a5\u53e3&#xff0c;\u7531 ntdll.dll \u5bfc\u51fa\u3002\u5b83\u662f\u7528\u6237\u6001\u80fd\u89e6\u53ca\u7684\u6700\u5e95\u5c42\u63a5\u53e3&#xff0c;\u76f4\u63a5\u901a\u8fc7 syscall \u6307\u4ee4\u8fdb\u5165\u5185\u6838\u3002NtCreateFile\u3001NtReadFile\u3001NtWriteFile\u3001NtClose \u7b49\u51fd\u6570\u4f7f\u7528 UNICODE_STRING\u3001OBJECT_ATTRIBUTES \u7b49 NT \u4e13\u7528\u6570\u636e\u7ed3\u6784\u3002Win32 API \u5728\u5185\u90e8\u8c03\u7528\u8fd9\u4e9b NT \u51fd\u6570\u3002<\/p>\n<ul>\n<li>\u8fd0\u884c\u73af\u5883&#xff1a;\u7528\u6237\u6001&#xff08;ntdll.dll \u5bfc\u51fa&#xff09;&#043; \u5185\u6838\u6001&#xff08;ntoskrnl.exe \u5bf9\u5e94\u5b9e\u73b0&#xff09;<\/li>\n<li>\u5178\u578b\u7ec4\u4ef6&#xff1a;ntdll.dll&#xff08;\u7528\u6237\u6001\u4fa7&#xff09;\u3001ntoskrnl.exe&#xff08;\u5185\u6838\u6001\u4fa7&#xff09;<\/li>\n<li>\u6838\u5fc3\u804c\u8d23&#xff1a;\u5b9a\u4e49\u7528\u6237\u6001\/\u5185\u6838\u6001\u7684\u5951\u7ea6\u8fb9\u754c&#xff0c;\u6267\u884c syscall \u5207\u6362<\/li>\n<\/ul>\n<h5>\u7b2c7\u5c42&#xff1a;syscall&#xff08;\u7cfb\u7edf\u8c03\u7528&#xff09;<\/h5>\n<p>syscall \u662f x64 \u67b6\u6784\u4e0a\u7684\u5feb\u901f\u7cfb\u7edf\u8c03\u7528\u6307\u4ee4&#xff0c;\u662f\u7528\u6237\u6001&#xff08;Ring 3&#xff09;\u8fdb\u5165\u5185\u6838\u6001&#xff08;Ring 0&#xff09;\u7684\u6807\u51c6\u5165\u53e3\u3002ntdll.dll \u4e2d\u7684 Nt* \u51fd\u6570\u5728\u5c06\u53c2\u6570\u653e\u5165\u5bc4\u5b58\u5668\u540e\u6267\u884c syscall \u6307\u4ee4&#xff0c;CPU \u81ea\u52a8\u5207\u6362\u5230\u5185\u6838\u6001\u5e76\u8df3\u8f6c\u5230\u5185\u6838\u7684 KiSystemCallStart \u5165\u53e3\u3002syscall \u53f7\u7528\u4e8e\u5728 SSDT&#xff08;System Service Descriptor Table&#xff09;\u4e2d\u67e5\u627e\u5bf9\u5e94\u7684\u5185\u6838\u51fd\u6570\u3002<\/p>\n<ul>\n<li>\u8fd0\u884c\u73af\u5883&#xff1a;CPU \u7279\u6743\u7ea7\u5207\u6362\u70b9&#xff08;Ring 3 \u2192 Ring 0&#xff09;<\/li>\n<li>\u5178\u578b\u7ec4\u4ef6&#xff1a;syscall \u6307\u4ee4\u3001MSR \u5bc4\u5b58\u5668&#xff08;IA32_LSTAR\u3001IA32_STAR&#xff09;\u3001SSDT<\/li>\n<li>\u6838\u5fc3\u804c\u8d23&#xff1a;\u5b89\u5168\u5730\u6267\u884c\u7279\u6743\u7ea7\u5207\u6362&#xff0c;\u8def\u7531\u5230\u6b63\u786e\u7684\u5185\u6838\u670d\u52a1\u4f8b\u7a0b<\/li>\n<\/ul>\n<h5>\u7b2c8\u5c42&#xff1a;\u5185\u6838&#xff08;Kernel&#xff09;<\/h5>\n<p>Windows \u5185\u6838&#xff08;ntoskrnl.exe&#xff09;\u662f\u64cd\u4f5c\u7cfb\u7edf\u7684\u6838\u5fc3&#xff0c;\u8fd0\u884c\u5728 Ring 0\u3002\u5b83\u7ba1\u7406\u8fdb\u7a0b\/\u7ebf\u7a0b\u3001\u5185\u5b58\u3001I\/O\u3001\u5bf9\u8c61\u3001\u5b89\u5168\u7b49\u5b50\u7cfb\u7edf\u3002\u5f53 syscall \u8fdb\u5165\u5185\u6838\u540e&#xff0c;\u5bf9\u5e94\u7684 Nt* \u5185\u6838\u51fd\u6570&#xff08;\u5982 NtCreateFile&#xff09;\u88ab\u8c03\u7528&#xff0c;\u6267\u884c\u5b9e\u9645\u7cfb\u7edf\u64cd\u4f5c\u3002\u5185\u6838\u901a\u8fc7 I\/O \u7ba1\u7406\u5668\u521b\u5efa IRP \u5e76\u53d1\u9001\u7ed9\u8bbe\u5907\u9a71\u52a8\u7a0b\u5e8f\u3002<\/p>\n<ul>\n<li>\u8fd0\u884c\u73af\u5883&#xff1a;\u5185\u6838\u6001&#xff08;Ring 0&#xff09;&#xff0c;\u7cfb\u7edf\u5730\u5740\u7a7a\u95f4&#xff08;\u9ad8 2TB&#xff09;<\/li>\n<li>\u5178\u578b\u7ec4\u4ef6&#xff1a;ntoskrnl.exe&#xff08;\u6267\u884c\u4f53&#043;\u5185\u6838&#xff09;\u3001win32k.sys&#xff08;\u7a97\u53e3\/\u56fe\u5f62\u5b50\u7cfb\u7edf&#xff09;<\/li>\n<li>\u6838\u5fc3\u804c\u8d23&#xff1a;\u7cfb\u7edf\u8d44\u6e90\u7ba1\u7406\u3001\u5b89\u5168\u68c0\u67e5\u3001I\/O \u8c03\u5ea6\u3001\u5bf9\u8c61\u7ba1\u7406<\/li>\n<\/ul>\n<h5>\u7b2c9\u5c42&#xff1a;\u9a71\u52a8&#xff08;Driver&#xff09;<\/h5>\n<p>\u8bbe\u5907\u9a71\u52a8\u7a0b\u5e8f\u662f\u5185\u6838\u53ef\u52a0\u8f7d\u6a21\u5757&#xff08;.sys \u6587\u4ef6&#xff09;&#xff0c;\u8fd0\u884c\u5728\u5185\u6838\u6001&#xff0c;\u8d1f\u8d23\u4e0e\u7279\u5b9a\u786c\u4ef6\u8bbe\u5907\u901a\u4fe1\u3002\u9a71\u52a8\u7a0b\u5e8f\u63a5\u6536\u5185\u6838 I\/O \u7ba1\u7406\u5668\u53d1\u9001\u7684 IRP&#xff08;I\/O Request Packet&#xff09;&#xff0c;\u89e3\u6790\u5176\u4e2d\u7684\u8bf7\u6c42\u53c2\u6570&#xff0c;\u6267\u884c\u8bbe\u5907\u7279\u5b9a\u64cd\u4f5c&#xff0c;\u5e76\u901a\u8fc7 HAL \u63a5\u53e3\u8bbf\u95ee\u786c\u4ef6\u5bc4\u5b58\u5668\u3002<\/p>\n<ul>\n<li>\u8fd0\u884c\u73af\u5883&#xff1a;\u5185\u6838\u6001&#xff08;Ring 0&#xff09;&#xff0c;\u4ee5\u9a71\u52a8\u6808\u5f62\u5f0f\u7ec4\u7ec7<\/li>\n<li>\u5178\u578b\u7ec4\u4ef6&#xff1a;disk.sys&#xff08;\u78c1\u76d8\u7c7b\u9a71\u52a8&#xff09;\u3001partmgr.sys&#xff08;\u5206\u533a\u7ba1\u7406&#xff09;\u3001nvme.sys&#xff08;NVMe \u9a71\u52a8&#xff09;\u3001tcpip.sys&#xff08;\u7f51\u7edc\u534f\u8bae\u6808&#xff09;<\/li>\n<li>\u6838\u5fc3\u804c\u8d23&#xff1a;\u8bbe\u5907\u7279\u5b9a I\/O \u5904\u7406\u3001\u786c\u4ef6\u62bd\u8c61\u3001\u4e2d\u65ad\u5904\u7406<\/li>\n<\/ul>\n<h5>\u7b2c10\u5c42&#xff1a;HAL&#xff08;Hardware Abstraction Layer&#xff09;<\/h5>\n<p>HAL&#xff08;\u786c\u4ef6\u62bd\u8c61\u5c42&#xff0c;hal.dll&#xff09;\u662f\u5185\u6838\u4e0e\u7269\u7406\u786c\u4ef6\u4e4b\u95f4\u7684\u8584\u5c42\u62bd\u8c61\u3002\u5b83\u5c01\u88c5\u4e86\u5e73\u53f0\u7279\u5b9a\u7684 I\/O \u7aef\u53e3\u8bbf\u95ee\u3001\u5bc4\u5b58\u5668\u8bfb\u5199\u3001\u4e2d\u65ad\u63a7\u5236\u3001DMA \u914d\u7f6e\u3001\u5b9a\u65f6\u5668\u64cd\u4f5c\u7b49\u64cd\u4f5c&#xff0c;\u4f7f\u5185\u6838\u548c\u9a71\u52a8\u4ee3\u7801\u53ef\u4ee5\u4e0d\u4fee\u6539\u5730\u8fd0\u884c\u5728\u4e0d\u540c\u5e73\u53f0&#xff08;\u5982 x86\u3001x64\u3001ARM64&#xff09;\u4e0a\u3002<\/p>\n<ul>\n<li>\u8fd0\u884c\u73af\u5883&#xff1a;\u5185\u6838\u6001&#xff08;Ring 0&#xff09;&#xff0c;\u4e0e\u5185\u6838\u7d27\u5bc6\u8026\u5408<\/li>\n<li>\u5178\u578b\u7ec4\u4ef6&#xff1a;hal.dll&#xff08;\u6216 halmacpi.dll&#xff09;\u3001ACPI.sys<\/li>\n<li>\u6838\u5fc3\u804c\u8d23&#xff1a;\u5e73\u53f0\u65e0\u5173\u7684\u786c\u4ef6\u8bbf\u95ee\u63a5\u53e3<\/li>\n<\/ul>\n<h5>\u7b2c11\u5c42&#xff1a;\u786c\u4ef6&#xff08;Hardware&#xff09;<\/h5>\n<p>\u7269\u7406\u786c\u4ef6\u662f\u5173\u7cfb\u94fe\u7684\u7ec8\u70b9\u2014\u2014CPU \u5f15\u811a\u4e0a\u7684\u7535\u4fe1\u53f7\u3001\u78c1\u76d8\u63a7\u5236\u5668\u7684\u5bc4\u5b58\u5668\u3001\u5185\u5b58\u603b\u7ebf\u7684\u65f6\u5e8f\u3002\u4ece\u8f6f\u4ef6\u7684\u89d2\u5ea6\u770b&#xff0c;\u786c\u4ef6\u8868\u73b0\u4e3a I\/O \u7aef\u53e3\u3001MMIO&#xff08;Memory-Mapped I\/O&#xff09;\u533a\u57df\u3001DMA \u901a\u9053\u548c\u4e2d\u65ad\u7ebf\u3002<\/p>\n<ul>\n<li>\u8fd0\u884c\u73af\u5883&#xff1a;\u7269\u7406\u5c42\u9762&#xff08;\u7535\u6c14\u4fe1\u53f7&#xff09;<\/li>\n<li>\u5178\u578b\u7ec4\u4ef6&#xff1a;CPU\u3001DRAM\u3001\u78c1\u76d8\u63a7\u5236\u5668\u3001\u7f51\u7edc\u63a7\u5236\u5668\u3001GPU<\/li>\n<li>\u6838\u5fc3\u804c\u8d23&#xff1a;\u6267\u884c\u7269\u7406 I\/O \u64cd\u4f5c<\/li>\n<\/ul>\n<h4>1.3 \u5b8c\u6574\u5173\u7cfb\u94fe\u5341\u5c42\u6a21\u578b\u56fe<\/h4>\n<p>  #mermaid-svg-Npk7nhXGBlWuphxj{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-Npk7nhXGBlWuphxj .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-Npk7nhXGBlWuphxj .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-Npk7nhXGBlWuphxj .error-icon{fill:#552222;}#mermaid-svg-Npk7nhXGBlWuphxj .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-Npk7nhXGBlWuphxj .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-Npk7nhXGBlWuphxj .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-Npk7nhXGBlWuphxj .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-Npk7nhXGBlWuphxj .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-Npk7nhXGBlWuphxj .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-Npk7nhXGBlWuphxj .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-Npk7nhXGBlWuphxj .marker{fill:#333333;stroke:#333333;}#mermaid-svg-Npk7nhXGBlWuphxj .marker.cross{stroke:#333333;}#mermaid-svg-Npk7nhXGBlWuphxj svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-Npk7nhXGBlWuphxj p{margin:0;}#mermaid-svg-Npk7nhXGBlWuphxj .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-Npk7nhXGBlWuphxj .cluster-label text{fill:#333;}#mermaid-svg-Npk7nhXGBlWuphxj .cluster-label span{color:#333;}#mermaid-svg-Npk7nhXGBlWuphxj .cluster-label span p{background-color:transparent;}#mermaid-svg-Npk7nhXGBlWuphxj .label text,#mermaid-svg-Npk7nhXGBlWuphxj span{fill:#333;color:#333;}#mermaid-svg-Npk7nhXGBlWuphxj .node rect,#mermaid-svg-Npk7nhXGBlWuphxj .node circle,#mermaid-svg-Npk7nhXGBlWuphxj .node ellipse,#mermaid-svg-Npk7nhXGBlWuphxj .node polygon,#mermaid-svg-Npk7nhXGBlWuphxj .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-Npk7nhXGBlWuphxj .rough-node .label text,#mermaid-svg-Npk7nhXGBlWuphxj .node .label text,#mermaid-svg-Npk7nhXGBlWuphxj .image-shape .label,#mermaid-svg-Npk7nhXGBlWuphxj .icon-shape .label{text-anchor:middle;}#mermaid-svg-Npk7nhXGBlWuphxj .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-Npk7nhXGBlWuphxj .rough-node .label,#mermaid-svg-Npk7nhXGBlWuphxj .node .label,#mermaid-svg-Npk7nhXGBlWuphxj .image-shape .label,#mermaid-svg-Npk7nhXGBlWuphxj .icon-shape .label{text-align:center;}#mermaid-svg-Npk7nhXGBlWuphxj .node.clickable{cursor:pointer;}#mermaid-svg-Npk7nhXGBlWuphxj .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-Npk7nhXGBlWuphxj .arrowheadPath{fill:#333333;}#mermaid-svg-Npk7nhXGBlWuphxj .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-Npk7nhXGBlWuphxj .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-Npk7nhXGBlWuphxj .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-Npk7nhXGBlWuphxj .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-Npk7nhXGBlWuphxj .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-Npk7nhXGBlWuphxj .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-Npk7nhXGBlWuphxj .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-Npk7nhXGBlWuphxj .cluster text{fill:#333;}#mermaid-svg-Npk7nhXGBlWuphxj .cluster span{color:#333;}#mermaid-svg-Npk7nhXGBlWuphxj div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-Npk7nhXGBlWuphxj .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-Npk7nhXGBlWuphxj rect.text{fill:none;stroke-width:0;}#mermaid-svg-Npk7nhXGBlWuphxj .icon-shape,#mermaid-svg-Npk7nhXGBlWuphxj .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-Npk7nhXGBlWuphxj .icon-shape p,#mermaid-svg-Npk7nhXGBlWuphxj .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-Npk7nhXGBlWuphxj .icon-shape .label rect,#mermaid-svg-Npk7nhXGBlWuphxj .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-Npk7nhXGBlWuphxj .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-Npk7nhXGBlWuphxj .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-Npk7nhXGBlWuphxj :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u786c\u4ef6\u5c42<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u5185\u6838\u6001 (Ring 0 \u00b7 CPL&#061;0)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u7528\u6237\u6001 (Ring 3 \u00b7 CPL&#061;3)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u7f16\u8bd1\/\u89e3\u91ca<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u94fe\u63a5\/\u52a0\u8f7d<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u8c03\u7528<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>P\/Invoke\u6216\u76f4\u63a5\u8c03\u7528<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u5185\u90e8\u8c03\u7528<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>syscall\u6307\u4ee4<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>SSDT\u8def\u7531<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>IoCallDriver\/IRP<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>HAL\u63a5\u53e3<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u5bc4\u5b58\u5668\/MMIO<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p><b>\u7b2c1\u5c42: \u5e94\u7528\u7a0b\u5e8f<\/b>\u4e1a\u52a1\u903b\u8f91\u4ee3\u7801\u4f8b: button1_Click()<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p><b>\u7b2c2\u5c42: \u7f16\u7a0b\u8bed\u8a00<\/b>\u7f16\u8bd1\u5668\/JIT\u7ffb\u8bd1\u4f8b: C# \u2192 IL \u2192 \u673a\u5668\u7801<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p><b>\u7b2c3\u5c42: \u8fd0\u884c\u65f6\u5e93<\/b>\u6807\u51c6\u5e93\u5b9e\u73b0\u4f8b: File.ReadAllText()<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p><b>\u7b2c4\u5c42: \u6846\u67b6<\/b>\u9886\u57df\u62bd\u8c61\u4f8b: WPF Window \/ MFC<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p><b>\u7b2c5\u5c42: Windows API<\/b>Win32\u516c\u5f00\u63a5\u53e3\u4f8b: CreateFileW()<\/p>\n<p><\/span><\/p>\n<p>         <span style=\"--darkreader-inline-color: var(--darkreader-text-ffffff, #e8e6e3)\" class=\"nodeLabel\"><\/p>\n<p><b>\u7b2c6\u5c42: NT API<\/b>\u539f\u751f\u7cfb\u7edf\u63a5\u53e3\u4f8b: NtCreateFile()<\/p>\n<p><\/span><\/p>\n<p>         <span style=\"--darkreader-inline-color: var(--darkreader-text-ffffff, #e8e6e3)\" class=\"nodeLabel\"><\/p>\n<p><b>\u7b2c7\u5c42: syscall<\/b>\u7279\u6743\u7ea7\u5207\u6362syscall\u6307\u4ee4 &#043; SSDT<\/p>\n<p><\/span><\/p>\n<p>         <span style=\"--darkreader-inline-color: var(--darkreader-text-ffffff, #e8e6e3)\" class=\"nodeLabel\"><\/p>\n<p><b>\u7b2c8\u5c42: \u5185\u6838<\/b>ntoskrnl.exe\u4f8b: NtCreateFile\u5185\u6838\u5b9e\u73b0<\/p>\n<p><\/span><\/p>\n<p>         <span style=\"--darkreader-inline-color: var(--darkreader-text-ffffff, #e8e6e3)\" class=\"nodeLabel\"><\/p>\n<p><b>\u7b2c9\u5c42: \u9a71\u52a8<\/b>\u8bbe\u5907\u9a71\u52a8\u7a0b\u5e8f\u4f8b: disk.sys IRP\u5904\u7406<\/p>\n<p><\/span><\/p>\n<p>         <span style=\"--darkreader-inline-color: var(--darkreader-text-ffffff, #e8e6e3)\" class=\"nodeLabel\"><\/p>\n<p><b>\u7b2c10\u5c42: HAL<\/b>\u786c\u4ef6\u62bd\u8c61\u5c42\u4f8b: READ_PORT_UCHAR()<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p><b>\u7b2c11\u5c42: \u786c\u4ef6<\/b>\u7269\u7406\u8bbe\u5907\u4f8b: \u78c1\u76d8\u63a7\u5236\u5668\u5bc4\u5b58\u5668<\/p>\n<p><\/span><\/p>\n<h4>1.4 \u5c42\u95f4\u5173\u7cfb\u7684\u5173\u952e\u7279\u5f81<\/h4>\n<p>\u5728\u6df1\u5165\u6bcf\u4e00\u5c42\u4e4b\u524d&#xff0c;\u9700\u8981\u7406\u89e3\u8d2f\u7a7f\u6574\u4e2a\u5173\u7cfb\u94fe\u7684\u51e0\u4e2a\u5173\u952e\u7279\u5f81&#xff1a;<\/p>\n<p>\u81ea\u4e0a\u800c\u4e0b\u7684\u62bd\u8c61\u9012\u51cf&#xff1a;\u4ece\u5e94\u7528\u7a0b\u5e8f\u5230\u786c\u4ef6&#xff0c;\u62bd\u8c61\u5c42\u6b21\u9010\u5c42\u964d\u4f4e\u3002\u5e94\u7528\u7a0b\u5e8f\u5c42\u5904\u7406\u7684\u662f\u4e1a\u52a1\u6982\u5ff5&#xff08;\u201c\u6253\u5f00\u62a5\u8868\u201d&#xff09;&#xff0c;\u800c\u786c\u4ef6\u5c42\u5904\u7406\u7684\u662f\u7535\u4fe1\u53f7&#xff08;\u201c\u8bbe\u7f6e\u5bc4\u5b58\u5668\u4f4d\u201d&#xff09;\u3002\u6bcf\u5411\u4e0b\u7a7f\u900f\u4e00\u5c42&#xff0c;\u62bd\u8c61\u5c31\u51cf\u5c11\u4e00\u5206&#xff0c;\u7ec6\u8282\u5c31\u589e\u52a0\u4e00\u5206\u3002<\/p>\n<p>\u5c01\u88c5\u8fb9\u754c\u7684\u6e17\u900f\u6027\u5dee\u5f02&#xff1a;\u4e0d\u540c\u5c42\u4e4b\u95f4\u7684\u5c01\u88c5\u8fb9\u754c\u6e17\u900f\u6027\u4e0d\u540c\u3002\u7f16\u7a0b\u8bed\u8a00\u5230\u8fd0\u884c\u65f6\u5e93\u7684\u8fb9\u754c\u662f&#034;\u8f6f&#034;\u7684\u2014\u2014\u53ea\u662f\u51fd\u6570\u8c03\u7528&#xff1b;\u800c NT API \u5230 syscall \u7684\u8fb9\u754c\u662f&#034;\u786c&#034;\u7684\u2014\u2014\u6d89\u53ca CPU \u7279\u6743\u7ea7\u5207\u6362&#xff0c;\u8fd9\u662f\u6574\u4e2a\u5173\u7cfb\u94fe\u4e2d\u6700\u5173\u952e\u7684\u8fb9\u754c\u3002<\/p>\n<p>\u540c\u6b65\u4e0e\u5f02\u6b65\u7684\u6df7\u5408&#xff1a;\u5173\u7cfb\u94fe\u7684\u4e0a\u5c42&#xff08;\u5e94\u7528\u2192Win32 API&#xff09;\u901a\u5e38\u662f\u540c\u6b65\u7684\u2014\u2014\u51fd\u6570\u8c03\u7528\u76f4\u63a5\u8fd4\u56de\u7ed3\u679c&#xff1b;\u800c\u4e2d\u5c42&#xff08;\u5185\u6838\u2192\u9a71\u52a8&#xff09;\u53ef\u80fd\u8f6c\u4e3a\u5f02\u6b65\u2014\u2014IRP \u88ab\u6392\u961f\u7b49\u5f85\u8bbe\u5907\u5b8c\u6210&#xff1b;\u5e95\u5c42&#xff08;HAL\u2192\u786c\u4ef6&#xff09;\u5219\u662f\u540c\u6b65\u7684\u786c\u4ef6\u64cd\u4f5c\u3002<\/p>\n<p>\u53c2\u6570\u683c\u5f0f\u7684\u9010\u5c42\u8f6c\u6362&#xff1a;\u8bf7\u6c42\u5728\u7a7f\u900f\u6bcf\u5c42\u65f6&#xff0c;\u53c2\u6570\u683c\u5f0f\u90fd\u4f1a\u53d1\u751f\u8f6c\u6362\u3002\u4f8b\u5982\u6587\u4ef6\u8def\u5f84\u4ece C# \u7684 string \u2192 CRT \u7684 char* \u2192 Win32 \u7684 LPCWSTR \u2192 NT \u7684 UNICODE_STRING \u2192 \u5185\u6838\u7684 OBJECT_ATTRIBUTES \u2192 \u9a71\u52a8\u7684 FILE_OBJECT\u3002\u8fd9\u79cd\u9010\u5c42\u8f6c\u6362\u662f\u7a7f\u900f\u673a\u5236\u7684\u6838\u5fc3\u7279\u5f81\u3002<\/p>\n<p>\u9519\u8bef\u4f20\u64ad\u7684\u65b9\u5411\u53cd\u8f6c&#xff1a;\u6b63\u5e38\u8bf7\u6c42\u662f\u81ea\u4e0a\u800c\u4e0b\u7a7f\u900f\u7684&#xff0c;\u4f46\u9519\u8bef\u662f\u81ea\u4e0b\u800c\u4e0a\u4f20\u64ad\u7684\u3002\u786c\u4ef6\u9519\u8bef \u2192 HAL \u8fd4\u56de\u9519\u8bef\u7801 \u2192 \u9a71\u52a8\u8bbe\u7f6e IRP \u7684 IoStatus.Status \u2192 \u5185\u6838\u8fd4\u56de NTSTATUS \u2192 Win32 \u8f6c\u6362\u4e3a GetLastError() \u2192 \u8fd0\u884c\u65f6\u5e93\u629b\u51fa\u5f02\u5e38 \u2192 \u5e94\u7528\u7a0b\u5e8f\u5904\u7406\u5f02\u5e38\u3002<\/p>\n<h4>1.5 \u5173\u7cfb\u94fe\u7684\u53d8\u4f53\u4e0e\u7b80\u5316<\/h4>\n<p>\u503c\u5f97\u6ce8\u610f\u7684\u662f&#xff0c;\u5e76\u975e\u6240\u6709\u8bf7\u6c42\u90fd\u7ecf\u8fc7\u5b8c\u6574\u7684\u5341\u5c42\u7a7f\u900f\u3002\u4ee5\u4e0b\u662f\u5e38\u89c1\u7684\u53d8\u4f53&#xff1a;<\/p>\n<p>\u8df3\u8fc7\u6846\u67b6\u5c42&#xff1a;\u63a7\u5236\u53f0\u7a0b\u5e8f\u6216\u7cfb\u7edf\u5de5\u5177\u901a\u5e38\u4e0d\u4f7f\u7528\u6846\u67b6&#xff0c;\u76f4\u63a5\u4ece\u8fd0\u884c\u65f6\u5e93\u8c03\u7528 Win32 API\u3002\u4f8b\u5982 cmd.exe \u7684 dir \u547d\u4ee4&#xff1a;CRT \u2192 Win32 \u2192 NT \u2192 syscall \u2192 \u5185\u6838 \u2192 \u9a71\u52a8 \u2192 HAL \u2192 \u786c\u4ef6&#xff0c;\u53ea\u6709\u516b\u5c42\u3002<\/p>\n<p>\u76f4\u63a5\u8c03\u7528 NT API&#xff1a;\u67d0\u4e9b\u7cfb\u7edf\u5de5\u5177&#xff08;\u5982 Process Hacker&#xff09;\u76f4\u63a5\u8c03\u7528 ntdll.dll \u5bfc\u51fa\u7684 Nt* \u51fd\u6570&#xff0c;\u8df3\u8fc7 Win32 API \u5c42\u3002<\/p>\n<p>\u5185\u6838\u5185\u8c03\u7528&#xff1a;\u5185\u6838\u9a71\u52a8\u4e4b\u95f4\u7684\u8c03\u7528\u4e0d\u7ecf\u8fc7 syscall\u2014\u2014\u5b83\u4eec\u76f4\u63a5\u5728 Ring 0 \u8c03\u7528\u5f7c\u6b64\u7684\u5bfc\u51fa\u51fd\u6570\u3002\u4f8b\u5982 disk.sys \u8c03\u7528 partmgr.sys \u7684\u63a5\u53e3\u65f6&#xff0c;\u4e0d\u7ecf\u8fc7\u7528\u6237\u6001\u5c42\u3002<\/p>\n<p>\u5185\u5b58\u64cd\u4f5c\u7684\u7279\u6b8a\u8def\u5f84&#xff1a;\u5185\u5b58\u5206\u914d&#xff08;malloc\/new&#xff09;\u7684\u7a7f\u900f\u8def\u5f84\u8f83\u77ed\u2014\u2014\u901a\u5e38\u53ea\u5230\u5185\u6838\u7684\u5185\u5b58\u7ba1\u7406\u5668&#xff08;\u901a\u8fc7 NtAllocateVirtualMemory&#xff09;&#xff0c;\u4e0d\u7ecf\u8fc7\u9a71\u52a8\u548c HAL\u3002\u56e0\u4e3a\u5806\u5185\u5b58\u662f\u865a\u62df\u5185\u5b58&#xff0c;\u7531 CPU \u7684 MMU \u786c\u4ef6\u7ba1\u7406&#xff0c;\u4e0d\u9700\u8981\u9a71\u52a8\u53c2\u4e0e\u3002<\/p>\n<p>  #mermaid-svg-DmwrNJxuUyFPUU6G{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-DmwrNJxuUyFPUU6G .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-DmwrNJxuUyFPUU6G .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-DmwrNJxuUyFPUU6G .error-icon{fill:#552222;}#mermaid-svg-DmwrNJxuUyFPUU6G .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-DmwrNJxuUyFPUU6G .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-DmwrNJxuUyFPUU6G .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-DmwrNJxuUyFPUU6G .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-DmwrNJxuUyFPUU6G .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-DmwrNJxuUyFPUU6G .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-DmwrNJxuUyFPUU6G .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-DmwrNJxuUyFPUU6G .marker{fill:#333333;stroke:#333333;}#mermaid-svg-DmwrNJxuUyFPUU6G .marker.cross{stroke:#333333;}#mermaid-svg-DmwrNJxuUyFPUU6G svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-DmwrNJxuUyFPUU6G p{margin:0;}#mermaid-svg-DmwrNJxuUyFPUU6G .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-DmwrNJxuUyFPUU6G .cluster-label text{fill:#333;}#mermaid-svg-DmwrNJxuUyFPUU6G .cluster-label span{color:#333;}#mermaid-svg-DmwrNJxuUyFPUU6G .cluster-label span p{background-color:transparent;}#mermaid-svg-DmwrNJxuUyFPUU6G .label text,#mermaid-svg-DmwrNJxuUyFPUU6G span{fill:#333;color:#333;}#mermaid-svg-DmwrNJxuUyFPUU6G .node rect,#mermaid-svg-DmwrNJxuUyFPUU6G .node circle,#mermaid-svg-DmwrNJxuUyFPUU6G .node ellipse,#mermaid-svg-DmwrNJxuUyFPUU6G .node polygon,#mermaid-svg-DmwrNJxuUyFPUU6G .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-DmwrNJxuUyFPUU6G .rough-node .label text,#mermaid-svg-DmwrNJxuUyFPUU6G .node .label text,#mermaid-svg-DmwrNJxuUyFPUU6G .image-shape .label,#mermaid-svg-DmwrNJxuUyFPUU6G .icon-shape .label{text-anchor:middle;}#mermaid-svg-DmwrNJxuUyFPUU6G .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-DmwrNJxuUyFPUU6G .rough-node .label,#mermaid-svg-DmwrNJxuUyFPUU6G .node .label,#mermaid-svg-DmwrNJxuUyFPUU6G .image-shape .label,#mermaid-svg-DmwrNJxuUyFPUU6G .icon-shape .label{text-align:center;}#mermaid-svg-DmwrNJxuUyFPUU6G .node.clickable{cursor:pointer;}#mermaid-svg-DmwrNJxuUyFPUU6G .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-DmwrNJxuUyFPUU6G .arrowheadPath{fill:#333333;}#mermaid-svg-DmwrNJxuUyFPUU6G .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-DmwrNJxuUyFPUU6G .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-DmwrNJxuUyFPUU6G .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-DmwrNJxuUyFPUU6G .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-DmwrNJxuUyFPUU6G .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-DmwrNJxuUyFPUU6G .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-DmwrNJxuUyFPUU6G .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-DmwrNJxuUyFPUU6G .cluster text{fill:#333;}#mermaid-svg-DmwrNJxuUyFPUU6G .cluster span{color:#333;}#mermaid-svg-DmwrNJxuUyFPUU6G div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-DmwrNJxuUyFPUU6G .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-DmwrNJxuUyFPUU6G rect.text{fill:none;stroke-width:0;}#mermaid-svg-DmwrNJxuUyFPUU6G .icon-shape,#mermaid-svg-DmwrNJxuUyFPUU6G .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-DmwrNJxuUyFPUU6G .icon-shape p,#mermaid-svg-DmwrNJxuUyFPUU6G .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-DmwrNJxuUyFPUU6G .icon-shape .label rect,#mermaid-svg-DmwrNJxuUyFPUU6G .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-DmwrNJxuUyFPUU6G .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-DmwrNJxuUyFPUU6G .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-DmwrNJxuUyFPUU6G :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u76f4\u63a5NT API\u8def\u5f84 (8\u5c42)<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>App<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>Lang<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>NT<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>syscall<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>Kernel<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>Driver<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>HAL<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>HW<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u5185\u5b58\u5206\u914d\u8def\u5f84 (7\u5c42)<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>App<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>Lang<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>RTL<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>Win32<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>NT<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>syscall<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>Kernel\/MMU<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u6807\u51c6\u6587\u4ef6I\/O\u8def\u5f84 (10\u5c42)<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>App<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>Lang<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>RTL<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>FW<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>Win32<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>NT<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>syscall<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>Kernel<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>Driver<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>HAL<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>HW<\/p>\n<p><\/span><\/p>\n<h4>1.6 \u672c\u6587\u6863\u7684\u5206\u6790\u65b9\u6cd5<\/h4>\n<p>\u672c\u6587\u6863\u91c7\u7528&#034;\u9010\u5c42\u62c6\u89e3 &#043; \u5168\u94fe\u8def\u8d2f\u7a7f&#034;\u7684\u5206\u6790\u65b9\u6cd5&#xff1a;<\/p>\n<ul>\n<li>\u9010\u5c42\u62c6\u89e3&#xff08;\u7b2c3-11\u8282&#xff09;&#xff1a;\u5bf9\u6bcf\u4e00\u5c42\u7a7f\u900f&#xff0c;\u5206\u6790\u5176\u5c01\u88c5\u8fb9\u754c\u3001\u7a7f\u900f\u65b9\u5f0f\u3001\u53c2\u6570\u8f6c\u6362\u3001\u6570\u636e\u7ed3\u6784\u53d8\u5316\u548c\u4ee3\u7801\u793a\u4f8b\u3002<\/li>\n<li>\u5168\u94fe\u8def\u8d2f\u7a7f&#xff08;\u7b2c12\u8282&#xff09;&#xff1a;\u4ee5 CreateFile \u4e3a\u6848\u4f8b&#xff0c;\u8ffd\u8e2a\u4e00\u4e2a\u8bf7\u6c42\u4ece fopen \u5230\u78c1\u76d8\u786c\u4ef6\u5bc4\u5b58\u5668\u7684\u5b8c\u6574\u7a7f\u900f\u8def\u5f84\u3002<\/li>\n<li>\u6a2a\u5411\u5bf9\u6bd4&#xff08;\u7b2c13-14\u8282&#xff09;&#xff1a;\u603b\u7ed3\u5404\u5c42\u5c01\u88c5\u7a0b\u5ea6\u548c\u6027\u80fd\u7279\u5f81\u3002<\/li>\n<\/ul>\n<p>\u6240\u6709\u4ee3\u7801\u793a\u4f8b\u57fa\u4e8e Windows 10\/11 (x64) \u7684\u5b9e\u9645\u5b9e\u73b0&#xff0c;\u6c47\u7f16\u4ee3\u7801\u57fa\u4e8e ntdll.dll \u7684\u53cd\u6c47\u7f16&#xff0c;\u5185\u6838\u6570\u636e\u7ed3\u6784\u57fa\u4e8e WDK&#xff08;Windows Driver Kit&#xff09;\u5934\u6587\u4ef6\u5b9a\u4e49\u3002<\/p>\n<hr \/>\n<h3>2. \u7eb5\u5411\u7a7f\u900f\u7684\u5b9a\u4e49\u4e0e\u672c\u8d28<\/h3>\n<h4>2.1 \u7a7f\u900f&#xff08;Penetration&#xff09;\u7684\u542b\u4e49<\/h4>\n<p>&#034;\u7a7f\u900f&#034;\u662f\u6307\u4e00\u4e2a\u8bf7\u6c42\u4ece\u5173\u7cfb\u94fe\u7684\u9ad8\u5c42\u9010\u5c42\u4f20\u9012\u5230\u4f4e\u5c42\u7684\u8fc7\u7a0b\u3002\u6bcf\u4e00\u6b21\u7a7f\u900f\u90fd\u6d89\u53ca\u4e09\u4e2a\u52a8\u4f5c&#xff1a;<\/p>\n<li>\u89e3\u5c01\u88c5&#xff08;De-encapsulation&#xff09;&#xff1a;\u4e0a\u5c42\u8c03\u7528\u4ee5\u672c\u5c42\u7684\u53c2\u6570\u683c\u5f0f\u4f20\u5165&#xff0c;\u672c\u5c42\u9700\u8981\u89e3\u6790\u8fd9\u4e9b\u53c2\u6570\u3002<\/li>\n<li>\u8f6c\u6362&#xff08;Transformation&#xff09;&#xff1a;\u5c06\u53c2\u6570\u4ece\u672c\u5c42\u683c\u5f0f\u8f6c\u6362\u4e3a\u4e0b\u4e00\u5c42\u683c\u5f0f&#xff0c;\u53ef\u80fd\u6d89\u53ca\u7c7b\u578b\u6620\u5c04\u3001\u7f16\u7801\u8f6c\u6362\u3001\u7ed3\u6784\u4f53\u91cd\u7ec4\u3002<\/li>\n<li>\u4f20\u9012&#xff08;Dispatch&#xff09;&#xff1a;\u4ee5\u4e0b\u4e00\u5c42\u671f\u671b\u7684\u65b9\u5f0f&#xff08;\u51fd\u6570\u8c03\u7528\u3001syscall \u6307\u4ee4\u3001IRP \u7b49&#xff09;\u5c06\u8bf7\u6c42\u4f20\u9012\u4e0b\u53bb\u3002<\/li>\n<p>\u7a7f\u900f\u4e0d\u662f\u7b80\u5355\u7684&#034;\u8f6c\u53d1&#034;\u2014\u2014\u6bcf\u4e00\u5c42\u90fd\u4f1a\u5728\u7a7f\u900f\u8fc7\u7a0b\u4e2d\u6267\u884c\u81ea\u5df1\u7684\u903b\u8f91\u3002\u4f8b\u5982&#xff1a;<\/p>\n<ul>\n<li>Win32 API CreateFileW \u5728\u8c03\u7528 NtCreateFile \u4e4b\u524d&#xff0c;\u4f1a\u5c06\u8def\u5f84\u5b57\u7b26\u4e32\u8f6c\u6362\u4e3a NT \u8def\u5f84\u683c\u5f0f&#xff08;\u5982 C:\\\\file.txt \u2192 \\\\??\\\\C:\\\\file.txt&#xff09;&#xff0c;\u5e76\u6784\u5efa OBJECT_ATTRIBUTES \u7ed3\u6784\u3002<\/li>\n<li>\u5185\u6838 NtCreateFile \u5728\u521b\u5efa IRP \u4e4b\u524d&#xff0c;\u4f1a\u6267\u884c\u5b89\u5168\u68c0\u67e5&#xff08;ACL \u9a8c\u8bc1&#xff09;\u3001\u5bf9\u8c61\u540d\u89e3\u6790\u548c\u8bbe\u5907\u6808\u5b9a\u4f4d\u3002<\/li>\n<li>\u9a71\u52a8\u5728\u8bbf\u95ee\u786c\u4ef6\u5bc4\u5b58\u5668\u4e4b\u524d&#xff0c;\u4f1a\u5c06\u903b\u8f91\u8bf7\u6c42&#xff08;\u201c\u8bfb\u53d6\u6247\u533a N\u201d&#xff09;\u8f6c\u6362\u4e3a\u786c\u4ef6\u547d\u4ee4&#xff08;\u201c\u8bbe\u7f6e LBA \u5bc4\u5b58\u5668&#xff0c;\u53d1\u9001 READ DMA \u547d\u4ee4\u201d&#xff09;\u3002<\/li>\n<\/ul>\n<h4>2.2 \u6bcf\u5c42\u7a7f\u900f\u7684\u5c01\u88c5\u8fb9\u754c<\/h4>\n<p>\u5c01\u88c5\u8fb9\u754c\u662f\u4e24\u5c42\u4e4b\u95f4\u7684\u63a5\u53e3\u5951\u7ea6\u2014\u2014\u4e0a\u5c42\u4f9d\u8d56\u8fd9\u4e2a\u5951\u7ea6\u7f16\u7a0b&#xff0c;\u4e0b\u5c42\u4f9d\u8d56\u8fd9\u4e2a\u5951\u7ea6\u5b9e\u73b0\u3002\u5c01\u88c5\u8fb9\u754c\u5b9a\u4e49\u4e86\u4ec0\u4e48\u4fe1\u606f\u53ef\u4ee5\u7a7f\u900f&#xff08;\u66b4\u9732\u7684\u63a5\u53e3&#xff09;&#xff0c;\u4ec0\u4e48\u4fe1\u606f\u88ab\u5c01\u88c5&#xff08;\u9690\u85cf\u7684\u5b9e\u73b0\u7ec6\u8282&#xff09;\u3002<\/p>\n<table>\n<tr>\u7a7f\u900f\u70b9\u5c01\u88c5\u8fb9\u754c\u7c7b\u578b\u8fb9\u754c\u5951\u7ea6\u7a7f\u900f\u65b9\u5f0f<\/tr>\n<tbody>\n<tr>\n<td>App\u2192Lang<\/td>\n<td>\u8bed\u6cd5\u8bed\u4e49\u8fb9\u754c<\/td>\n<td>\u8bed\u8a00\u89c4\u8303&#xff08;C# spec \/ C&#043;&#043; standard&#xff09;<\/td>\n<td>\u7f16\u8bd1\u5668\/\u89e3\u91ca\u5668\u7ffb\u8bd1<\/td>\n<\/tr>\n<tr>\n<td>Lang\u2192RTL<\/td>\n<td>\u6807\u51c6\u5e93API\u8fb9\u754c<\/td>\n<td>ISO C \/ .NET BCL \u89c4\u8303<\/td>\n<td>\u51fd\u6570\u8c03\u7528<\/td>\n<\/tr>\n<tr>\n<td>RTL\u2192Win32<\/td>\n<td>OS API\u8fb9\u754c<\/td>\n<td>Win32 API \u51fd\u6570\u7b7e\u540d<\/td>\n<td>\u51fd\u6570\u8c03\u7528\/P\/Invoke<\/td>\n<\/tr>\n<tr>\n<td>Win32\u2192NT<\/td>\n<td>\u7cfb\u7edf\u63a5\u53e3\u8fb9\u754c<\/td>\n<td>NT API \u51fd\u6570\u7b7e\u540d &#043; NT \u6570\u636e\u7ed3\u6784<\/td>\n<td>\u51fd\u6570\u8c03\u7528&#xff08;\u540c\u8fdb\u7a0b\u5185&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>NT\u2192syscall<\/td>\n<td>\u7279\u6743\u7ea7\u8fb9\u754c<\/td>\n<td>syscall\u53f7 &#043; \u5bc4\u5b58\u5668\u7ea6\u5b9a<\/td>\n<td>syscall \u6307\u4ee4&#xff08;CPU\u7279\u6743\u7ea7\u5207\u6362&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>syscall\u2192Kernel<\/td>\n<td>\u5185\u6838\u5165\u53e3\u8fb9\u754c<\/td>\n<td>SSDT \u8868 &#043; \u5185\u6838\u51fd\u6570\u7b7e\u540d<\/td>\n<td>\u5185\u6838\u51fd\u6570\u76f4\u63a5\u8c03\u7528<\/td>\n<\/tr>\n<tr>\n<td>Kernel\u2192Driver<\/td>\n<td>I\/O \u63a5\u53e3\u8fb9\u754c<\/td>\n<td>IRP &#043; IOCTL &#043; \u8bbe\u5907\u6808<\/td>\n<td>IoCallDriver<\/td>\n<\/tr>\n<tr>\n<td>Driver\u2192HAL<\/td>\n<td>\u786c\u4ef6\u8bbf\u95ee\u8fb9\u754c<\/td>\n<td>HAL \u51fd\u6570&#xff08;READ_PORT_*\u7b49&#xff09;<\/td>\n<td>\u51fd\u6570\u8c03\u7528<\/td>\n<\/tr>\n<tr>\n<td>HAL\u2192Hardware<\/td>\n<td>\u7269\u7406\u8fb9\u754c<\/td>\n<td>I\/O\u7aef\u53e3\/MMIO\u5730\u5740\/\u4e2d\u65ad\u53f7<\/td>\n<td>CPU \u6307\u4ee4&#xff08;in\/out\/mov&#xff09;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>2.3 \u7a7f\u900f\u7684\u4e24\u79cd\u57fa\u672c\u65b9\u5f0f<\/h4>\n<p>\u7eb5\u5411\u7a7f\u900f\u5728\u5b9e\u73b0\u673a\u5236\u4e0a\u5206\u4e3a\u4e24\u79cd\u57fa\u672c\u65b9\u5f0f&#xff1a;\u540c\u6b65\u7a7f\u900f\u548c\u5f02\u6b65\u7a7f\u900f\u3002\u7406\u89e3\u8fd9\u4e24\u79cd\u65b9\u5f0f\u7684\u533a\u522b\u5bf9\u4e8e\u638c\u63e1 Windows I\/O \u4f53\u7cfb\u81f3\u5173\u91cd\u8981\u3002<\/p>\n<h5>2.3.1 \u540c\u6b65\u7a7f\u900f&#xff08;Synchronous Penetration&#xff09;<\/h5>\n<p>\u540c\u6b65\u7a7f\u900f\u662f\u6307\u8bf7\u6c42\u6cbf\u7740\u51fd\u6570\u8c03\u7528\u94fe\u81ea\u4e0a\u800c\u4e0b\u4f20\u9012&#xff0c;\u6bcf\u4e00\u5c42\u76f4\u63a5\u8c03\u7528\u4e0b\u4e00\u5c42\u7684\u51fd\u6570&#xff0c;\u8c03\u7528\u6808\u5728\u6240\u6709\u5c42\u4e4b\u95f4\u662f\u8fde\u7eed\u7684\u3002\u8c03\u7528\u6808\u5c55\u5f00\u65f6&#xff0c;\u8fd4\u56de\u503c\u81ea\u4e0b\u800c\u4e0a\u9010\u5c42\u8fd4\u56de\u3002<\/p>\n<p>\u540c\u6b65\u7a7f\u900f\u7684\u7279\u5f81&#xff1a;<\/p>\n<ul>\n<li>\u8fde\u7eed\u8c03\u7528\u6808&#xff1a;\u4ece\u5e94\u7528\u7a0b\u5e8f\u5230 Win32 API&#xff0c;\u6240\u6709\u5c42\u7684\u6808\u5e27\u5728\u540c\u4e00\u4e2a\u7ebf\u7a0b\u7684\u8c03\u7528\u6808\u4e0a\u8fde\u7eed\u6392\u5217\u3002<\/li>\n<li>\u5373\u65f6\u8fd4\u56de&#xff1a;\u6bcf\u4e00\u5c42\u8c03\u7528\u4e0b\u4e00\u5c42\u540e\u7acb\u5373\u7b49\u5f85\u8fd4\u56de&#xff0c;\u4e0d\u505a\u5176\u4ed6\u5de5\u4f5c\u3002<\/li>\n<li>\u6808\u4f20\u9012\u53c2\u6570&#xff1a;\u53c2\u6570\u901a\u8fc7\u6808&#xff08;x64 \u4e0b\u901a\u8fc7\u5bc4\u5b58\u5668&#043;\u6808&#xff09;\u4f20\u9012&#xff0c;\u65e0\u9700\u989d\u5916\u7684\u6570\u636e\u7ed3\u6784\u3002<\/li>\n<li>\u9002\u7528\u573a\u666f&#xff1a;\u8ba1\u7b97\u5bc6\u96c6\u578b\u64cd\u4f5c\u3001\u5185\u5b58\u64cd\u4f5c\u3001\u7b80\u5355\u7684\u540c\u6b65 I\/O\u3002<\/li>\n<\/ul>\n<p>\u540c\u6b65\u7a7f\u900f\u7684\u5178\u578b\u8def\u5f84&#xff08;\u4ee5\u540c\u6b65 ReadFile \u4e3a\u4f8b&#xff09;&#xff1a;<\/p>\n<p>  #mermaid-svg-LDjTLLartxMgjoMB{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-LDjTLLartxMgjoMB .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-LDjTLLartxMgjoMB .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-LDjTLLartxMgjoMB .error-icon{fill:#552222;}#mermaid-svg-LDjTLLartxMgjoMB .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-LDjTLLartxMgjoMB .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-LDjTLLartxMgjoMB .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-LDjTLLartxMgjoMB .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-LDjTLLartxMgjoMB .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-LDjTLLartxMgjoMB .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-LDjTLLartxMgjoMB .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-LDjTLLartxMgjoMB .marker{fill:#333333;stroke:#333333;}#mermaid-svg-LDjTLLartxMgjoMB .marker.cross{stroke:#333333;}#mermaid-svg-LDjTLLartxMgjoMB svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-LDjTLLartxMgjoMB p{margin:0;}#mermaid-svg-LDjTLLartxMgjoMB .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-LDjTLLartxMgjoMB .cluster-label text{fill:#333;}#mermaid-svg-LDjTLLartxMgjoMB .cluster-label span{color:#333;}#mermaid-svg-LDjTLLartxMgjoMB .cluster-label span p{background-color:transparent;}#mermaid-svg-LDjTLLartxMgjoMB .label text,#mermaid-svg-LDjTLLartxMgjoMB span{fill:#333;color:#333;}#mermaid-svg-LDjTLLartxMgjoMB .node rect,#mermaid-svg-LDjTLLartxMgjoMB .node circle,#mermaid-svg-LDjTLLartxMgjoMB .node ellipse,#mermaid-svg-LDjTLLartxMgjoMB .node polygon,#mermaid-svg-LDjTLLartxMgjoMB .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-LDjTLLartxMgjoMB .rough-node .label text,#mermaid-svg-LDjTLLartxMgjoMB .node .label text,#mermaid-svg-LDjTLLartxMgjoMB .image-shape .label,#mermaid-svg-LDjTLLartxMgjoMB .icon-shape .label{text-anchor:middle;}#mermaid-svg-LDjTLLartxMgjoMB .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-LDjTLLartxMgjoMB .rough-node .label,#mermaid-svg-LDjTLLartxMgjoMB .node .label,#mermaid-svg-LDjTLLartxMgjoMB .image-shape .label,#mermaid-svg-LDjTLLartxMgjoMB .icon-shape .label{text-align:center;}#mermaid-svg-LDjTLLartxMgjoMB .node.clickable{cursor:pointer;}#mermaid-svg-LDjTLLartxMgjoMB .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-LDjTLLartxMgjoMB .arrowheadPath{fill:#333333;}#mermaid-svg-LDjTLLartxMgjoMB .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-LDjTLLartxMgjoMB .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-LDjTLLartxMgjoMB .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-LDjTLLartxMgjoMB .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-LDjTLLartxMgjoMB .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-LDjTLLartxMgjoMB .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-LDjTLLartxMgjoMB .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-LDjTLLartxMgjoMB .cluster text{fill:#333;}#mermaid-svg-LDjTLLartxMgjoMB .cluster span{color:#333;}#mermaid-svg-LDjTLLartxMgjoMB div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-LDjTLLartxMgjoMB .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-LDjTLLartxMgjoMB rect.text{fill:none;stroke-width:0;}#mermaid-svg-LDjTLLartxMgjoMB .icon-shape,#mermaid-svg-LDjTLLartxMgjoMB .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-LDjTLLartxMgjoMB .icon-shape p,#mermaid-svg-LDjTLLartxMgjoMB .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-LDjTLLartxMgjoMB .icon-shape .label rect,#mermaid-svg-LDjTLLartxMgjoMB .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-LDjTLLartxMgjoMB .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-LDjTLLartxMgjoMB .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-LDjTLLartxMgjoMB :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u51fd\u6570\u8c03\u7528<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u51fd\u6570\u8c03\u7528<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u51fd\u6570\u8c03\u7528<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>syscall\u6307\u4ee4<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>IoCallDriver<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>HAL\u51fd\u6570<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>in\u6307\u4ee4<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u8fd4\u56de\u503c<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u8fd4\u56de<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>IRP\u5b8c\u6210<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u8fd4\u56deNTSTATUS<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u8f6c\u6362\u9519\u8bef\u7801<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u8fd4\u56deBOOL<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u8fd4\u56desize_t<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u5e94\u7528\u7a0b\u5e8fReadFileSync()<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8fd0\u884c\u65f6\u5e93fread()<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>Win32 APIReadFile()<\/p>\n<p><\/span><\/p>\n<p>         <span style=\"--darkreader-inline-color: var(--darkreader-text-ffffff, #e8e6e3)\" class=\"nodeLabel\"><\/p>\n<p>NT APINtReadFile()<\/p>\n<p><\/span><\/p>\n<p>         <span style=\"--darkreader-inline-color: var(--darkreader-text-ffffff, #e8e6e3)\" class=\"nodeLabel\"><\/p>\n<p>\u5185\u6838NtReadFile (kernel)<\/p>\n<p><\/span><\/p>\n<p>         <span style=\"--darkreader-inline-color: var(--darkreader-text-ffffff, #e8e6e3)\" class=\"nodeLabel\"><\/p>\n<p>\u9a71\u52a8DispatchRead<\/p>\n<p><\/span><\/p>\n<p>         <span style=\"--darkreader-inline-color: var(--darkreader-text-ffffff, #e8e6e3)\" class=\"nodeLabel\"><\/p>\n<p>HALREAD_PORT_UCHAR<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u786c\u4ef6I\/O\u7aef\u53e3<\/p>\n<p><\/span><\/p>\n<h5>2.3.2 \u5f02\u6b65\u7a7f\u900f&#xff08;Asynchronous Penetration&#xff09;<\/h5>\n<p>\u5f02\u6b65\u7a7f\u900f\u662f\u6307\u8bf7\u6c42\u901a\u8fc7\u4e2d\u95f4\u6570\u636e\u7ed3\u6784&#xff08;IRP\u3001\u6d88\u606f\u3001\u5b8c\u6210\u5305&#xff09;\u4f20\u9012&#xff0c;\u53d1\u8d77\u8bf7\u6c42\u7684\u5c42\u4e0d\u7b49\u5f85\u5b8c\u6210&#xff0c;\u800c\u662f\u7ee7\u7eed\u6267\u884c\u3002\u8bf7\u6c42\u5b8c\u6210\u540e&#xff0c;\u901a\u8fc7\u56de\u8c03\u3001\u4e8b\u4ef6\u6216\u5b8c\u6210\u7aef\u53e3\u673a\u5236\u901a\u77e5\u53d1\u8d77\u65b9\u3002<\/p>\n<p>\u5f02\u6b65\u7a7f\u900f\u7684\u7279\u5f81&#xff1a;<\/p>\n<ul>\n<li>\u65ad\u7eed\u8c03\u7528\u6808&#xff1a;\u8bf7\u6c42\u4f20\u9012\u548c\u5b8c\u6210\u901a\u77e5\u4e0d\u5728\u540c\u4e00\u4e2a\u8c03\u7528\u6808\u4e0a\u3002\u8bf7\u6c42\u53d1\u8d77\u65f6\u7684\u6808\u5728\u51fd\u6570\u8fd4\u56de\u540e\u5df2\u7ecf\u5c55\u5f00\u3002<\/li>\n<li>\u5ef6\u8fdf\u5b8c\u6210&#xff1a;\u8bf7\u6c42\u53ef\u80fd\u5728\u672a\u6765\u7684\u67d0\u4e2a\u65f6\u523b\u624d\u5b8c\u6210&#xff0c;\u53d1\u8d77\u65b9\u9700\u8981\u7b49\u5f85\u6216\u8f6e\u8be2\u3002<\/li>\n<li>\u6570\u636e\u7ed3\u6784\u4f20\u9012&#xff1a;\u53c2\u6570\u5c01\u88c5\u5728 IRP \u7b49\u6570\u636e\u7ed3\u6784\u4e2d\u4f20\u9012&#xff0c;\u800c\u975e\u901a\u8fc7\u6808\u3002<\/li>\n<li>\u9002\u7528\u573a\u666f&#xff1a;\u78c1\u76d8 I\/O\u3001\u7f51\u7edc I\/O\u3001\u8bbe\u5907 I\/O \u7b49\u9700\u8981\u786c\u4ef6\u54cd\u5e94\u7684\u64cd\u4f5c\u3002<\/li>\n<\/ul>\n<p>\u5f02\u6b65\u7a7f\u900f\u7684\u5178\u578b\u8def\u5f84&#xff08;\u4ee5\u5f02\u6b65 ReadFile \u4e3a\u4f8b&#xff09;&#xff1a;<\/p>\n<p>     \u786c\u4ef6<\/p>\n<p>     HAL<\/p>\n<p>     \u9a71\u52a8<\/p>\n<p>     \u5185\u6838 I\/O\u7ba1\u7406\u5668<\/p>\n<p>     NT API<\/p>\n<p>     Win32 API<\/p>\n<p>     \u5e94\u7528\u7a0b\u5e8f<\/p>\n<p>      \u786c\u4ef6<\/p>\n<p>      HAL<\/p>\n<p>      \u9a71\u52a8<\/p>\n<p>      \u5185\u6838 I\/O\u7ba1\u7406\u5668<\/p>\n<p>      NT API<\/p>\n<p>      Win32 API<\/p>\n<p>      \u5e94\u7528\u7a0b\u5e8f<\/p>\n<p>  #mermaid-svg-qWl4raEJU67qm0PT{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-qWl4raEJU67qm0PT .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-qWl4raEJU67qm0PT .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-qWl4raEJU67qm0PT .error-icon{fill:#552222;}#mermaid-svg-qWl4raEJU67qm0PT .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-qWl4raEJU67qm0PT .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-qWl4raEJU67qm0PT .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-qWl4raEJU67qm0PT .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-qWl4raEJU67qm0PT .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-qWl4raEJU67qm0PT .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-qWl4raEJU67qm0PT .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-qWl4raEJU67qm0PT .marker{fill:#333333;stroke:#333333;}#mermaid-svg-qWl4raEJU67qm0PT .marker.cross{stroke:#333333;}#mermaid-svg-qWl4raEJU67qm0PT svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-qWl4raEJU67qm0PT p{margin:0;}#mermaid-svg-qWl4raEJU67qm0PT .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-qWl4raEJU67qm0PT text.actor&gt;tspan{fill:black;stroke:none;}#mermaid-svg-qWl4raEJU67qm0PT .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-qWl4raEJU67qm0PT .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-qWl4raEJU67qm0PT .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-qWl4raEJU67qm0PT .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-qWl4raEJU67qm0PT #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-qWl4raEJU67qm0PT .sequenceNumber{fill:white;}#mermaid-svg-qWl4raEJU67qm0PT #sequencenumber{fill:#333;}#mermaid-svg-qWl4raEJU67qm0PT #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-qWl4raEJU67qm0PT .messageText{fill:#333;stroke:none;}#mermaid-svg-qWl4raEJU67qm0PT .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-qWl4raEJU67qm0PT .labelText,#mermaid-svg-qWl4raEJU67qm0PT .labelText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-qWl4raEJU67qm0PT .loopText,#mermaid-svg-qWl4raEJU67qm0PT .loopText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-qWl4raEJU67qm0PT .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-qWl4raEJU67qm0PT .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-qWl4raEJU67qm0PT .noteText,#mermaid-svg-qWl4raEJU67qm0PT .noteText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-qWl4raEJU67qm0PT .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-qWl4raEJU67qm0PT .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-qWl4raEJU67qm0PT .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-qWl4raEJU67qm0PT .actorPopupMenu{position:absolute;}#mermaid-svg-qWl4raEJU67qm0PT .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 \/ 0.4));}#mermaid-svg-qWl4raEJU67qm0PT .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-qWl4raEJU67qm0PT .actor-man circle,#mermaid-svg-qWl4raEJU67qm0PT line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-qWl4raEJU67qm0PT :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>     \u9636\u6bb51: \u8bf7\u6c42\u53d1\u8d77 (\u540c\u6b65\u6808)<\/p>\n<p>     \u9636\u6bb52: \u786c\u4ef6\u6267\u884c (\u5f02\u6b65)<\/p>\n<p>     \u9636\u6bb53: \u5b8c\u6210\u901a\u77e5 (\u65b0\u6808)<\/p>\n<p>   ReadFile(overlapped)<\/p>\n<p>   NtReadFile()<\/p>\n<p>   syscall<\/p>\n<p>   \u521b\u5efaIRP, \u586b\u5145\u53c2\u6570<\/p>\n<p>   IoCallDriver(IRP)<\/p>\n<p>   \u7f16\u7a0bDMA\u63a7\u5236\u5668<\/p>\n<p>   \u5199MMIO\u5bc4\u5b58\u5668<\/p>\n<p>   \u8fd4\u56deSTATUS_PENDING<\/p>\n<p>   \u8fd4\u56deSTATUS_PENDING<\/p>\n<p>   \u8fd4\u56deSTATUS_PENDING<\/p>\n<p>   ReadFile\u8fd4\u56deFALSE, GetLastError&#061;ERROR_IO_PENDING<\/p>\n<p>   \u6267\u884cDMA\u4f20\u8f93<\/p>\n<p>   \u89e6\u53d1\u4e2d\u65ad(IRQ)<\/p>\n<p>   ISR\u6267\u884c<\/p>\n<p>   DPC\u4f8b\u7a0b\u5904\u7406\u5b8c\u6210<\/p>\n<p>   IoCompleteRequest(IRP)<\/p>\n<p>   \u590d\u5236\u6570\u636e\u5230\u7528\u6237\u7f13\u51b2\u533a<\/p>\n<p>   \u8bbe\u7f6e overlapped.hEvent<\/p>\n<p>   GetOverlappedResult() \u83b7\u53d6\u7ed3\u679c<\/p>\n<h4>2.4 \u540c\u6b65\u7a7f\u900f vs \u5f02\u6b65\u7a7f\u900f\u5bf9\u6bd4<\/h4>\n<p>  #mermaid-svg-eq4tzkaGJO1fc0b2{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-eq4tzkaGJO1fc0b2 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-eq4tzkaGJO1fc0b2 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-eq4tzkaGJO1fc0b2 .error-icon{fill:#552222;}#mermaid-svg-eq4tzkaGJO1fc0b2 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-eq4tzkaGJO1fc0b2 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-eq4tzkaGJO1fc0b2 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-eq4tzkaGJO1fc0b2 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-eq4tzkaGJO1fc0b2 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-eq4tzkaGJO1fc0b2 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-eq4tzkaGJO1fc0b2 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-eq4tzkaGJO1fc0b2 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-eq4tzkaGJO1fc0b2 .marker.cross{stroke:#333333;}#mermaid-svg-eq4tzkaGJO1fc0b2 svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-eq4tzkaGJO1fc0b2 p{margin:0;}#mermaid-svg-eq4tzkaGJO1fc0b2 .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-eq4tzkaGJO1fc0b2 .cluster-label text{fill:#333;}#mermaid-svg-eq4tzkaGJO1fc0b2 .cluster-label span{color:#333;}#mermaid-svg-eq4tzkaGJO1fc0b2 .cluster-label span p{background-color:transparent;}#mermaid-svg-eq4tzkaGJO1fc0b2 .label text,#mermaid-svg-eq4tzkaGJO1fc0b2 span{fill:#333;color:#333;}#mermaid-svg-eq4tzkaGJO1fc0b2 .node rect,#mermaid-svg-eq4tzkaGJO1fc0b2 .node circle,#mermaid-svg-eq4tzkaGJO1fc0b2 .node ellipse,#mermaid-svg-eq4tzkaGJO1fc0b2 .node polygon,#mermaid-svg-eq4tzkaGJO1fc0b2 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-eq4tzkaGJO1fc0b2 .rough-node .label text,#mermaid-svg-eq4tzkaGJO1fc0b2 .node .label text,#mermaid-svg-eq4tzkaGJO1fc0b2 .image-shape .label,#mermaid-svg-eq4tzkaGJO1fc0b2 .icon-shape .label{text-anchor:middle;}#mermaid-svg-eq4tzkaGJO1fc0b2 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-eq4tzkaGJO1fc0b2 .rough-node .label,#mermaid-svg-eq4tzkaGJO1fc0b2 .node .label,#mermaid-svg-eq4tzkaGJO1fc0b2 .image-shape .label,#mermaid-svg-eq4tzkaGJO1fc0b2 .icon-shape .label{text-align:center;}#mermaid-svg-eq4tzkaGJO1fc0b2 .node.clickable{cursor:pointer;}#mermaid-svg-eq4tzkaGJO1fc0b2 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-eq4tzkaGJO1fc0b2 .arrowheadPath{fill:#333333;}#mermaid-svg-eq4tzkaGJO1fc0b2 .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-eq4tzkaGJO1fc0b2 .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-eq4tzkaGJO1fc0b2 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-eq4tzkaGJO1fc0b2 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-eq4tzkaGJO1fc0b2 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-eq4tzkaGJO1fc0b2 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-eq4tzkaGJO1fc0b2 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-eq4tzkaGJO1fc0b2 .cluster text{fill:#333;}#mermaid-svg-eq4tzkaGJO1fc0b2 .cluster span{color:#333;}#mermaid-svg-eq4tzkaGJO1fc0b2 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-eq4tzkaGJO1fc0b2 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-eq4tzkaGJO1fc0b2 rect.text{fill:none;stroke-width:0;}#mermaid-svg-eq4tzkaGJO1fc0b2 .icon-shape,#mermaid-svg-eq4tzkaGJO1fc0b2 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-eq4tzkaGJO1fc0b2 .icon-shape p,#mermaid-svg-eq4tzkaGJO1fc0b2 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-eq4tzkaGJO1fc0b2 .icon-shape .label rect,#mermaid-svg-eq4tzkaGJO1fc0b2 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-eq4tzkaGJO1fc0b2 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-eq4tzkaGJO1fc0b2 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-eq4tzkaGJO1fc0b2 :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u5f02\u6b65\u7a7f\u900f<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/p>\n<p>\u7acb\u5373\u8fd4\u56dePENDING<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/p>\n<p>\u4e8b\u4ef6\u901a\u77e5\/IOCP<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u5e94\u7528\u5c42\u8c03\u7528ReadFile(Overlapped)<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>Win32\u5c42ReadFile<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>NT\u5c42NtReadFile<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u5185\u6838\u5c42\u521b\u5efaIRP<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u9a71\u52a8\u5c42\u6392\u961fIRP<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u786c\u4ef6\u5b8c\u6210\u89e6\u53d1\u4e2d\u65ad<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u9a71\u52a8ISR&#043;DPC\u5b8c\u6210IRP<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u5185\u6838IoCompleteRequest<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u7279\u5f81:1. \u8c03\u7528\u6808\u65ad\u7eed2. \u5ef6\u8fdf\u5b8c\u62103. IRP\u4f20\u9012\u53c2\u65704. \u7ebf\u7a0b\u4e0d\u963b\u585e<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u540c\u6b65\u7a7f\u900f<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/p>\n<p>\u540c\u4e00\u8c03\u7528\u6808\u8fd4\u56de<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u5e94\u7528\u5c42\u8c03\u7528ReadFile<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>Win32\u5c42ReadFile<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>NT\u5c42NtReadFile<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u5185\u6838\u5c42NtReadFile<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u9a71\u52a8\u5c42DispatchRead<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>HAL\u5c42\u7aef\u53e3\u8bfb\u53d6<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u786c\u4ef6\u8fd4\u56de\u6570\u636e<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u7279\u5f81:1. \u8c03\u7528\u6808\u8fde\u7eed2. \u5373\u65f6\u8fd4\u56de3. \u6808\u4f20\u9012\u53c2\u65704. \u7ebf\u7a0b\u963b\u585e\u7b49\u5f85<\/p>\n<p><\/span><\/p>\n<h4>2.5 \u7a7f\u900f\u4e2d\u7684\u6570\u636e\u6d41\u4e0e\u63a7\u5236\u6d41<\/h4>\n<p>\u5728\u7a7f\u900f\u8fc7\u7a0b\u4e2d&#xff0c;\u9700\u8981\u533a\u5206\u4e24\u79cd\u6d41&#xff1a;<\/p>\n<p>\u63a7\u5236\u6d41&#xff08;Control Flow&#xff09;&#xff1a;\u6307\u4ee4\u6267\u884c\u7684\u987a\u5e8f&#xff0c;\u4f53\u73b0\u4e3a\u51fd\u6570\u8c03\u7528\u548c\u8fd4\u56de\u3002\u63a7\u5236\u6d41\u6cbf\u7740\u8c03\u7528\u6808\u81ea\u4e0a\u800c\u4e0b&#xff08;\u8c03\u7528\u65f6&#xff09;\u548c\u81ea\u4e0b\u800c\u4e0a&#xff08;\u8fd4\u56de\u65f6&#xff09;\u6d41\u52a8\u3002<\/p>\n<p>\u6570\u636e\u6d41&#xff08;Data Flow&#xff09;&#xff1a;\u8bf7\u6c42\u53c2\u6570\u548c\u8fd4\u56de\u6570\u636e\u7684\u6d41\u52a8\u3002\u6570\u636e\u6d41\u53ef\u80fd\u4e0e\u63a7\u5236\u6d41\u540c\u5411&#xff08;\u8bf7\u6c42\u53c2\u6570\u81ea\u4e0a\u800c\u4e0b&#xff09;&#xff0c;\u4e5f\u53ef\u80fd\u53cd\u5411&#xff08;\u8fd4\u56de\u6570\u636e\u81ea\u4e0b\u800c\u4e0a&#xff09;&#xff0c;\u751a\u81f3\u53ef\u80fd\u8de8\u7ebf\u7a0b\u6d41\u52a8&#xff08;\u5f02\u6b65\u5b8c\u6210\u65f6&#xff09;\u3002<\/p>\n<p>\u5728\u540c\u6b65\u7a7f\u900f\u4e2d&#xff0c;\u63a7\u5236\u6d41\u548c\u6570\u636e\u6d41\u5728\u540c\u4e00\u8c03\u7528\u6808\u4e0a\u7d27\u5bc6\u8026\u5408\u3002\u5728\u5f02\u6b65\u7a7f\u900f\u4e2d&#xff0c;\u63a7\u5236\u6d41\u5728\u8bf7\u6c42\u53d1\u8d77\u548c\u5b8c\u6210\u901a\u77e5\u4e4b\u95f4\u65ad\u5f00&#xff0c;\u6570\u636e\u6d41\u901a\u8fc7 IRP \u7b49\u6570\u636e\u7ed3\u6784&#034;\u642d\u6865&#034;\u8fde\u63a5\u4e24\u4e2a\u72ec\u7acb\u7684\u63a7\u5236\u6d41\u3002<\/p>\n<h4>2.6 \u7a7f\u900f\u7684\u672c\u8d28&#xff1a;\u62bd\u8c61\u7684\u9010\u5c42\u5265\u79bb<\/h4>\n<p>\u4ece\u54f2\u5b66\u89d2\u5ea6\u770b&#xff0c;\u7eb5\u5411\u7a7f\u900f\u7684\u672c\u8d28\u662f\u62bd\u8c61\u7684\u9010\u5c42\u5265\u79bb\u3002\u6bcf\u4e00\u5c42\u90fd\u4e3a\u4e0a\u4e00\u5c42\u63d0\u4f9b\u4e86\u4e00\u79cd\u62bd\u8c61&#xff1a;<\/p>\n<ul>\n<li>\u5e94\u7528\u7a0b\u5e8f\u62bd\u8c61\u4e86&#034;\u4e1a\u52a1\u64cd\u4f5c&#034;&#xff08;\u201c\u4fdd\u5b58\u6587\u6863\u201d&#xff09;<\/li>\n<li>\u8fd0\u884c\u65f6\u5e93\u62bd\u8c61\u4e86&#034;\u7cfb\u7edf\u8d44\u6e90\u64cd\u4f5c&#034;&#xff08;\u201c\u5199\u6587\u4ef6\u201d&#xff09;<\/li>\n<li>Win32 API \u62bd\u8c61\u4e86&#034;\u5185\u6838\u670d\u52a1\u8c03\u7528&#034;&#xff08;CreateFileW&#xff09;<\/li>\n<li>NT API \u62bd\u8c61\u4e86&#034;\u7cfb\u7edf\u8c03\u7528\u63a5\u53e3&#034;&#xff08;NtCreateFile&#xff09;<\/li>\n<li>syscall \u62bd\u8c61\u4e86&#034;\u7279\u6743\u7ea7\u5207\u6362&#034;&#xff08;syscall\u53f7 \u2192 \u5185\u6838\u51fd\u6570&#xff09;<\/li>\n<li>\u5185\u6838\u62bd\u8c61\u4e86&#034;\u8d44\u6e90\u7ba1\u7406&#034;&#xff08;\u5bf9\u8c61\u7ba1\u7406\u5668\u3001I\/O\u7ba1\u7406\u5668&#xff09;<\/li>\n<li>\u9a71\u52a8\u62bd\u8c61\u4e86&#034;\u8bbe\u5907\u64cd\u4f5c&#034;&#xff08;\u201c\u8bfb\u6247\u533aN\u201d&#xff09;<\/li>\n<li>HAL \u62bd\u8c61\u4e86&#034;\u786c\u4ef6\u8bbf\u95ee&#034;&#xff08;\u201c\u8bfb\u7aef\u53e30x1F0\u201d&#xff09;<\/li>\n<li>\u786c\u4ef6\u62bd\u8c61\u4e86&#034;\u7535\u6c14\u64cd\u4f5c&#034;&#xff08;\u201c\u8bbe\u7f6e\u6570\u636e\u7ebf\u7535\u5e73\u201d&#xff09;<\/li>\n<\/ul>\n<p>\u7a7f\u900f\u7684\u8fc7\u7a0b&#xff0c;\u5c31\u662f\u5c06\u8fd9\u4e9b\u62bd\u8c61\u9010\u5c42\u5265\u79bb&#xff0c;\u76f4\u5230\u6700\u7ec8\u53d8\u6210\u7269\u7406\u786c\u4ef6\u4e0a\u7684\u7535\u4fe1\u53f7\u3002\u7406\u89e3\u7a7f\u900f\u673a\u5236&#xff0c;\u5c31\u662f\u7406\u89e3\u6bcf\u4e00\u5c42\u62bd\u8c61\u7684\u8fb9\u754c\u2014\u2014\u5b83\u9690\u85cf\u4e86\u4ec0\u4e48\u3001\u66b4\u9732\u4e86\u4ec0\u4e48\u3001\u5982\u4f55\u8f6c\u6362\u3002<\/p>\n<hr \/>\n<h3>3. \u7b2c1\u5c42\u7a7f\u900f&#xff1a;\u5e94\u7528\u7a0b\u5e8f\u2192\u7f16\u7a0b\u8bed\u8a00<\/h3>\n<h4>3.1 \u5c01\u88c5\u8fb9\u754c&#xff1a;\u8bed\u6cd5\u548c\u8bed\u4e49\u89c4\u5219<\/h4>\n<p>\u5e94\u7528\u7a0b\u5e8f\u5230\u7f16\u7a0b\u8bed\u8a00\u4e4b\u95f4\u7684\u7a7f\u900f\u8fb9\u754c\u662f\u8bed\u8a00\u89c4\u8303&#xff08;Language Specification&#xff09;\u3002\u8bed\u8a00\u89c4\u8303\u5b9a\u4e49\u4e86\u6e90\u4ee3\u7801\u7684\u5408\u6cd5\u8bed\u6cd5\u548c\u8bed\u4e49&#xff0c;\u4f46\u4e0d\u89c4\u5b9a\u5e95\u5c42\u5982\u4f55\u5b9e\u73b0\u3002\u5f00\u53d1\u8005\u7f16\u5199\u7b26\u5408\u8bed\u8a00\u89c4\u8303\u7684\u4ee3\u7801&#xff0c;\u7f16\u8bd1\u5668\/\u89e3\u91ca\u5668\u8d1f\u8d23\u5c06\u5176\u7ffb\u8bd1\u4e3a\u53ef\u6267\u884c\u6307\u4ee4\u3002<\/p>\n<p>\u8fd9\u6761\u8fb9\u754c\u7684\u7279\u5f81&#xff1a;<\/p>\n<ul>\n<li>\u58f0\u660e\u6027&#xff1a;\u5f00\u53d1\u8005\u58f0\u660e&#034;\u505a\u4ec0\u4e48&#034;&#xff08;\u58f0\u660e\u53d8\u91cf\u3001\u8c03\u7528\u51fd\u6570\u3001\u63a7\u5236\u6d41&#xff09;&#xff0c;\u8bed\u8a00\u8fd0\u884c\u65f6\u51b3\u5b9a&#034;\u600e\u4e48\u505a&#034;\u3002<\/li>\n<li>\u5e73\u53f0\u65e0\u5173\u6027&#xff1a;\u540c\u4e00\u6bb5 C# \u4ee3\u7801\u53ef\u4ee5\u5728 Windows\u3001Linux\u3001macOS \u4e0a\u7f16\u8bd1\u8fd0\u884c&#xff08;.NET \u8de8\u5e73\u53f0&#xff09;\u3002<\/li>\n<li>\u4f18\u5316\u7a7a\u95f4&#xff1a;\u7f16\u8bd1\u5668\u6709\u81ea\u7531\u9009\u62e9\u5982\u4f55\u7ffb\u8bd1\u2014\u2014\u5bc4\u5b58\u5668\u5206\u914d\u3001\u6307\u4ee4\u9009\u62e9\u3001\u5185\u8054\u5c55\u5f00\u7b49\u90fd\u7531\u7f16\u8bd1\u5668\u51b3\u5b9a\u3002<\/li>\n<\/ul>\n<h4>3.2 \u7a7f\u900f\u65b9\u5f0f&#xff1a;\u7f16\u8bd1\u5668\/\u89e3\u91ca\u5668\u7ffb\u8bd1<\/h4>\n<p>\u6839\u636e\u8bed\u8a00\u7c7b\u578b&#xff0c;\u7ffb\u8bd1\u65b9\u5f0f\u5206\u4e3a\u4e09\u7c7b&#xff1a;<\/p>\n<p>\u7f16\u8bd1\u578b&#xff08;Ahead-of-Time Compilation&#xff09;&#xff1a;C\/C&#043;&#043;\/Rust \u7b49\u8bed\u8a00\u5728\u5f00\u53d1\u9636\u6bb5\u7531\u7f16\u8bd1\u5668\u5c06\u6e90\u4ee3\u7801\u7f16\u8bd1\u4e3a\u673a\u5668\u7801\u3002\u7a7f\u900f\u53d1\u751f\u5728\u7f16\u8bd1\u65f6&#xff0c;\u8fd0\u884c\u65f6\u4e0d\u518d\u6709\u7ffb\u8bd1\u5f00\u9500\u3002<\/p>\n<p>\u6e90\u4ee3\u7801(.c\/.cpp) \u2192 \u9884\u5904\u7406 \u2192 \u7f16\u8bd1 \u2192 \u6c47\u7f16 \u2192 \u673a\u5668\u7801(.obj) \u2192 \u94fe\u63a5 \u2192 \u53ef\u6267\u884c\u6587\u4ef6(.exe)<\/p>\n<p>JIT\u578b&#xff08;Just-In-Time Compilation&#xff09;&#xff1a;C#\/Java \u7b49\u8bed\u8a00\u5148\u5c06\u6e90\u4ee3\u7801\u7f16\u8bd1\u4e3a\u4e2d\u95f4\u8bed\u8a00&#xff08;IL\/\u5b57\u8282\u7801&#xff09;&#xff0c;\u8fd0\u884c\u65f6\u7531 JIT \u7f16\u8bd1\u5668\u5c06\u70ed\u70b9\u4ee3\u7801\u7f16\u8bd1\u4e3a\u673a\u5668\u7801\u3002\u7a7f\u900f\u5206\u4e3a\u4e24\u9636\u6bb5&#xff1a;\u7f16\u8bd1\u65f6&#xff08;\u6e90\u7801\u2192IL&#xff09;\u548c\u8fd0\u884c\u65f6&#xff08;IL\u2192\u673a\u5668\u7801&#xff09;\u3002<\/p>\n<p>\u6e90\u4ee3\u7801(.cs) \u2192 \u7f16\u8bd1\u5668 \u2192 IL\u5b57\u8282\u7801(.dll) \u2192 JIT\u7f16\u8bd1\u5668 \u2192 \u673a\u5668\u7801(\u5185\u5b58\u4e2d)<\/p>\n<p>\u89e3\u91ca\u578b&#xff08;Interpretation&#xff09;&#xff1a;Python\/Ruby\/JavaScript \u7b49\u8bed\u8a00\u7531\u89e3\u91ca\u5668\u9010\u884c\u6216\u9010\u5757\u7ffb\u8bd1\u6267\u884c\u3002\u7a7f\u900f\u5728\u8fd0\u884c\u65f6\u6301\u7eed\u53d1\u751f\u3002<\/p>\n<p>\u6e90\u4ee3\u7801(.py) \u2192 \u89e3\u91ca\u5668 \u2192 AST \u2192 \u5b57\u8282\u7801(.pyc) \u2192 \u865a\u62df\u673a \u2192 \u6267\u884c<\/p>\n<h4>3.3 \u793a\u4f8b1&#xff1a;C# \u4ee3\u7801 \u2192 IL \u6307\u4ee4 \u2192 JIT \u2192 \u673a\u5668\u7801<\/h4>\n<p>\u8003\u8651\u4e00\u4e2a\u7b80\u5355\u7684 C# \u6587\u4ef6\u8bfb\u53d6\u64cd\u4f5c&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ C# \u6e90\u4ee3\u7801 (\u5e94\u7528\u7a0b\u5e8f\u5c42)<\/span><br \/>\n<span class=\"token keyword\">using<\/span> <span class=\"token namespace\">System<span class=\"token punctuation\">.<\/span>IO<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token keyword\">class<\/span> <span class=\"token class-name\">Program<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">static<\/span> <span class=\"token return-type class-name\"><span class=\"token keyword\">void<\/span><\/span> <span class=\"token function\">Main<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token class-name\"><span class=\"token keyword\">string<\/span><\/span> content <span class=\"token operator\">&#061;<\/span> File<span class=\"token punctuation\">.<\/span><span class=\"token function\">ReadAllText<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#064;&#034;C:\\\\test.txt&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        Console<span class=\"token punctuation\">.<\/span><span class=\"token function\">WriteLine<\/span><span class=\"token punctuation\">(<\/span>content<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>C# \u7f16\u8bd1\u5668&#xff08;Roslyn&#xff09;\u5c06\u8fd9\u6bb5\u4ee3\u7801\u7f16\u8bd1\u4e3a IL&#xff08;Intermediate Language&#xff09;&#xff1a;<\/p>\n<p>\/\/ IL \u4e2d\u95f4\u8bed\u8a00 (\u7f16\u7a0b\u8bed\u8a00\u5c42)<br \/>\n.method private hidebysig static void Main() cil managed<br \/>\n{<br \/>\n    .entrypoint<br \/>\n    .maxstack 1<br \/>\n    .locals init (<br \/>\n        [0] string content<br \/>\n    )<\/p>\n<p>    \/\/ ldstr: \u52a0\u8f7d\u5b57\u7b26\u4e32\u5e38\u91cf &#034;C:\\\\test.txt&#034;<br \/>\n    IL_0000: ldstr        &#034;C:\\\\\\\\test.txt&#034;<br \/>\n    \/\/ call: \u8c03\u7528 File.ReadAllText<br \/>\n    IL_0005: call         string [System.IO.FileSystem]System.IO.File::ReadAllText(string)<br \/>\n    \/\/ stloc.0: \u5b58\u50a8\u5230\u5c40\u90e8\u53d8\u91cf content<br \/>\n    IL_000a: stloc.0<\/p>\n<p>    \/\/ ldloc.0: \u52a0\u8f7d content<br \/>\n    IL_000b: ldloc.0<br \/>\n    \/\/ call: \u8c03\u7528 Console.WriteLine<br \/>\n    IL_000c: call         void [System.Console]System.Console::WriteLine(string)<\/p>\n<p>    IL_0011: ret<br \/>\n}<\/p>\n<p>\u5f53 File.ReadAllText \u7b2c\u4e00\u6b21\u88ab\u8c03\u7528\u65f6&#xff0c;.NET \u7684 JIT \u7f16\u8bd1\u5668&#xff08;RyuJIT&#xff09;\u5c06\u4e0a\u8ff0 IL \u7f16\u8bd1\u4e3a x64 \u673a\u5668\u7801&#xff1a;<\/p>\n<p>; x64 \u673a\u5668\u7801 (JIT\u8f93\u51fa, \u5728\u5185\u5b58\u4e2d\u6267\u884c)<br \/>\n; \u5bf9\u5e94 IL_0000 ~ IL_000a: File.ReadAllText(&#034;C:\\\\test.txt&#034;)<\/p>\n<p>; \u5c06\u5b57\u7b26\u4e32\u5e38\u91cf\u5730\u5740\u52a0\u8f7d\u5230 RCX (\u7b2c\u4e00\u4e2a\u53c2\u6570, this\/objref)<br \/>\nlea rcx, [rip &#043; 0x????]      ; \u6307\u5411 &#034;C:\\\\test.txt&#034; \u7684\u6258\u7ba1\u5806\u5b57\u7b26\u4e32\u5bf9\u8c61<\/p>\n<p>; \u8c03\u7528 File.ReadAllText \u7684 JIT \u7f16\u8bd1\u7248\u672c<br \/>\n; \u5982\u679c\u662f\u9996\u6b21\u8c03\u7528, \u5148\u8df3\u5230 JIT \u7f16\u8bd1\u6869(PreStub), \u7f16\u8bd1\u5b8c\u6210\u540e\u56de\u586b<br \/>\ncall JIT_MethodAccessor       ; \u2192 RyuJIT \u7f16\u8bd1 \u2192 \u8df3\u8f6c\u5230\u7f16\u8bd1\u540e\u7684\u673a\u5668\u7801<\/p>\n<p>; JIT\u7f16\u8bd1\u540e\u7684 File.ReadAllText \u673a\u5668\u7801\u5927\u81f4\u7ed3\u6784:<br \/>\n; (1) \u5728\u6258\u7ba1\u5806\u4e0a\u5206\u914d FileStream \u5bf9\u8c61<br \/>\n;    call CORINFO_HELP_NEWFAST         ; \u2192 GC \u5206\u914d\u5668<br \/>\n; (2) \u521d\u59cb\u5316 FileStream \u5b57\u6bb5<br \/>\n;    mov [rax&#043;offset], rcx             ; \u8bbe\u7f6e _path \u5b57\u6bb5<br \/>\n; (3) \u8c03\u7528 FileStream \u6784\u9020\u51fd\u6570\u5185\u90e8\u903b\u8f91<br \/>\n;    \u2192 \u6700\u7ec8\u8c03\u7528 Win32 CreateFileW (\u901a\u8fc7 P\/Invoke)<br \/>\n; (4) \u8bfb\u53d6\u6587\u4ef6\u5185\u5bb9\u5230 byte[] \u7f13\u51b2\u533a<br \/>\n;    \u2192 \u6700\u7ec8\u8c03\u7528 Win32 ReadFile<br \/>\n; (5) \u5c06 byte[] \u8f6c\u6362\u4e3a string (UTF-8 \u89e3\u7801)<br \/>\n;    \u2192 \u8c03\u7528 Encoding.UTF8.GetString<br \/>\n; (6) \u8fd4\u56de string \u5f15\u7528\u5230 RAX<br \/>\nmov [rbp-0x08], rax           ; \u5b58\u50a8\u8fd4\u56de\u503c\u5230 content \u5c40\u90e8\u53d8\u91cf<\/p>\n<h4>3.4 \u793a\u4f8b2&#xff1a;C \u4ee3\u7801 \u2192 \u673a\u5668\u7801<\/h4>\n<p>\u5bf9\u4e8e C \u8bed\u8a00&#xff0c;\u7f16\u8bd1\u5668\u76f4\u63a5\u5c06\u6e90\u4ee3\u7801\u7ffb\u8bd1\u4e3a\u673a\u5668\u7801&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ C \u6e90\u4ee3\u7801 (\u5e94\u7528\u7a0b\u5e8f\u5c42)<\/span><br \/>\n<span class=\"token macro property\"><span class=\"token directive-hash\">#<\/span><span class=\"token directive keyword\">include<\/span> <span class=\"token string\">&lt;stdio.h&gt;<\/span><\/span><\/p>\n<p><span class=\"token keyword\">int<\/span> <span class=\"token function\">main<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    FILE<span class=\"token operator\">*<\/span> fp <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">fopen<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;C:\\\\\\\\test.txt&#034;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">&#034;r&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>fp <span class=\"token operator\">&#061;&#061;<\/span> <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token function\">printf<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;Failed to open file\\\\n&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> <span class=\"token number\">1<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token keyword\">char<\/span> buffer<span class=\"token punctuation\">[<\/span><span class=\"token number\">256<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">while<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token function\">fgets<\/span><span class=\"token punctuation\">(<\/span>buffer<span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">sizeof<\/span><span class=\"token punctuation\">(<\/span>buffer<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span> fp<span class=\"token punctuation\">)<\/span> <span class=\"token operator\">!&#061;<\/span> <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token function\">printf<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;%s&#034;<\/span><span class=\"token punctuation\">,<\/span> buffer<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token function\">fclose<\/span><span class=\"token punctuation\">(<\/span>fp<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>MSVC \u7f16\u8bd1\u5668&#xff08;cl.exe&#xff09;\u5c06 fopen \u8c03\u7528\u7f16\u8bd1\u4e3a\u4ee5\u4e0b x64 \u673a\u5668\u7801&#xff1a;<\/p>\n<p>; x64 \u673a\u5668\u7801 (MSVC \/O2 \u4f18\u5316)<br \/>\n; \u5bf9\u5e94: FILE* fp &#061; fopen(&#034;C:\\\\\\\\test.txt&#034;, &#034;r&#034;);<\/p>\n<p>; \u52a0\u8f7d &#034;C:\\\\test.txt&#034; \u5b57\u7b26\u4e32\u5730\u5740\u5230 RCX (\u7b2c\u4e00\u4e2a\u53c2\u6570)<br \/>\nlea rcx, [rip &#043; string_data]   ; &#034;C:\\\\test.txt&#034;<\/p>\n<p>; \u52a0\u8f7d &#034;r&#034; \u5b57\u7b26\u4e32\u5730\u5740\u5230 RDX (\u7b2c\u4e8c\u4e2a\u53c2\u6570)<br \/>\nlea rdx, [rip &#043; mode_data]     ; &#034;r&#034;<\/p>\n<p>; \u8c03\u7528 fopen (\u5b9e\u9645\u94fe\u63a5\u5230 ucrtbase.dll \u7684 fopen)<br \/>\ncall fopen                      ; \u2192 \u8df3\u8f6c\u5230 ucrtbase.dll!fopen<\/p>\n<p>; \u68c0\u67e5\u8fd4\u56de\u503c\u662f\u5426\u4e3a NULL<br \/>\ntest rax, rax<br \/>\njz  .error_handler              ; \u5982\u679c\u4e3a NULL, \u8df3\u8f6c\u5230\u9519\u8bef\u5904\u7406<\/p>\n<p>; \u4fdd\u5b58 FILE* \u5230\u6808<br \/>\nmov [rbp &#8211; 0x08], rax<\/p>\n<p>; &#8230; \u540e\u7eed fgets \u5faa\u73af\u4ee3\u7801 &#8230;<\/p>\n<h4>3.5 \u7f16\u8bd1\u7a7f\u900f\u6d41\u7a0b\u56fe<\/h4>\n<p>  #mermaid-svg-FkAMvyNx0CRELJ8H{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-FkAMvyNx0CRELJ8H .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-FkAMvyNx0CRELJ8H .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-FkAMvyNx0CRELJ8H .error-icon{fill:#552222;}#mermaid-svg-FkAMvyNx0CRELJ8H .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-FkAMvyNx0CRELJ8H .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-FkAMvyNx0CRELJ8H .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-FkAMvyNx0CRELJ8H .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-FkAMvyNx0CRELJ8H .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-FkAMvyNx0CRELJ8H .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-FkAMvyNx0CRELJ8H .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-FkAMvyNx0CRELJ8H .marker{fill:#333333;stroke:#333333;}#mermaid-svg-FkAMvyNx0CRELJ8H .marker.cross{stroke:#333333;}#mermaid-svg-FkAMvyNx0CRELJ8H svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-FkAMvyNx0CRELJ8H p{margin:0;}#mermaid-svg-FkAMvyNx0CRELJ8H .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-FkAMvyNx0CRELJ8H .cluster-label text{fill:#333;}#mermaid-svg-FkAMvyNx0CRELJ8H .cluster-label span{color:#333;}#mermaid-svg-FkAMvyNx0CRELJ8H .cluster-label span p{background-color:transparent;}#mermaid-svg-FkAMvyNx0CRELJ8H .label text,#mermaid-svg-FkAMvyNx0CRELJ8H span{fill:#333;color:#333;}#mermaid-svg-FkAMvyNx0CRELJ8H .node rect,#mermaid-svg-FkAMvyNx0CRELJ8H .node circle,#mermaid-svg-FkAMvyNx0CRELJ8H .node ellipse,#mermaid-svg-FkAMvyNx0CRELJ8H .node polygon,#mermaid-svg-FkAMvyNx0CRELJ8H .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-FkAMvyNx0CRELJ8H .rough-node .label text,#mermaid-svg-FkAMvyNx0CRELJ8H .node .label text,#mermaid-svg-FkAMvyNx0CRELJ8H .image-shape .label,#mermaid-svg-FkAMvyNx0CRELJ8H .icon-shape .label{text-anchor:middle;}#mermaid-svg-FkAMvyNx0CRELJ8H .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-FkAMvyNx0CRELJ8H .rough-node .label,#mermaid-svg-FkAMvyNx0CRELJ8H .node .label,#mermaid-svg-FkAMvyNx0CRELJ8H .image-shape .label,#mermaid-svg-FkAMvyNx0CRELJ8H .icon-shape .label{text-align:center;}#mermaid-svg-FkAMvyNx0CRELJ8H .node.clickable{cursor:pointer;}#mermaid-svg-FkAMvyNx0CRELJ8H .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-FkAMvyNx0CRELJ8H .arrowheadPath{fill:#333333;}#mermaid-svg-FkAMvyNx0CRELJ8H .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-FkAMvyNx0CRELJ8H .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-FkAMvyNx0CRELJ8H .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-FkAMvyNx0CRELJ8H .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-FkAMvyNx0CRELJ8H .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-FkAMvyNx0CRELJ8H .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-FkAMvyNx0CRELJ8H .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-FkAMvyNx0CRELJ8H .cluster text{fill:#333;}#mermaid-svg-FkAMvyNx0CRELJ8H .cluster span{color:#333;}#mermaid-svg-FkAMvyNx0CRELJ8H div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-FkAMvyNx0CRELJ8H .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-FkAMvyNx0CRELJ8H rect.text{fill:none;stroke-width:0;}#mermaid-svg-FkAMvyNx0CRELJ8H .icon-shape,#mermaid-svg-FkAMvyNx0CRELJ8H .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-FkAMvyNx0CRELJ8H .icon-shape p,#mermaid-svg-FkAMvyNx0CRELJ8H .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-FkAMvyNx0CRELJ8H .icon-shape .label rect,#mermaid-svg-FkAMvyNx0CRELJ8H .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-FkAMvyNx0CRELJ8H .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-FkAMvyNx0CRELJ8H .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-FkAMvyNx0CRELJ8H :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u7a7f\u900f\u7ed3\u679c: \u673a\u5668\u7801\u5728CPU\u4e0a\u6267\u884c<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8fd0\u884c\u65f6\u7a7f\u900f<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u7f16\u8bd1\u65f6\u7a7f\u900f (\u79bb\u7ebf)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>Roslyn\u7f16\u8bd1\u5668<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>MSVC\u7f16\u8bd1\u5668<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>IL.dll<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u94fe\u63a5\u5668link.exe<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u9996\u6b21\u8c03\u7528<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>PE\u52a0\u8f7d\u5668<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>C# \u6e90\u4ee3\u7801File.ReadAllText(path)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>C\/C&#043;&#043; \u6e90\u4ee3\u7801fopen(path, mode)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>IL \u4e2d\u95f4\u8bed\u8a00ldstr &#043; call<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u76ee\u6807\u6587\u4ef6(.obj)lea rcx &#043; call fopen<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u7b49\u5f85JIT\u7f16\u8bd1<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u53ef\u6267\u884c\u6587\u4ef6(.exe)\u542b\u673a\u5668\u7801<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>JIT\u7f16\u8bd1\u5668(RyuJIT)IL \u2192 x64\u673a\u5668\u7801<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u5185\u5b58\u4e2d\u7684\u673a\u5668\u7801call JIT_Stub \u2192 \u7f16\u8bd1 \u2192 \u56de\u586b<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u5185\u5b58\u4e2d\u7684\u673a\u5668\u7801\u76f4\u63a5\u6267\u884c<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>CPU\u6267\u884c\u6307\u4ee4lea\/call\/mov\/ret<\/p>\n<p><\/span><\/p>\n<h4>3.6 \u7f16\u8bd1\u7a7f\u900f\u4e2d\u7684\u4f18\u5316<\/h4>\n<p>\u7f16\u8bd1\u5668\u5728\u7a7f\u900f\u8fc7\u7a0b\u4e2d\u4f1a\u6267\u884c\u591a\u79cd\u4f18\u5316&#xff0c;\u8fd9\u4e9b\u4f18\u5316\u6539\u53d8\u4e86\u8bf7\u6c42\u7684\u5f62\u6001&#xff1a;<\/p>\n<p>\u5185\u8054\u5c55\u5f00&#xff08;Inlining&#xff09;&#xff1a;\u7f16\u8bd1\u5668\u5c06\u5c0f\u51fd\u6570\u7684\u4ee3\u7801\u76f4\u63a5\u5d4c\u5165\u8c03\u7528\u70b9&#xff0c;\u6d88\u9664\u4e86\u51fd\u6570\u8c03\u7528\u5f00\u9500\u3002\u4f8b\u5982&#xff0c;\u7b80\u5355\u7684\u5c5e\u6027 getter public int Count &#061;&gt; _count; \u4f1a\u88ab\u5185\u8054\u4e3a\u4e00\u6761 mov \u6307\u4ee4\u3002<\/p>\n<p>\u5e38\u91cf\u6298\u53e0&#xff08;Constant Folding&#xff09;&#xff1a;\u7f16\u8bd1\u5668\u5728\u7f16\u8bd1\u65f6\u8ba1\u7b97\u5e38\u91cf\u8868\u8fbe\u5f0f\u3002int x &#061; 3 * 1024; \u88ab\u76f4\u63a5\u66ff\u6362\u4e3a int x &#061; 3072;\u3002<\/p>\n<p>\u6b7b\u4ee3\u7801\u6d88\u9664&#xff08;Dead Code Elimination&#xff09;&#xff1a;\u7f16\u8bd1\u5668\u5220\u9664\u4e0d\u4f1a\u6267\u884c\u7684\u4ee3\u7801\u8def\u5f84&#xff0c;\u51cf\u5c11\u7a7f\u900f\u8def\u5f84\u3002<\/p>\n<p>\u5c3e\u8c03\u7528\u4f18\u5316&#xff08;Tail Call Optimization&#xff09;&#xff1a;\u5982\u679c\u51fd\u6570\u7684\u6700\u540e\u4e00\u6b65\u662f\u8c03\u7528\u53e6\u4e00\u4e2a\u51fd\u6570&#xff0c;\u7f16\u8bd1\u5668\u53ef\u4ee5\u590d\u7528\u5f53\u524d\u6808\u5e27&#xff0c;\u907f\u514d\u6808\u589e\u957f\u3002<\/p>\n<p>\u8fd9\u4e9b\u4f18\u5316\u610f\u5473\u7740&#xff0c;\u6e90\u4ee3\u7801\u4e2d\u7684\u51fd\u6570\u8c03\u7528\u5173\u7cfb\u5e76\u4e0d\u5b8c\u5168\u7b49\u4e8e\u8fd0\u884c\u65f6\u7684\u5b9e\u9645\u8c03\u7528\u5173\u7cfb\u3002\u7f16\u8bd1\u5668\u7a7f\u900f\u662f\u4e00\u4e2a\u6709\u635f\u8fc7\u7a0b\u2014\u2014\u5b83\u6539\u53d8\u3001\u5408\u5e76\u3001\u5220\u9664\u4e86\u90e8\u5206\u8c03\u7528\u5173\u7cfb\u3002<\/p>\n<h4>3.7 \u8bed\u8a00\u5c42\u7a7f\u900f\u7684\u7279\u6b8a\u6027<\/h4>\n<p>\u4e0e\u5176\u4ed6\u5c42\u7a7f\u900f\u4e0d\u540c&#xff0c;\u8bed\u8a00\u5c42\u7a7f\u900f\u7684\u7279\u6b8a\u6027\u5728\u4e8e&#xff1a;<\/p>\n<p>\u65f6\u5e8f\u5dee\u5f02&#xff1a;\u7f16\u8bd1\u578b\u8bed\u8a00\u7684\u7a7f\u900f\u53d1\u751f\u5728\u7f16\u8bd1\u65f6&#xff08;\u79bb\u7ebf&#xff09;&#xff0c;\u8fd0\u884c\u65f6\u53ea\u6709\u673a\u5668\u7801\u6267\u884c&#xff1b;JIT \u578b\u8bed\u8a00\u7684\u7a7f\u900f\u53d1\u751f\u5728\u8fd0\u884c\u65f6&#xff08;\u9996\u6b21\u8c03\u7528\u65f6&#xff09;&#xff1b;\u89e3\u91ca\u578b\u8bed\u8a00\u7684\u7a7f\u900f\u6301\u7eed\u53d1\u751f\u5728\u8fd0\u884c\u65f6\u3002<\/p>\n<p>\u53ef\u9006\u6027&#xff1a;\u7f16\u8bd1\u7a7f\u900f\u662f\u5355\u5411\u4e0d\u53ef\u9006\u7684\u2014\u2014\u4ece\u673a\u5668\u7801\u65e0\u6cd5\u5b8c\u7f8e\u8fd8\u539f\u6e90\u4ee3\u7801&#xff08;\u53cd\u7f16\u8bd1\u53ea\u80fd\u8fd1\u4f3c&#xff09;\u3002\u800c\u5176\u4ed6\u5c42\u7a7f\u900f&#xff08;\u5982 Win32\u2192NT&#xff09;\u5728\u8fd0\u884c\u65f6\u53ef\u4ee5\u52a8\u6001\u8ffd\u8e2a&#xff08;API Hooking&#xff09;\u3002<\/p>\n<p>\u4f18\u5316\u4ecb\u5165&#xff1a;\u7f16\u8bd1\u5668\u5728\u7a7f\u900f\u8fc7\u7a0b\u4e2d\u4f1a\u8fdb\u884c\u5927\u91cf\u4f18\u5316&#xff0c;\u4f7f\u5f97\u6e90\u4ee3\u7801\u4e0e\u673a\u5668\u7801\u4e4b\u95f4\u7684\u5bf9\u5e94\u5173\u7cfb\u53d8\u5f97\u590d\u6742\u3002\u5f00\u53d1\u8005\u770b\u5230\u7684\u6e90\u4ee3\u7801\u7ed3\u6784\u53ef\u80fd\u4e0e\u5b9e\u9645\u6267\u884c\u7684\u673a\u5668\u7801\u7ed3\u6784\u5dee\u5f02\u5f88\u5927\u3002<\/p>\n<p>\u8c03\u8bd5\u4fe1\u606f&#xff1a;\u4e3a\u4e86\u5728\u8c03\u8bd5\u65f6\u80fd\u5c06\u673a\u5668\u7801\u6620\u5c04\u56de\u6e90\u4ee3\u7801&#xff0c;\u7f16\u8bd1\u5668\u4f1a\u751f\u6210\u8c03\u8bd5\u4fe1\u606f&#xff08;PDB \u6587\u4ef6&#xff09;\u3002PDB \u5b58\u50a8\u4e86\u6e90\u4ee3\u7801\u884c\u53f7\u4e0e\u673a\u5668\u7801\u5730\u5740\u7684\u6620\u5c04\u5173\u7cfb&#xff0c;\u662f\u53cd\u5411\u7a7f\u900f&#xff08;\u8c03\u8bd5&#xff09;\u7684\u5173\u952e\u3002<\/p>\n<p>  #mermaid-svg-15enuK7uLkn0d8cf{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-15enuK7uLkn0d8cf .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-15enuK7uLkn0d8cf .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-15enuK7uLkn0d8cf .error-icon{fill:#552222;}#mermaid-svg-15enuK7uLkn0d8cf .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-15enuK7uLkn0d8cf .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-15enuK7uLkn0d8cf .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-15enuK7uLkn0d8cf .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-15enuK7uLkn0d8cf .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-15enuK7uLkn0d8cf .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-15enuK7uLkn0d8cf .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-15enuK7uLkn0d8cf .marker{fill:#333333;stroke:#333333;}#mermaid-svg-15enuK7uLkn0d8cf .marker.cross{stroke:#333333;}#mermaid-svg-15enuK7uLkn0d8cf svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-15enuK7uLkn0d8cf p{margin:0;}#mermaid-svg-15enuK7uLkn0d8cf .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-15enuK7uLkn0d8cf .cluster-label text{fill:#333;}#mermaid-svg-15enuK7uLkn0d8cf .cluster-label span{color:#333;}#mermaid-svg-15enuK7uLkn0d8cf .cluster-label span p{background-color:transparent;}#mermaid-svg-15enuK7uLkn0d8cf .label text,#mermaid-svg-15enuK7uLkn0d8cf span{fill:#333;color:#333;}#mermaid-svg-15enuK7uLkn0d8cf .node rect,#mermaid-svg-15enuK7uLkn0d8cf .node circle,#mermaid-svg-15enuK7uLkn0d8cf .node ellipse,#mermaid-svg-15enuK7uLkn0d8cf .node polygon,#mermaid-svg-15enuK7uLkn0d8cf .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-15enuK7uLkn0d8cf .rough-node .label text,#mermaid-svg-15enuK7uLkn0d8cf .node .label text,#mermaid-svg-15enuK7uLkn0d8cf .image-shape .label,#mermaid-svg-15enuK7uLkn0d8cf .icon-shape .label{text-anchor:middle;}#mermaid-svg-15enuK7uLkn0d8cf .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-15enuK7uLkn0d8cf .rough-node .label,#mermaid-svg-15enuK7uLkn0d8cf .node .label,#mermaid-svg-15enuK7uLkn0d8cf .image-shape .label,#mermaid-svg-15enuK7uLkn0d8cf .icon-shape .label{text-align:center;}#mermaid-svg-15enuK7uLkn0d8cf .node.clickable{cursor:pointer;}#mermaid-svg-15enuK7uLkn0d8cf .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-15enuK7uLkn0d8cf .arrowheadPath{fill:#333333;}#mermaid-svg-15enuK7uLkn0d8cf .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-15enuK7uLkn0d8cf .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-15enuK7uLkn0d8cf .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-15enuK7uLkn0d8cf .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-15enuK7uLkn0d8cf .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-15enuK7uLkn0d8cf .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-15enuK7uLkn0d8cf .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-15enuK7uLkn0d8cf .cluster text{fill:#333;}#mermaid-svg-15enuK7uLkn0d8cf .cluster span{color:#333;}#mermaid-svg-15enuK7uLkn0d8cf div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-15enuK7uLkn0d8cf .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-15enuK7uLkn0d8cf rect.text{fill:none;stroke-width:0;}#mermaid-svg-15enuK7uLkn0d8cf .icon-shape,#mermaid-svg-15enuK7uLkn0d8cf .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-15enuK7uLkn0d8cf .icon-shape p,#mermaid-svg-15enuK7uLkn0d8cf .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-15enuK7uLkn0d8cf .icon-shape .label rect,#mermaid-svg-15enuK7uLkn0d8cf .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-15enuK7uLkn0d8cf .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-15enuK7uLkn0d8cf .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-15enuK7uLkn0d8cf :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u8fd0\u884c\u65f6<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u53cd\u5411\u7a7f\u900f (\u8c03\u8bd5)<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/p>\n<p>PDB\u6620\u5c04<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u673a\u5668\u7801\u5730\u57400x7FF6_1234<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u6e90\u4ee3\u7801\u884cProgram.cs:42<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u6b63\u5411\u7a7f\u900f (\u7f16\u8bd1)<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"edgeLabel\"><\/p>\n<p>\u7f16\u8bd1\u5668<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u6e90\u4ee3\u7801(\u9ad8\u7ea7\u62bd\u8c61)<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>\u673a\u5668\u7801(\u4f4e\u7ea7\u6307\u4ee4)<\/p>\n<p><\/span><\/p>\n<h4>3.8 \u672c\u5c42\u7a7f\u900f\u603b\u7ed3<\/h4>\n<p>\u5e94\u7528\u7a0b\u5e8f\u5230\u7f16\u7a0b\u8bed\u8a00\u7684\u7a7f\u900f\u662f\u6574\u4e2a\u5173\u7cfb\u94fe\u4e2d\u552f\u4e00\u53d1\u751f\u5728&#034;\u7f16\u8bd1\u65f6&#034;&#xff08;\u5bf9\u7f16\u8bd1\u578b\u8bed\u8a00&#xff09;\u7684\u7a7f\u900f\u3002\u5b83\u5c06\u4eba\u7c7b\u53ef\u8bfb\u7684\u6e90\u4ee3\u7801\u7ffb\u8bd1\u4e3a CPU \u53ef\u6267\u884c\u7684\u673a\u5668\u6307\u4ee4&#xff0c;\u662f\u6240\u6709\u540e\u7eed\u7a7f\u900f\u7684\u57fa\u7840\u3002\u6ca1\u6709\u8fd9\u4e00\u5c42\u7a7f\u900f&#xff0c;\u4e0a\u5c42\u7684\u4e1a\u52a1\u903b\u8f91\u5c31\u65e0\u6cd5\u8f6c\u5316\u4e3a\u4e0b\u5c42\u7684\u7cfb\u7edf\u8c03\u7528\u3002<\/p>\n<p>\u8fd9\u5c42\u7a7f\u900f\u7684\u5173\u952e\u8981\u70b9&#xff1a;<\/p>\n<ul>\n<li>\u7f16\u8bd1\u5668\u662f\u7a7f\u900f\u7684\u6267\u884c\u8005&#xff0c;\u8bed\u8a00\u89c4\u8303\u662f\u7a7f\u900f\u7684\u5951\u7ea6<\/li>\n<li>\u4e0d\u540c\u8bed\u8a00\u7c7b\u578b\u7684\u7a7f\u900f\u65f6\u673a\u4e0d\u540c&#xff08;\u7f16\u8bd1\u65f6\/\u8fd0\u884c\u65f6\/\u6301\u7eed&#xff09;<\/li>\n<li>\u7f16\u8bd1\u4f18\u5316\u4f1a\u6539\u53d8\u7a7f\u900f\u8def\u5f84\u7684\u5f62\u6001<\/li>\n<li>PDB \u6587\u4ef6\u652f\u6301\u53cd\u5411\u7a7f\u900f&#xff08;\u8c03\u8bd5&#xff09;<\/li>\n<\/ul>\n<hr \/>\n<h3>4. \u7b2c2\u5c42\u7a7f\u900f&#xff1a;\u7f16\u7a0b\u8bed\u8a00\u2192\u8fd0\u884c\u65f6\u5e93<\/h3>\n<h4>4.1 \u5c01\u88c5\u8fb9\u754c&#xff1a;\u8bed\u8a00\u6807\u51c6\u5e93API<\/h4>\n<p>\u7f16\u7a0b\u8bed\u8a00\u5230\u8fd0\u884c\u65f6\u5e93\u7684\u7a7f\u900f\u8fb9\u754c\u662f\u8bed\u8a00\u6807\u51c6\u5e93\u89c4\u8303\u3002\u6807\u51c6\u5e93\u89c4\u8303\u5b9a\u4e49\u4e86\u51fd\u6570\u7b7e\u540d\u3001\u884c\u4e3a\u5951\u7ea6\u548c\u9519\u8bef\u5904\u7406\u65b9\u5f0f&#xff0c;\u4f46\u4e0d\u89c4\u5b9a\u5e95\u5c42\u5b9e\u73b0\u3002\u8fd0\u884c\u65f6\u5e93\u662f\u6807\u51c6\u5e93\u89c4\u8303\u5728\u7279\u5b9a\u5e73\u53f0\u4e0a\u7684\u5177\u4f53\u5b9e\u73b0\u3002<\/p>\n<p>\u4f8b\u5982&#xff0c;C \u8bed\u8a00\u6807\u51c6&#xff08;ISO\/IEC 9899&#xff09;\u5b9a\u4e49\u4e86 fopen\u3001fread\u3001fwrite\u3001printf\u3001malloc \u7b49\u51fd\u6570\u7684\u884c\u4e3a&#xff0c;\u4f46\u4e0d\u8bf4&#034;\u5982\u4f55\u6253\u5f00\u6587\u4ef6&#034;\u2014\u2014\u90a3\u7531\u8fd0\u884c\u65f6\u5e93\u5b9e\u73b0\u51b3\u5b9a\u3002\u5728 Windows \u4e0a&#xff0c;fopen \u7684\u5b9e\u73b0\u6700\u7ec8\u8c03\u7528 CreateFileW&#xff1b;\u5728 Linux \u4e0a&#xff0c;fopen \u7684\u5b9e\u73b0\u8c03\u7528 open \u7cfb\u7edf\u8c03\u7528\u3002<\/p>\n<p>\u8fd9\u6761\u8fb9\u754c\u7684\u7279\u5f81&#xff1a;<\/p>\n<ul>\n<li>\u8de8\u5e73\u53f0\u6027&#xff1a;\u540c\u4e00\u5957\u6807\u51c6\u5e93 API \u53ef\u4ee5\u5728\u4e0d\u540c\u64cd\u4f5c\u7cfb\u7edf\u4e0a\u6709\u4e0d\u540c\u5b9e\u73b0\u3002<\/li>\n<li>\u62bd\u8c61\u5c42\u7ea7&#xff1a;\u6807\u51c6\u5e93\u63d0\u4f9b\u6bd4 OS API \u66f4\u9ad8\u5c42\u7684\u62bd\u8c61&#xff08;\u5982 printf \u683c\u5f0f\u5316\u3001fread \u7f13\u51b2&#xff09;\u3002<\/li>\n<li>\u884c\u4e3a\u4fdd\u8bc1&#xff1a;\u6807\u51c6\u5e93\u4fdd\u8bc1\u8de8\u5b9e\u73b0\u7684\u884c\u4e3a\u4e00\u81f4\u6027&#xff08;\u5982 fopen \u8fd4\u56de NULL \u8868\u793a\u5931\u8d25&#xff09;\u3002<\/li>\n<\/ul>\n<h4>4.2 \u7a7f\u900f\u65b9\u5f0f&#xff1a;\u8fd0\u884c\u65f6\u5e93\u5b9e\u73b0\u6807\u51c6\u5e93\u51fd\u6570<\/h4>\n<p>\u8fd0\u884c\u65f6\u5e93\u901a\u8fc7\u5728\u5185\u90e8\u8c03\u7528\u64cd\u4f5c\u7cfb\u7edf API \u6765\u5b9e\u73b0\u6807\u51c6\u5e93\u51fd\u6570\u3002\u7a7f\u900f\u65b9\u5f0f\u662f\u666e\u901a\u7684\u51fd\u6570\u8c03\u7528\u2014\u2014\u8fd0\u884c\u65f6\u5e93\u51fd\u6570\u76f4\u63a5\u8c03\u7528 OS API \u51fd\u6570&#xff0c;\u53c2\u6570\u901a\u8fc7\u51fd\u6570\u7b7e\u540d\u4f20\u9012\u3002<\/p>\n<p>\u4ee5\u6587\u4ef6 I\/O \u4e3a\u4f8b&#xff0c;\u8fd0\u884c\u65f6\u5e93\u7684\u7a7f\u900f\u8def\u5f84&#xff1a;<\/p>\n<p>\u6807\u51c6\u5e93API (fopen\/fread\/fwrite)<br \/>\n    \u2192 \u8fd0\u884c\u65f6\u5e93\u5185\u90e8\u5b9e\u73b0<br \/>\n        \u2192 \u6587\u4ef6\u63cf\u8ff0\u7b26\u7ba1\u7406<br \/>\n        \u2192 \u7f13\u51b2\u533a\u7ba1\u7406<br \/>\n        \u2192 OS API\u8c03\u7528 (CreateFileW\/ReadFile\/WriteFile)<\/p>\n<h4>4.3 \u793a\u4f8b1&#xff1a;C# File.ReadAllText \u2192 FileStream \u2192 ReadFile<\/h4>\n<p>.NET \u7684 File.ReadAllText \u65b9\u6cd5\u5185\u90e8\u5b9e\u73b0\u8def\u5f84&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ .NET BCL \u6e90\u4ee3\u7801 (\u7b80\u5316\u7248, .NET 8)<\/span><br \/>\n<span class=\"token comment\">\/\/ \u6587\u4ef6: src\/libraries\/System.IO.FileSystem\/src\/System\/IO\/File.cs<\/span><\/p>\n<p><span class=\"token keyword\">public<\/span> <span class=\"token keyword\">static<\/span> <span class=\"token return-type class-name\"><span class=\"token keyword\">string<\/span><\/span> <span class=\"token function\">ReadAllText<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\"><span class=\"token keyword\">string<\/span><\/span> path<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ 1. \u53c2\u6570\u9a8c\u8bc1<\/span><br \/>\n    ArgumentException<span class=\"token punctuation\">.<\/span><span class=\"token function\">ThrowIfNullOrEmpty<\/span><span class=\"token punctuation\">(<\/span>path<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 2. \u8c03\u7528\u91cd\u8f7d\u65b9\u6cd5<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> <span class=\"token function\">ReadAllText<\/span><span class=\"token punctuation\">(<\/span>path<span class=\"token punctuation\">,<\/span> Encoding<span class=\"token punctuation\">.<\/span>UTF8<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p><span class=\"token keyword\">public<\/span> <span class=\"token keyword\">static<\/span> <span class=\"token return-type class-name\"><span class=\"token keyword\">string<\/span><\/span> <span class=\"token function\">ReadAllText<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\"><span class=\"token keyword\">string<\/span><\/span> path<span class=\"token punctuation\">,<\/span> <span class=\"token class-name\">Encoding<\/span> encoding<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ 3. \u53c2\u6570\u9a8c\u8bc1<\/span><br \/>\n    ArgumentException<span class=\"token punctuation\">.<\/span><span class=\"token function\">ThrowIfNullOrEmpty<\/span><span class=\"token punctuation\">(<\/span>path<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    ArgumentNullException<span class=\"token punctuation\">.<\/span><span class=\"token function\">ThrowIfNull<\/span><span class=\"token punctuation\">(<\/span>encoding<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 4. \u8c03\u7528 ReadAllTextInternal<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> <span class=\"token function\">ReadAllTextInternal<\/span><span class=\"token punctuation\">(<\/span>path<span class=\"token punctuation\">,<\/span> encoding<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p><span class=\"token keyword\">private<\/span> <span class=\"token keyword\">static<\/span> <span class=\"token return-type class-name\"><span class=\"token keyword\">string<\/span><\/span> <span class=\"token function\">ReadAllTextInternal<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\"><span class=\"token keyword\">string<\/span><\/span> path<span class=\"token punctuation\">,<\/span> <span class=\"token class-name\">Encoding<\/span> encoding<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ 5. \u83b7\u53d6\u6587\u4ef6\u957f\u5ea6<\/span><br \/>\n    <span class=\"token class-name\"><span class=\"token keyword\">long<\/span><\/span> length <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token class-name\">FileAttributes<\/span> fileAttributes <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ \u8fd9\u91cc\u8c03\u7528\u4e86 Win32 API GetFileAttributesEx<\/span><br \/>\n    length <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token constructor-invocation class-name\">FileInfo<\/span><span class=\"token punctuation\">(<\/span>path<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span>Length<span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 6. \u6253\u5f00\u6587\u4ef6 \u2014 \u521b\u5efa FileStream \u5bf9\u8c61<\/span><br \/>\n    <span class=\"token comment\">\/\/ FileStream \u6784\u9020\u51fd\u6570\u5185\u90e8\u8c03\u7528 Win32 CreateFileW<\/span><br \/>\n    <span class=\"token keyword\">using<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token class-name\">FileStream<\/span> fs <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token constructor-invocation class-name\">FileStream<\/span><span class=\"token punctuation\">(<\/span><br \/>\n        path<span class=\"token punctuation\">,<\/span><br \/>\n        FileMode<span class=\"token punctuation\">.<\/span>Open<span class=\"token punctuation\">,<\/span>           <span class=\"token comment\">\/\/ \u2192 CREATE_OPEN (dwCreationDisposition)<\/span><br \/>\n        FileAccess<span class=\"token punctuation\">.<\/span>Read<span class=\"token punctuation\">,<\/span>         <span class=\"token comment\">\/\/ \u2192 GENERIC_READ (dwDesiredAccess)<\/span><br \/>\n        FileShare<span class=\"token punctuation\">.<\/span>Read<span class=\"token punctuation\">,<\/span>          <span class=\"token comment\">\/\/ \u2192 FILE_SHARE_READ (dwShareMode)<\/span><br \/>\n        DefaultBufferSize<span class=\"token punctuation\">,<\/span>       <span class=\"token comment\">\/\/ \u2192 \u7f13\u51b2\u533a\u5927\u5c0f<\/span><br \/>\n        FileOptions<span class=\"token punctuation\">.<\/span>None         <span class=\"token comment\">\/\/ \u2192 0 (dwFlagsAndAttributes)<\/span><br \/>\n    <span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token comment\">\/\/ 7. \u8bfb\u53d6\u6587\u4ef6\u5185\u5bb9<\/span><br \/>\n        <span class=\"token comment\">\/\/ ReadAllBytesInternal \u5185\u90e8\u8c03\u7528 Win32 ReadFile<\/span><br \/>\n        <span class=\"token class-name\"><span class=\"token keyword\">byte<\/span><span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span><\/span> bytes <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">ReadAllBytesInternal<\/span><span class=\"token punctuation\">(<\/span>fs<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>        <span class=\"token comment\">\/\/ 8. \u89e3\u7801\u4e3a\u5b57\u7b26\u4e32<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> encoding<span class=\"token punctuation\">.<\/span><span class=\"token function\">GetString<\/span><span class=\"token punctuation\">(<\/span>bytes<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token comment\">\/\/ 9. using \u5757\u7ed3\u675f \u2192 FileStream.Dispose \u2192 CloseHandle<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>\u5176\u4e2d FileStream \u6784\u9020\u51fd\u6570\u7684\u5173\u952e\u5b9e\u73b0&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ .NET BCL \u6e90\u4ee3\u7801 (\u7b80\u5316\u7248)<\/span><br \/>\n<span class=\"token comment\">\/\/ \u6587\u4ef6: src\/libraries\/System.Private.CoreLib\/src\/System\/IO\/FileStream.cs<\/span><\/p>\n<p><span class=\"token keyword\">internal<\/span> <span class=\"token function\">FileStream<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\"><span class=\"token keyword\">string<\/span><\/span> path<span class=\"token punctuation\">,<\/span> <span class=\"token class-name\">FileMode<\/span> mode<span class=\"token punctuation\">,<\/span> <span class=\"token class-name\">FileAccess<\/span> access<span class=\"token punctuation\">,<\/span><br \/>\n                    <span class=\"token class-name\">FileShare<\/span> share<span class=\"token punctuation\">,<\/span> <span class=\"token class-name\"><span class=\"token keyword\">int<\/span><\/span> bufferSize<span class=\"token punctuation\">,<\/span> <span class=\"token class-name\">FileOptions<\/span> options<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ &#8230; \u53c2\u6570\u9a8c\u8bc1 &#8230;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ \u8c03\u7528 Win32 CreateFileW (\u901a\u8fc7 P\/Invoke)<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u8fd9\u662f\u7a7f\u900f\u5230 Win32 API \u5c42\u7684\u5173\u952e\u70b9<\/span><br \/>\n    _fileHandle <span class=\"token operator\">&#061;<\/span> Interop<span class=\"token punctuation\">.<\/span>Kernel32<span class=\"token punctuation\">.<\/span><span class=\"token function\">CreateFileW<\/span><span class=\"token punctuation\">(<\/span><br \/>\n        path<span class=\"token punctuation\">,<\/span>                           <span class=\"token comment\">\/\/ lpFileName<\/span><br \/>\n        <span class=\"token punctuation\">(<\/span><span class=\"token keyword\">uint<\/span><span class=\"token punctuation\">)<\/span>access<span class=\"token punctuation\">.<\/span><span class=\"token function\">ToGenericAccess<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token comment\">\/\/ dwDesiredAccess \u2192 GENERIC_READ<\/span><br \/>\n        <span class=\"token punctuation\">(<\/span><span class=\"token keyword\">uint<\/span><span class=\"token punctuation\">)<\/span>share<span class=\"token punctuation\">,<\/span>                    <span class=\"token comment\">\/\/ dwShareMode \u2192 FILE_SHARE_READ<\/span><br \/>\n        IntPtr<span class=\"token punctuation\">.<\/span>Zero<span class=\"token punctuation\">,<\/span>                    <span class=\"token comment\">\/\/ lpSecurityAttributes<\/span><br \/>\n        <span class=\"token punctuation\">(<\/span><span class=\"token keyword\">uint<\/span><span class=\"token punctuation\">)<\/span>mode<span class=\"token punctuation\">,<\/span>                     <span class=\"token comment\">\/\/ dwCreationDisposition \u2192 OPEN_EXISTING<\/span><br \/>\n        <span class=\"token punctuation\">(<\/span><span class=\"token keyword\">uint<\/span><span class=\"token punctuation\">)<\/span>options <span class=\"token operator\">|<\/span> FileAttributes<span class=\"token punctuation\">.<\/span>Normal<span class=\"token punctuation\">,<\/span> <span class=\"token comment\">\/\/ dwFlagsAndAttributes<\/span><br \/>\n        IntPtr<span class=\"token punctuation\">.<\/span>Zero                     <span class=\"token comment\">\/\/ hTemplateFile<\/span><br \/>\n    <span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ \u68c0\u67e5\u8fd4\u56de\u503c<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_fileHandle<span class=\"token punctuation\">.<\/span>IsInvalid<span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token comment\">\/\/ \u5c06 Win32 \u9519\u8bef\u7801\u8f6c\u6362\u4e3a .NET \u5f02\u5e38<\/span><br \/>\n        <span class=\"token keyword\">throw<\/span> Win32Marshal<span class=\"token punctuation\">.<\/span><span class=\"token function\">GetExceptionForLastWin32Error<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ \u521d\u59cb\u5316\u7f13\u51b2\u533a<\/span><br \/>\n    _buffer <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token constructor-invocation class-name\"><span class=\"token keyword\">byte<\/span><\/span><span class=\"token punctuation\">[<\/span>bufferSize<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<h4>4.4 \u793a\u4f8b2&#xff1a;C printf \u2192 WriteFile<\/h4>\n<p>C \u8fd0\u884c\u65f6\u5e93\u4e2d printf \u7684\u5b9e\u73b0\u8def\u5f84&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ UCRT (Universal C Runtime) \u6e90\u7801\u7ed3\u6784 (\u7b80\u5316)<\/span><\/p>\n<p><span class=\"token comment\">\/\/ \u7b2c1\u6b65: printf \u89e3\u6790\u683c\u5f0f\u5b57\u7b26\u4e32<\/span><br \/>\n<span class=\"token keyword\">int<\/span> __cdecl <span class=\"token function\">printf<\/span><span class=\"token punctuation\">(<\/span><span class=\"token keyword\">const<\/span> <span class=\"token keyword\">char<\/span><span class=\"token operator\">*<\/span> format<span class=\"token punctuation\">,<\/span> <span class=\"token punctuation\">.<\/span><span class=\"token punctuation\">.<\/span><span class=\"token punctuation\">.<\/span><span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    va_list arglist<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token function\">va_start<\/span><span class=\"token punctuation\">(<\/span>arglist<span class=\"token punctuation\">,<\/span> format<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ \u8c03\u7528\u5185\u90e8\u5b9e\u73b0<\/span><br \/>\n    <span class=\"token keyword\">int<\/span> result <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">_vfprintf_l<\/span><span class=\"token punctuation\">(<\/span><span class=\"token constant\">stdout<\/span><span class=\"token punctuation\">,<\/span> format<span class=\"token punctuation\">,<\/span> <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">,<\/span> arglist<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token function\">va_end<\/span><span class=\"token punctuation\">(<\/span>arglist<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> result<span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p><span class=\"token comment\">\/\/ \u7b2c2\u6b65: _vfprintf_l \u683c\u5f0f\u5316\u8f93\u51fa<\/span><br \/>\n<span class=\"token keyword\">int<\/span> <span class=\"token function\">_vfprintf_l<\/span><span class=\"token punctuation\">(<\/span>FILE<span class=\"token operator\">*<\/span> stream<span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">const<\/span> <span class=\"token keyword\">char<\/span><span class=\"token operator\">*<\/span> format<span class=\"token punctuation\">,<\/span> _locale_t locale<span class=\"token punctuation\">,<\/span> va_list arglist<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ 1. \u521d\u59cb\u5316\u683c\u5f0f\u5316\u4e0a\u4e0b\u6587<\/span><br \/>\n    <span class=\"token function\">_locale_lock<\/span><span class=\"token punctuation\">(<\/span>locale<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    __acrt_ptd<span class=\"token operator\">*<\/span> ptd <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">__acrt_getptd_noexit<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 2. \u9010\u5b57\u7b26\u89e3\u6790\u683c\u5f0f\u5b57\u7b26\u4e32<\/span><br \/>\n    <span class=\"token comment\">\/\/    \u9047\u5230 % \u65f6, \u6839\u636e\u683c\u5f0f\u8bf4\u660e\u7b26\u4ece va_list \u53d6\u53c2\u5e76\u683c\u5f0f\u5316<\/span><br \/>\n    <span class=\"token comment\">\/\/    \u5c06\u683c\u5f0f\u5316\u540e\u7684\u5b57\u7b26\u5199\u5165 stream \u7684\u5185\u90e8\u7f13\u51b2\u533a<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 3. \u5f53\u7f13\u51b2\u533a\u6ee1\u6216\u9047\u5230\u6362\u884c\u7b26\u65f6, \u5237\u65b0\u7f13\u51b2\u533a<\/span><br \/>\n    <span class=\"token comment\">\/\/    \u8c03\u7528 __acrt_flush_buffer \u2192 _write \u2192 WriteFile<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>buffer_full <span class=\"token operator\">||<\/span> ch <span class=\"token operator\">&#061;&#061;<\/span> <span class=\"token char\">&#039;\\\\n&#039;<\/span><span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token function\">__acrt_flush_buffer<\/span><span class=\"token punctuation\">(<\/span>stream<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p><span class=\"token comment\">\/\/ \u7b2c3\u6b65: __acrt_flush_buffer \u5237\u65b0\u5230 OS<\/span><br \/>\n<span class=\"token keyword\">int<\/span> <span class=\"token function\">__acrt_flush_buffer<\/span><span class=\"token punctuation\">(<\/span>FILE<span class=\"token operator\">*<\/span> stream<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u83b7\u53d6\u5e95\u5c42\u6587\u4ef6\u53e5\u67c4<\/span><br \/>\n    HANDLE os_handle <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">_get_osfhandle<\/span><span class=\"token punctuation\">(<\/span>stream<span class=\"token operator\">-&gt;<\/span>_file<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ \u5c06\u7f13\u51b2\u533a\u6570\u636e\u5199\u5165 OS<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u8fd9\u91cc\u7a7f\u900f\u5230 Win32 API \u5c42<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token operator\">!<\/span><span class=\"token function\">WriteFile<\/span><span class=\"token punctuation\">(<\/span><br \/>\n        os_handle<span class=\"token punctuation\">,<\/span>                 <span class=\"token comment\">\/\/ hFile<\/span><br \/>\n        stream<span class=\"token operator\">-&gt;<\/span>_base<span class=\"token punctuation\">,<\/span>             <span class=\"token comment\">\/\/ lpBuffer<\/span><br \/>\n        <span class=\"token punctuation\">(<\/span>DWORD<span class=\"token punctuation\">)<\/span>stream<span class=\"token operator\">-&gt;<\/span>_cnt<span class=\"token punctuation\">,<\/span>       <span class=\"token comment\">\/\/ nNumberOfBytesToWrite<\/span><br \/>\n        <span class=\"token operator\">&amp;<\/span>bytes_written<span class=\"token punctuation\">,<\/span>            <span class=\"token comment\">\/\/ lpNumberOfBytesWritten<\/span><br \/>\n        <span class=\"token constant\">NULL<\/span>                       <span class=\"token comment\">\/\/ lpOverlapped<\/span><br \/>\n    <span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> <span class=\"token operator\">&#8211;<\/span><span class=\"token number\">1<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token keyword\">return<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<h4>4.5 \u8fd0\u884c\u65f6\u5e93\u7684\u7f13\u51b2\u5c42<\/h4>\n<p>\u8fd0\u884c\u65f6\u5e93\u5728\u6807\u51c6\u5e93 API \u548c OS API \u4e4b\u95f4\u589e\u52a0\u4e86\u4e00\u4e2a\u7f13\u51b2\u5c42\u3002\u8fd9\u662f\u7a7f\u900f\u8fc7\u7a0b\u4e2d\u7684\u4e00\u4e2a\u91cd\u8981\u4e2d\u95f4\u6b65\u9aa4&#xff1a;<\/p>\n<p>\u5bf9\u4e8e\u6587\u4ef6 I\/O&#xff0c;CRT \u7684 FILE \u7ed3\u6784\u4f53\u5305\u542b\u4e00\u4e2a\u5185\u90e8\u7f13\u51b2\u533a&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ CRT FILE \u7ed3\u6784\u4f53 (\u7b80\u5316, \u5b9e\u9645\u5b9a\u4e49\u5728 stdio.h \/ mtdll.h \u4e2d)<\/span><br \/>\n<span class=\"token keyword\">typedef<\/span> <span class=\"token keyword\">struct<\/span> <span class=\"token class-name\">_iobuf<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">char<\/span><span class=\"token operator\">*<\/span> _ptr<span class=\"token punctuation\">;<\/span>          <span class=\"token comment\">\/\/ \u5f53\u524d\u7f13\u51b2\u533a\u8bfb\/\u5199\u6307\u9488<\/span><br \/>\n    <span class=\"token keyword\">int<\/span>   _cnt<span class=\"token punctuation\">;<\/span>          <span class=\"token comment\">\/\/ \u7f13\u51b2\u533a\u5269\u4f59\u5b57\u8282\u6570<\/span><br \/>\n    <span class=\"token keyword\">char<\/span><span class=\"token operator\">*<\/span> _base<span class=\"token punctuation\">;<\/span>         <span class=\"token comment\">\/\/ \u7f13\u51b2\u533a\u57fa\u5740<\/span><br \/>\n    <span class=\"token keyword\">int<\/span>   _flag<span class=\"token punctuation\">;<\/span>         <span class=\"token comment\">\/\/ \u6587\u4ef6\u72b6\u6001\u6807\u5fd7<\/span><br \/>\n    <span class=\"token keyword\">int<\/span>   _file<span class=\"token punctuation\">;<\/span>         <span class=\"token comment\">\/\/ OS \u6587\u4ef6\u53e5\u67c4 (\u7531 _get_osfhandle \u8f6c\u6362\u4e3a HANDLE)<\/span><br \/>\n    <span class=\"token keyword\">int<\/span>   _charbuf<span class=\"token punctuation\">;<\/span>      <span class=\"token comment\">\/\/ \u5355\u5b57\u7b26\u56de\u9000\u7f13\u51b2<\/span><br \/>\n    <span class=\"token keyword\">int<\/span>   _bufsiz<span class=\"token punctuation\">;<\/span>       <span class=\"token comment\">\/\/ \u7f13\u51b2\u533a\u5927\u5c0f<\/span><br \/>\n    <span class=\"token keyword\">char<\/span><span class=\"token operator\">*<\/span> _tmpfname<span class=\"token punctuation\">;<\/span>     <span class=\"token comment\">\/\/ \u4e34\u65f6\u6587\u4ef6\u540d<\/span><br \/>\n<span class=\"token punctuation\">}<\/span> FILE<span class=\"token punctuation\">;<\/span><\/p>\n<p>\u7f13\u51b2\u5c42\u7684\u7a7f\u900f\u903b\u8f91&#xff1a;<\/p>\n<ul>\n<li>fread \u5148\u68c0\u67e5 FILE \u7684\u5185\u90e8\u7f13\u51b2\u533a\u662f\u5426\u6709\u6570\u636e\u3002\u6709\u5219\u76f4\u63a5\u4ece\u7f13\u51b2\u533a\u62f7\u8d1d&#xff0c;\u4e0d\u7a7f\u900f\u5230 OS\u3002<\/li>\n<li>\u7f13\u51b2\u533a\u4e3a\u7a7a\u65f6&#xff0c;fread \u8c03\u7528 ReadFile \u4e00\u6b21\u8bfb\u53d6\u4e00\u6574\u5757\u6570\u636e\u586b\u5145\u7f13\u51b2\u533a\u3002<\/li>\n<li>fwrite \u5148\u5199\u5165\u7f13\u51b2\u533a\u3002\u7f13\u51b2\u533a\u6ee1\u6216\u8c03\u7528 fflush \u65f6&#xff0c;\u624d\u8c03\u7528 WriteFile \u7a7f\u900f\u5230 OS\u3002<\/li>\n<\/ul>\n<p>\u8fd9\u610f\u5473\u7740\u6807\u51c6\u5e93 API \u5230 OS API \u7684\u7a7f\u900f\u4e0d\u662f 1:1 \u7684\u2014\u2014\u4e00\u6b21 fread(buf, 1, 1, fp) \u53ef\u80fd\u4e0d\u89e6\u53d1\u4efb\u4f55 OS \u8c03\u7528&#xff08;\u5982\u679c\u7f13\u51b2\u533a\u6709\u6570\u636e&#xff09;&#xff0c;\u4e5f\u53ef\u80fd\u89e6\u53d1\u4e00\u6b21\u5927\u5757 ReadFile&#xff08;\u5982\u679c\u7f13\u51b2\u533a\u4e3a\u7a7a&#xff09;\u3002<\/p>\n<h4>4.6 \u8bed\u8a00\u5230\u8fd0\u884c\u65f6\u5e93\u7a7f\u900f\u56fe<\/h4>\n<p> \u6e32\u67d3\u9519\u8bef: Mermaid \u6e32\u67d3\u5931\u8d25: Parse error on line 4: &#8230; printf(\\\\&#034;Hello %d\\\\&#034;, 42)&#034;] end &#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8211;^ Expecting &#039;SQE&#039;, &#039;DOUBLECIRCLEEND&#039;, &#039;PE&#039;, &#039;-)&#039;, &#039;STADIUMEND&#039;, &#039;SUBROUTINEEND&#039;, &#039;PIPE&#039;, &#039;CYLINDEREND&#039;, &#039;DIAMOND_STOP&#039;, &#039;TAGEND&#039;, &#039;TRAPEND&#039;, &#039;INVTRAPEND&#039;, &#039;UNICODE_TEXT&#039;, &#039;TEXT&#039;, &#039;TAGSTART&#039;, got &#039;STR&#039;<\/p>\n<h4>4.7 \u8fd0\u884c\u65f6\u5e93\u7684\u53e5\u67c4\u7ba1\u7406<\/h4>\n<p>\u8fd0\u884c\u65f6\u5e93\u7ef4\u62a4\u81ea\u5df1\u7684\u6587\u4ef6\u6807\u8bc6\u7b26\u7cfb\u7edf&#xff0c;\u4e0e OS \u7684\u53e5\u67c4\u7cfb\u7edf\u4e4b\u95f4\u9700\u8981\u8f6c\u6362&#xff1a;<\/p>\n<p>CRT \u7684\u6587\u4ef6\u63cf\u8ff0\u7b26&#xff08;_file \u5b57\u6bb5&#xff09;&#xff1a;CRT \u4f7f\u7528\u5c0f\u6574\u6570&#xff08;0&#061;stdin, 1&#061;stdout, 2&#061;stderr, 3&#043;&#061;\u7528\u6237\u6587\u4ef6&#xff09;\u6807\u8bc6\u6253\u5f00\u7684\u6587\u4ef6\u3002\u8fd9\u4e2a\u6574\u6570\u662f CRT \u5185\u90e8 _ioinfo \u6570\u7ec4\u7684\u7d22\u5f15\u3002<\/p>\n<p>OS \u7684\u6587\u4ef6\u53e5\u67c4&#xff08;HANDLE&#xff09;&#xff1a;Windows \u4f7f\u7528 HANDLE&#xff08;\u5b9e\u9645\u662f void* \u6307\u9488&#xff09;\u6807\u8bc6\u5185\u6838\u5bf9\u8c61\u3002<\/p>\n<p>CRT \u901a\u8fc7 _get_osfhandle(fd) \u5c06\u6587\u4ef6\u63cf\u8ff0\u7b26\u8f6c\u6362\u4e3a OS \u53e5\u67c4&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ UCRT \u5b9e\u73b0 (\u7b80\u5316)<\/span><br \/>\nHANDLE __cdecl <span class=\"token function\">_get_osfhandle<\/span><span class=\"token punctuation\">(<\/span><span class=\"token keyword\">int<\/span> fd<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u68c0\u67e5 fd \u8303\u56f4<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>fd <span class=\"token operator\">&lt;<\/span> <span class=\"token number\">0<\/span> <span class=\"token operator\">||<\/span> fd <span class=\"token operator\">&gt;&#061;<\/span> _nhandle<span class=\"token punctuation\">)<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> INVALID_HANDLE_VALUE<span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ \u4ece\u5185\u90e8 _ioinfo \u6570\u7ec4\u83b7\u53d6 OS \u53e5\u67c4<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> <span class=\"token punctuation\">(<\/span>HANDLE<span class=\"token punctuation\">)<\/span>__pioinfo<span class=\"token punctuation\">[<\/span>fd <span class=\"token operator\">\/<\/span> _IOINFO_ARRAY_ELTS<span class=\"token punctuation\">]<\/span><br \/>\n                          <span class=\"token punctuation\">[<\/span>fd <span class=\"token operator\">%<\/span> _IOINFO_ARRAY_ELTS<span class=\"token punctuation\">]<\/span><span class=\"token operator\">-&gt;<\/span>_osfhnd<span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>\u8fd9\u4e2a\u8f6c\u6362\u6b65\u9aa4\u5728\u6bcf\u6b21\u4ece\u6807\u51c6\u5e93 API \u7a7f\u900f\u5230 OS API \u65f6\u90fd\u4f1a\u53d1\u751f&#xff0c;\u662f\u8fd0\u884c\u65f6\u5e93\u5c42\u7684\u4e00\u4e2a\u56fa\u5b9a\u5f00\u9500\u3002<\/p>\n<h4>4.8 .NET \u7684 P\/Invoke \u7a7f\u900f\u673a\u5236<\/h4>\n<p>.NET \u901a\u8fc7 P\/Invoke&#xff08;Platform Invoke&#xff09;\u673a\u5236\u8c03\u7528 Win32 API\u3002P\/Invoke \u7a7f\u900f\u6d89\u53ca\u4ee5\u4e0b\u6b65\u9aa4&#xff1a;<\/p>\n<p>     Win32 DLL<\/p>\n<p>     \u53c2\u6570\u5c01\u9001\u5668<\/p>\n<p>     P\/Invoke\u6869<\/p>\n<p>     JIT\u7f16\u8bd1\u5668<\/p>\n<p>     C<\/p>\n<p>      Win32 DLL<\/p>\n<p>      \u53c2\u6570\u5c01\u9001\u5668<\/p>\n<p>      P\/Invoke\u6869<\/p>\n<p>      JIT\u7f16\u8bd1\u5668<\/p>\n<p>      C<\/p>\n<p>  #mermaid-svg-KZA2csrplhmkXeiy{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-KZA2csrplhmkXeiy .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-KZA2csrplhmkXeiy .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-KZA2csrplhmkXeiy .error-icon{fill:#552222;}#mermaid-svg-KZA2csrplhmkXeiy .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-KZA2csrplhmkXeiy .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-KZA2csrplhmkXeiy .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-KZA2csrplhmkXeiy .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-KZA2csrplhmkXeiy .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-KZA2csrplhmkXeiy .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-KZA2csrplhmkXeiy .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-KZA2csrplhmkXeiy .marker{fill:#333333;stroke:#333333;}#mermaid-svg-KZA2csrplhmkXeiy .marker.cross{stroke:#333333;}#mermaid-svg-KZA2csrplhmkXeiy svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-KZA2csrplhmkXeiy p{margin:0;}#mermaid-svg-KZA2csrplhmkXeiy .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-KZA2csrplhmkXeiy text.actor&gt;tspan{fill:black;stroke:none;}#mermaid-svg-KZA2csrplhmkXeiy .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-KZA2csrplhmkXeiy .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-KZA2csrplhmkXeiy .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-KZA2csrplhmkXeiy .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-KZA2csrplhmkXeiy #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-KZA2csrplhmkXeiy .sequenceNumber{fill:white;}#mermaid-svg-KZA2csrplhmkXeiy #sequencenumber{fill:#333;}#mermaid-svg-KZA2csrplhmkXeiy #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-KZA2csrplhmkXeiy .messageText{fill:#333;stroke:none;}#mermaid-svg-KZA2csrplhmkXeiy .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-KZA2csrplhmkXeiy .labelText,#mermaid-svg-KZA2csrplhmkXeiy .labelText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-KZA2csrplhmkXeiy .loopText,#mermaid-svg-KZA2csrplhmkXeiy .loopText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-KZA2csrplhmkXeiy .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-KZA2csrplhmkXeiy .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-KZA2csrplhmkXeiy .noteText,#mermaid-svg-KZA2csrplhmkXeiy .noteText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-KZA2csrplhmkXeiy .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-KZA2csrplhmkXeiy .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-KZA2csrplhmkXeiy .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-KZA2csrplhmkXeiy .actorPopupMenu{position:absolute;}#mermaid-svg-KZA2csrplhmkXeiy .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 \/ 0.4));}#mermaid-svg-KZA2csrplhmkXeiy .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-KZA2csrplhmkXeiy .actor-man circle,#mermaid-svg-KZA2csrplhmkXeiy line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-KZA2csrplhmkXeiy :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>     \u9996\u6b21\u8c03\u7528\u65f6<\/p>\n<p>     \u540e\u7eed\u8c03\u7528\u65f6 (\u6869\u5df2\u7f16\u8bd1, \u53c2\u6570\u5c01\u9001\u5df2\u4f18\u5316)<\/p>\n<p>   \u7f16\u8bd1 P\/Invoke \u8c03\u7528<\/p>\n<p>   \u8bc6\u522b DllImport \u7279\u6027<\/p>\n<p>   \u751f\u6210\u8c03\u7528\u6869\u4ee3\u7801<\/p>\n<p>   \u8c03\u7528 CreateFileW(path, &#8230;)<\/p>\n<p>   \u8bbe\u7f6e\u7ebf\u7a0b\u6a21\u5f0f(GC\u6a21\u5f0f)<\/p>\n<p>   \u5c01\u9001\u53c2\u6570<\/p>\n<p>   string \u2192 LPCWSTR (\u5206\u914d\u975e\u6258\u7ba1\u5185\u5b58, \u590d\u5236\u5b57\u7b26)<\/p>\n<p>   \u679a\u4e3e \u2192 uint<\/p>\n<p>   CreateFileW(\u975e\u6258\u7ba1\u53c2\u6570)<\/p>\n<p>   \u8fd4\u56de HANDLE<\/p>\n<p>   \u8f6c\u6362\u8fd4\u56de\u503c<\/p>\n<p>   \u91ca\u653e\u975e\u6258\u7ba1\u5185\u5b58<\/p>\n<p>   \u8fd4\u56de SafeFileHandle<\/p>\n<p>   \u76f4\u63a5\u8c03\u7528\u5df2\u7f16\u8bd1\u6869<\/p>\n<p>   CreateFileW (\u5feb\u901f\u8def\u5f84)<\/p>\n<p>   \u8fd4\u56de\u7ed3\u679c<\/p>\n<p>P\/Invoke \u7684\u53c2\u6570\u5c01\u9001\u5f00\u9500\u662f\u8fd0\u884c\u65f6\u5e93\u5230 Win32 API \u7a7f\u900f\u7684\u4e00\u4e2a\u91cd\u8981\u6027\u80fd\u56e0\u7d20\u3002\u5bf9\u4e8e string \u7c7b\u578b&#xff0c;\u5c01\u9001\u5668\u9700\u8981\u5206\u914d\u975e\u6258\u7ba1\u5185\u5b58\u3001\u590d\u5236\u5b57\u7b26\u6570\u636e\u3001\u91ca\u653e\u975e\u6258\u7ba1\u5185\u5b58\u3002\u5bf9\u4e8e\u503c\u7c7b\u578b&#xff08;int, enum, struct&#xff09;&#xff0c;\u5c01\u9001\u5f00\u9500\u8f83\u5c0f\u3002<\/p>\n<h4>4.9 \u8fd0\u884c\u65f6\u5e93\u5c42\u7684\u9519\u8bef\u8f6c\u6362<\/h4>\n<p>\u8fd0\u884c\u65f6\u5e93\u8d1f\u8d23\u5c06 OS API \u7684\u9519\u8bef\u7801\u8f6c\u6362\u4e3a\u8bed\u8a00\u6807\u51c6\u7684\u9519\u8bef\u8868\u793a&#xff1a;<\/p>\n<table>\n<tr>OS API \u9519\u8befWin32 GetLastError()CRT errno.NET \u5f02\u5e38<\/tr>\n<tbody>\n<tr>\n<td>\u6587\u4ef6\u4e0d\u5b58\u5728<\/td>\n<td>ERROR_FILE_NOT_FOUND (2)<\/td>\n<td>ENOENT (2)<\/td>\n<td>FileNotFoundException<\/td>\n<\/tr>\n<tr>\n<td>\u6743\u9650\u4e0d\u8db3<\/td>\n<td>ERROR_ACCESS_DENIED (5)<\/td>\n<td>EACCES (13)<\/td>\n<td>UnauthorizedAccessException<\/td>\n<\/tr>\n<tr>\n<td>\u8def\u5f84\u65e0\u6548<\/td>\n<td>ERROR_PATH_NOT_FOUND (3)<\/td>\n<td>ENOENT (2)<\/td>\n<td>DirectoryNotFoundException<\/td>\n<\/tr>\n<tr>\n<td>\u6587\u4ef6\u5df2\u5b58\u5728<\/td>\n<td>ERROR_FILE_EXISTS (80)<\/td>\n<td>EEXIST (17)<\/td>\n<td>IOException<\/td>\n<\/tr>\n<tr>\n<td>\u78c1\u76d8\u6ee1<\/td>\n<td>ERROR_DISK_FULL (112)<\/td>\n<td>ENOSPC (28)<\/td>\n<td>IOException<\/td>\n<\/tr>\n<tr>\n<td>\u53e5\u67c4\u65e0\u6548<\/td>\n<td>ERROR_INVALID_HANDLE (6)<\/td>\n<td>EBADF (9)<\/td>\n<td>ObjectDisposedException<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>4.10 \u672c\u5c42\u7a7f\u900f\u603b\u7ed3<\/h4>\n<p>\u7f16\u7a0b\u8bed\u8a00\u5230\u8fd0\u884c\u65f6\u5e93\u7684\u7a7f\u900f\u5c06\u8bed\u8a00\u6807\u51c6\u5b9a\u4e49\u7684\u62bd\u8c61\u63a5\u53e3\u6620\u5c04\u4e3a\u64cd\u4f5c\u7cfb\u7edf API \u8c03\u7528\u3002\u8fd9\u5c42\u7a7f\u900f\u7684\u5173\u952e\u8981\u70b9&#xff1a;<\/p>\n<ul>\n<li>\u8fd0\u884c\u65f6\u5e93\u662f\u6807\u51c6\u5e93\u89c4\u8303\u7684\u5e73\u53f0\u7279\u5b9a\u5b9e\u73b0<\/li>\n<li>\u7f13\u51b2\u5c42\u4f7f\u5f97\u6807\u51c6\u5e93 API \u5230 OS API \u7684\u7a7f\u900f\u4e0d\u662f 1:1 \u7684<\/li>\n<li>\u53e5\u67c4\/\u6807\u8bc6\u7b26\u8f6c\u6362\u662f\u6bcf\u6b21\u7a7f\u900f\u7684\u56fa\u5b9a\u5f00\u9500<\/li>\n<li>P\/Invoke \u7684\u53c2\u6570\u5c01\u9001\u5e26\u6765\u989d\u5916\u5f00\u9500<\/li>\n<li>\u9519\u8bef\u7801\u9700\u8981\u4ece OS \u683c\u5f0f\u8f6c\u6362\u4e3a\u8bed\u8a00\u6807\u51c6\u683c\u5f0f<\/li>\n<\/ul>\n<hr \/>\n<h3>5. \u7b2c3\u5c42\u7a7f\u900f&#xff1a;\u8fd0\u884c\u65f6\u5e93\u2192Windows API<\/h3>\n<h4>5.1 \u5c01\u88c5\u8fb9\u754c&#xff1a;Windows API \u51fd\u6570\u7b7e\u540d<\/h4>\n<p>\u8fd0\u884c\u65f6\u5e93\u5230 Windows API \u7684\u7a7f\u900f\u8fb9\u754c\u662f Win32 API \u51fd\u6570\u7b7e\u540d\u3002Win32 API \u662f\u5fae\u8f6f\u516c\u5f00\u7684\u3001\u9762\u5411\u7528\u6237\u6001\u5e94\u7528\u7a0b\u5e8f\u7684\u7cfb\u7edf\u7f16\u7a0b\u63a5\u53e3&#xff0c;\u5176\u51fd\u6570\u7b7e\u540d\u5728 Windows SDK \u5934\u6587\u4ef6&#xff08;\u5982 fileapi.h\u3001handleapi.h&#xff09;\u4e2d\u5b9a\u4e49\u3002<\/p>\n<p>Win32 API \u7684\u8bbe\u8ba1\u539f\u5219&#xff1a;<\/p>\n<ul>\n<li>C \u8bed\u8a00\u63a5\u53e3&#xff1a;\u6240\u6709\u51fd\u6570\u4f7f\u7528 C \u8c03\u7528\u7ea6\u5b9a&#xff08;__stdcall \/ WinAPI&#xff09;&#xff0c;\u53c2\u6570\u901a\u8fc7\u6808\u4f20\u9012&#xff08;x86&#xff09;\u6216\u901a\u8fc7\u5bc4\u5b58\u5668&#043;\u6808\u4f20\u9012&#xff08;x64&#xff09;\u3002<\/li>\n<li>Unicode \u4f18\u5148&#xff1a;\u73b0\u4ee3 Windows 10\/11 \u4e0a&#xff0c;CreateFileW&#xff08;Unicode \u7248\u672c&#xff09;\u662f\u5b9e\u9645\u5b9e\u73b0&#xff0c;CreateFileA&#xff08;ANSI \u7248\u672c&#xff09;\u5728\u5185\u90e8\u8f6c\u6362\u4e3a Unicode \u540e\u8c03\u7528 W \u7248\u672c\u3002<\/li>\n<li>\u53e5\u67c4\u8bed\u4e49&#xff1a;\u4f7f\u7528 HANDLE \u6807\u8bc6\u5185\u6838\u5bf9\u8c61&#xff0c;\u901a\u8fc7 CloseHandle \u91ca\u653e\u3002<\/li>\n<li>\u9519\u8bef\u62a5\u544a&#xff1a;\u901a\u8fc7\u8fd4\u56de\u503c\u8868\u793a\u6210\u529f\/\u5931\u8d25&#xff0c;\u901a\u8fc7 GetLastError() \u83b7\u53d6\u8be6\u7ec6\u9519\u8bef\u7801\u3002<\/li>\n<\/ul>\n<h4>5.2 \u7a7f\u900f\u65b9\u5f0f&#xff1a;P\/Invoke \u6216\u76f4\u63a5\u8c03\u7528<\/h4>\n<p>\u8fd0\u884c\u65f6\u5e93\u8c03\u7528 Win32 API \u7684\u65b9\u5f0f\u53d6\u51b3\u4e8e\u7f16\u7a0b\u8bed\u8a00&#xff1a;<\/p>\n<p>C\/C&#043;&#043; \u8fd0\u884c\u65f6\u5e93&#xff1a;\u76f4\u63a5\u51fd\u6570\u8c03\u7528\u3002Win32 API \u7684 DLL&#xff08;kernel32.dll \u7b49&#xff09;\u5728\u7f16\u8bd1\u65f6\u901a\u8fc7 .lib \u5bfc\u5165\u5e93\u94fe\u63a5&#xff0c;\u8fd0\u884c\u65f6\u7531 PE \u52a0\u8f7d\u5668\u89e3\u6790\u5bfc\u5165\u8868\u3002<\/p>\n<p>.NET \u8fd0\u884c\u65f6\u5e93&#xff08;BCL&#xff09;&#xff1a;\u901a\u8fc7 P\/Invoke \u8c03\u7528\u3002\u4f7f\u7528 [DllImport(&#034;kernel32.dll&#034;)] \u7279\u6027\u58f0\u660e\u5916\u90e8\u51fd\u6570&#xff0c;\u8fd0\u884c\u65f6\u81ea\u52a8\u751f\u6210\u8c03\u7528\u6869\u3002<\/p>\n<p>Python \u6807\u51c6\u5e93&#xff1a;\u901a\u8fc7 ctypes \u6a21\u5757\u6216 C \u6269\u5c55\u6a21\u5757\u8c03\u7528\u3002ctypes.windll.kernel32.CreateFileW(&#8230;) \u5728\u8fd0\u884c\u65f6\u52a8\u6001\u52a0\u8f7d DLL \u5e76\u8c03\u7528\u51fd\u6570\u3002<\/p>\n<h4>5.3 \u793a\u4f8b1&#xff1a;CRT fopen \u2192 CreateFileW<\/h4>\n<p>C \u8fd0\u884c\u65f6\u5e93\u7684 fopen \u5185\u90e8\u5b9e\u73b0\u8def\u5f84\u5230 CreateFileW&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ UCRT fopen \u5b9e\u73b0 (\u7b80\u5316, \u57fa\u4e8e\u5f00\u6e90 UCRT \u6e90\u7801)<\/span><br \/>\nFILE<span class=\"token operator\">*<\/span> __cdecl <span class=\"token function\">fopen<\/span><span class=\"token punctuation\">(<\/span><span class=\"token keyword\">const<\/span> <span class=\"token keyword\">char<\/span><span class=\"token operator\">*<\/span> path<span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">const<\/span> <span class=\"token keyword\">char<\/span><span class=\"token operator\">*<\/span> mode<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ 1. \u5c06 ANSI \u8def\u5f84\u8f6c\u6362\u4e3a Unicode<\/span><br \/>\n    <span class=\"token class-name\">wchar_t<\/span> wpath<span class=\"token punctuation\">[<\/span>MAX_PATH<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token function\">MultiByteToWideChar<\/span><span class=\"token punctuation\">(<\/span>CP_ACP<span class=\"token punctuation\">,<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">,<\/span> path<span class=\"token punctuation\">,<\/span> <span class=\"token operator\">&#8211;<\/span><span class=\"token number\">1<\/span><span class=\"token punctuation\">,<\/span> wpath<span class=\"token punctuation\">,<\/span> MAX_PATH<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 2. \u89e3\u6790 mode \u5b57\u7b26\u4e32, \u786e\u5b9a dwCreationDisposition \u7b49\u53c2\u6570<\/span><br \/>\n    DWORD dwDesiredAccess <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    DWORD dwCreationDisposition <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    DWORD dwShareMode <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    DWORD dwFlagsAndAttributes <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ \u89e3\u6790 mode: &#034;r&#034;, &#034;w&#034;, &#034;a&#034;, &#034;r&#043;&#034;, &#034;w&#043;&#034;, &#034;a&#043;&#034;, &#034;rb&#034;, &#034;wb&#034;, &#8230;<\/span><br \/>\n    bool readable <span class=\"token operator\">&#061;<\/span> false<span class=\"token punctuation\">,<\/span> writable <span class=\"token operator\">&#061;<\/span> false<span class=\"token punctuation\">,<\/span> append <span class=\"token operator\">&#061;<\/span> false<span class=\"token punctuation\">;<\/span><br \/>\n    bool binary <span class=\"token operator\">&#061;<\/span> false<span class=\"token punctuation\">,<\/span> truncate <span class=\"token operator\">&#061;<\/span> false<span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token keyword\">for<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token keyword\">const<\/span> <span class=\"token keyword\">char<\/span><span class=\"token operator\">*<\/span> p <span class=\"token operator\">&#061;<\/span> mode<span class=\"token punctuation\">;<\/span> <span class=\"token operator\">*<\/span>p<span class=\"token punctuation\">;<\/span> <span class=\"token operator\">&#043;&#043;<\/span>p<span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token keyword\">switch<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token operator\">*<\/span>p<span class=\"token punctuation\">)<\/span><br \/>\n        <span class=\"token punctuation\">{<\/span><br \/>\n            <span class=\"token keyword\">case<\/span> <span class=\"token char\">&#039;r&#039;<\/span><span class=\"token operator\">:<\/span> readable <span class=\"token operator\">&#061;<\/span> true<span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">break<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">case<\/span> <span class=\"token char\">&#039;w&#039;<\/span><span class=\"token operator\">:<\/span> writable <span class=\"token operator\">&#061;<\/span> true<span class=\"token punctuation\">;<\/span> truncate <span class=\"token operator\">&#061;<\/span> true<span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">break<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">case<\/span> <span class=\"token char\">&#039;a&#039;<\/span><span class=\"token operator\">:<\/span> writable <span class=\"token operator\">&#061;<\/span> true<span class=\"token punctuation\">;<\/span> append <span class=\"token operator\">&#061;<\/span> true<span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">break<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">case<\/span> <span class=\"token char\">&#039;&#043;&#039;<\/span><span class=\"token operator\">:<\/span> readable <span class=\"token operator\">&#061;<\/span> true<span class=\"token punctuation\">;<\/span> writable <span class=\"token operator\">&#061;<\/span> true<span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">break<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">case<\/span> <span class=\"token char\">&#039;b&#039;<\/span><span class=\"token operator\">:<\/span> binary <span class=\"token operator\">&#061;<\/span> true<span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">break<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">case<\/span> <span class=\"token char\">&#039;t&#039;<\/span><span class=\"token operator\">:<\/span> binary <span class=\"token operator\">&#061;<\/span> false<span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">break<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 3. \u5c06 mode \u6807\u5fd7\u8f6c\u6362\u4e3a Win32 \u53c2\u6570<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>readable <span class=\"token operator\">&amp;&amp;<\/span> <span class=\"token operator\">!<\/span>writable<span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        dwDesiredAccess <span class=\"token operator\">&#061;<\/span> GENERIC_READ<span class=\"token punctuation\">;<\/span><br \/>\n        dwCreationDisposition <span class=\"token operator\">&#061;<\/span> OPEN_EXISTING<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token keyword\">else<\/span> <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>writable <span class=\"token operator\">&amp;&amp;<\/span> truncate<span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        dwDesiredAccess <span class=\"token operator\">&#061;<\/span> GENERIC_WRITE<span class=\"token punctuation\">;<\/span><br \/>\n        dwCreationDisposition <span class=\"token operator\">&#061;<\/span> CREATE_ALWAYS<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token keyword\">else<\/span> <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>writable <span class=\"token operator\">&amp;&amp;<\/span> append<span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        dwDesiredAccess <span class=\"token operator\">&#061;<\/span> FILE_APPEND_DATA<span class=\"token punctuation\">;<\/span><br \/>\n        dwCreationDisposition <span class=\"token operator\">&#061;<\/span> OPEN_ALWAYS<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token keyword\">else<\/span> <span class=\"token comment\">\/\/ readable &amp;&amp; writable<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        dwDesiredAccess <span class=\"token operator\">&#061;<\/span> GENERIC_READ <span class=\"token operator\">|<\/span> GENERIC_WRITE<span class=\"token punctuation\">;<\/span><br \/>\n        dwCreationDisposition <span class=\"token operator\">&#061;<\/span> truncate <span class=\"token operator\">?<\/span> CREATE_ALWAYS <span class=\"token operator\">:<\/span> OPEN_EXISTING<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    dwShareMode <span class=\"token operator\">&#061;<\/span> FILE_SHARE_READ<span class=\"token punctuation\">;<\/span><br \/>\n    dwFlagsAndAttributes <span class=\"token operator\">&#061;<\/span> binary <span class=\"token operator\">?<\/span> <span class=\"token number\">0<\/span> <span class=\"token operator\">:<\/span> FILE_ATTRIBUTE_NORMAL<span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 4. \u8c03\u7528 Win32 API CreateFileW \u2014 \u7a7f\u900f\u5230 Win32 \u5c42<\/span><br \/>\n    HANDLE hFile <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">CreateFileW<\/span><span class=\"token punctuation\">(<\/span><br \/>\n        wpath<span class=\"token punctuation\">,<\/span>                    <span class=\"token comment\">\/\/ lpFileName<\/span><br \/>\n        dwDesiredAccess<span class=\"token punctuation\">,<\/span>          <span class=\"token comment\">\/\/ dwDesiredAccess<\/span><br \/>\n        dwShareMode<span class=\"token punctuation\">,<\/span>              <span class=\"token comment\">\/\/ dwShareMode<\/span><br \/>\n        <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">,<\/span>                     <span class=\"token comment\">\/\/ lpSecurityAttributes<\/span><br \/>\n        dwCreationDisposition<span class=\"token punctuation\">,<\/span>    <span class=\"token comment\">\/\/ dwCreationDisposition<\/span><br \/>\n        dwFlagsAndAttributes<span class=\"token punctuation\">,<\/span>     <span class=\"token comment\">\/\/ dwFlagsAndAttributes<\/span><br \/>\n        <span class=\"token constant\">NULL<\/span>                      <span class=\"token comment\">\/\/ hTemplateFile<\/span><br \/>\n    <span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 5. \u9519\u8bef\u5904\u7406: Win32 \u9519\u8bef\u7801 \u2192 CRT errno<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>hFile <span class=\"token operator\">&#061;&#061;<\/span> INVALID_HANDLE_VALUE<span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        DWORD err <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">GetLastError<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token function\">_dosmaperr<\/span><span class=\"token punctuation\">(<\/span>err<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>  <span class=\"token comment\">\/\/ Win32 error \u2192 errno<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 6. \u5c06 HANDLE \u5173\u8054\u5230 CRT \u7684 fd \u8868<\/span><br \/>\n    <span class=\"token keyword\">int<\/span> fd <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">_open_osfhandle<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\">intptr_t<\/span><span class=\"token punctuation\">)<\/span>hFile<span class=\"token punctuation\">,<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>fd <span class=\"token operator\">&#061;&#061;<\/span> <span class=\"token operator\">&#8211;<\/span><span class=\"token number\">1<\/span><span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token function\">CloseHandle<\/span><span class=\"token punctuation\">(<\/span>hFile<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 7. \u5206\u914d FILE \u7ed3\u6784\u4f53\u5e76\u521d\u59cb\u5316\u7f13\u51b2\u533a<\/span><br \/>\n    FILE<span class=\"token operator\">*<\/span> fp <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">_alloc_stream<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    fp<span class=\"token operator\">-&gt;<\/span>_file <span class=\"token operator\">&#061;<\/span> fd<span class=\"token punctuation\">;<\/span><br \/>\n    fp<span class=\"token operator\">-&gt;<\/span>_flag <span class=\"token operator\">&#061;<\/span> _IOREAD <span class=\"token operator\">|<\/span> _IOWRT<span class=\"token punctuation\">;<\/span>  <span class=\"token comment\">\/\/ \u6839\u636e mode \u8bbe\u7f6e<\/span><br \/>\n    fp<span class=\"token operator\">-&gt;<\/span>_base <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token keyword\">char<\/span><span class=\"token operator\">*<\/span><span class=\"token punctuation\">)<\/span><span class=\"token function\">malloc<\/span><span class=\"token punctuation\">(<\/span>_INTERNAL_BUFSIZ<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    fp<span class=\"token operator\">-&gt;<\/span>_bufsiz <span class=\"token operator\">&#061;<\/span> _INTERNAL_BUFSIZ<span class=\"token punctuation\">;<\/span><br \/>\n    fp<span class=\"token operator\">-&gt;<\/span>_ptr <span class=\"token operator\">&#061;<\/span> fp<span class=\"token operator\">-&gt;<\/span>_base<span class=\"token punctuation\">;<\/span><br \/>\n    fp<span class=\"token operator\">-&gt;<\/span>_cnt <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token keyword\">return<\/span> fp<span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<h4>5.4 \u793a\u4f8b2&#xff1a;.NET FileStream.Read \u2192 ReadFile<\/h4>\n<p>.NET \u7684 FileStream.Read \u65b9\u6cd5\u5230 ReadFile \u7684\u7a7f\u900f&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ .NET BCL \u6e90\u7801 (\u7b80\u5316\u7248, .NET 8)<\/span><br \/>\n<span class=\"token comment\">\/\/ \u6587\u4ef6: src\/libraries\/System.Private.CoreLib\/src\/System\/IO\/FileStream.cs<\/span><\/p>\n<p><span class=\"token keyword\">public<\/span> <span class=\"token keyword\">override<\/span> <span class=\"token return-type class-name\"><span class=\"token keyword\">int<\/span><\/span> <span class=\"token function\">Read<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\">Span<span class=\"token punctuation\">&lt;<\/span><span class=\"token keyword\">byte<\/span><span class=\"token punctuation\">&gt;<\/span><\/span> buffer<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ 1. \u53c2\u6570\u9a8c\u8bc1<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_fileHandle<span class=\"token punctuation\">.<\/span>IsInvalid<span class=\"token punctuation\">)<\/span><br \/>\n        ThrowHelper<span class=\"token punctuation\">.<\/span><span class=\"token function\">ThrowObjectDisposedException_FileClosed<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 2. \u68c0\u67e5\u662f\u5426\u53ef\u4ee5\u4ece\u7f13\u51b2\u533a\u8bfb\u53d6<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_readPos <span class=\"token operator\">&lt;<\/span> _readLen<span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token comment\">\/\/ \u4ece\u5185\u90e8\u7f13\u51b2\u533a\u62f7\u8d1d, \u4e0d\u7a7f\u900f\u5230 OS<\/span><br \/>\n        <span class=\"token class-name\"><span class=\"token keyword\">int<\/span><\/span> count <span class=\"token operator\">&#061;<\/span> Math<span class=\"token punctuation\">.<\/span><span class=\"token function\">Min<\/span><span class=\"token punctuation\">(<\/span>buffer<span class=\"token punctuation\">.<\/span>Length<span class=\"token punctuation\">,<\/span> _readLen <span class=\"token operator\">&#8211;<\/span> _readPos<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        _buffer<span class=\"token punctuation\">.<\/span><span class=\"token function\">AsSpan<\/span><span class=\"token punctuation\">(<\/span>_readPos<span class=\"token punctuation\">,<\/span> count<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">CopyTo<\/span><span class=\"token punctuation\">(<\/span>buffer<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        _readPos <span class=\"token operator\">&#043;&#061;<\/span> count<span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> count<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 3. \u7f13\u51b2\u533a\u4e3a\u7a7a, \u9700\u8981\u4ece OS \u8bfb\u53d6<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u5982\u679c\u8bf7\u6c42\u7684\u5927\u5c0f &gt;&#061; \u7f13\u51b2\u533a\u5927\u5c0f, \u76f4\u63a5\u8bfb\u5230\u7528\u6237\u7f13\u51b2\u533a (\u8df3\u8fc7\u5185\u90e8\u7f13\u51b2)<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>buffer<span class=\"token punctuation\">.<\/span>Length <span class=\"token operator\">&gt;&#061;<\/span> _bufferSize<span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token comment\">\/\/ \u76f4\u63a5\u8c03\u7528 ReadFile, \u8bfb\u5230\u7528\u6237\u63d0\u4f9b\u7684 buffer<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> <span class=\"token function\">ReadCore<\/span><span class=\"token punctuation\">(<\/span>buffer<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token keyword\">else<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token comment\">\/\/ \u5148\u8bfb\u5230\u5185\u90e8\u7f13\u51b2\u533a, \u518d\u62f7\u8d1d\u5230\u7528\u6237 buffer<\/span><br \/>\n        <span class=\"token class-name\"><span class=\"token keyword\">int<\/span><\/span> bytesRead <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">ReadCore<\/span><span class=\"token punctuation\">(<\/span>_buffer<span class=\"token punctuation\">.<\/span><span class=\"token function\">AsSpan<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        _readLen <span class=\"token operator\">&#061;<\/span> bytesRead<span class=\"token punctuation\">;<\/span><br \/>\n        _readPos <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>        <span class=\"token class-name\"><span class=\"token keyword\">int<\/span><\/span> count <span class=\"token operator\">&#061;<\/span> Math<span class=\"token punctuation\">.<\/span><span class=\"token function\">Min<\/span><span class=\"token punctuation\">(<\/span>buffer<span class=\"token punctuation\">.<\/span>Length<span class=\"token punctuation\">,<\/span> bytesRead<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        _buffer<span class=\"token punctuation\">.<\/span><span class=\"token function\">AsSpan<\/span><span class=\"token punctuation\">(<\/span><span class=\"token number\">0<\/span><span class=\"token punctuation\">,<\/span> count<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">CopyTo<\/span><span class=\"token punctuation\">(<\/span>buffer<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        _readPos <span class=\"token operator\">&#061;<\/span> count<span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> count<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p><span class=\"token keyword\">private<\/span> <span class=\"token keyword\">unsafe<\/span> <span class=\"token return-type class-name\"><span class=\"token keyword\">int<\/span><\/span> <span class=\"token function\">ReadCore<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\">Span<span class=\"token punctuation\">&lt;<\/span><span class=\"token keyword\">byte<\/span><span class=\"token punctuation\">&gt;<\/span><\/span> buffer<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u56fa\u5b9a\u7f13\u51b2\u533a\u6307\u9488 (\u9632\u6b62 GC \u79fb\u52a8)<\/span><br \/>\n    <span class=\"token keyword\">fixed<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token keyword\">byte<\/span><span class=\"token operator\">*<\/span> bufferPtr <span class=\"token operator\">&#061;<\/span> buffer<span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token comment\">\/\/ \u8c03\u7528 Win32 ReadFile \u2014 \u7a7f\u900f\u5230 Win32 \u5c42<\/span><br \/>\n        <span class=\"token comment\">\/\/ Interop.Kernel32.ReadFile \u662f P\/Invoke \u58f0\u660e<\/span><br \/>\n        <span class=\"token class-name\"><span class=\"token keyword\">bool<\/span><\/span> success <span class=\"token operator\">&#061;<\/span> Interop<span class=\"token punctuation\">.<\/span>Kernel32<span class=\"token punctuation\">.<\/span><span class=\"token function\">ReadFile<\/span><span class=\"token punctuation\">(<\/span><br \/>\n            _fileHandle<span class=\"token punctuation\">,<\/span>           <span class=\"token comment\">\/\/ hFile<\/span><br \/>\n            bufferPtr<span class=\"token punctuation\">,<\/span>             <span class=\"token comment\">\/\/ lpBuffer<\/span><br \/>\n            buffer<span class=\"token punctuation\">.<\/span>Length<span class=\"token punctuation\">,<\/span>         <span class=\"token comment\">\/\/ nNumberOfBytesToRead<\/span><br \/>\n            <span class=\"token keyword\">out<\/span> <span class=\"token class-name\"><span class=\"token keyword\">int<\/span><\/span> bytesRead<span class=\"token punctuation\">,<\/span>     <span class=\"token comment\">\/\/ lpNumberOfBytesRead<\/span><br \/>\n            <span class=\"token keyword\">null<\/span>                   <span class=\"token comment\">\/\/ lpOverlapped (\u540c\u6b65\u6a21\u5f0f)<\/span><br \/>\n        <span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token operator\">!<\/span>success<span class=\"token punctuation\">)<\/span><br \/>\n        <span class=\"token punctuation\">{<\/span><br \/>\n            <span class=\"token class-name\"><span class=\"token keyword\">int<\/span><\/span> errorCode <span class=\"token operator\">&#061;<\/span> Marshal<span class=\"token punctuation\">.<\/span><span class=\"token function\">GetLastWin32Error<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token comment\">\/\/ \u68c0\u67e5\u662f\u5426\u5230\u8fbe\u6587\u4ef6\u5c3e<\/span><br \/>\n            <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>errorCode <span class=\"token operator\">&#061;&#061;<\/span> Interop<span class=\"token punctuation\">.<\/span>Errors<span class=\"token punctuation\">.<\/span>ERROR_HANDLE_EOF<span class=\"token punctuation\">)<\/span><br \/>\n                <span class=\"token keyword\">return<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">throw<\/span> Win32Marshal<span class=\"token punctuation\">.<\/span><span class=\"token function\">GetExceptionForWin32Error<\/span><span class=\"token punctuation\">(<\/span>errorCode<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span><\/p>\n<p>        <span class=\"token keyword\">return<\/span> bytesRead<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>\u5bf9\u5e94\u7684 P\/Invoke \u58f0\u660e&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ .NET \u5185\u90e8\u4e92\u64cd\u4f5c\u58f0\u660e<\/span><br \/>\n<span class=\"token keyword\">internal<\/span> <span class=\"token keyword\">static<\/span> <span class=\"token keyword\">partial<\/span> <span class=\"token keyword\">class<\/span> <span class=\"token class-name\">Kernel32<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token punctuation\">[<\/span><span class=\"token attribute\"><span class=\"token class-name\">LibraryImport<\/span><span class=\"token attribute-arguments\"><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;kernel32.dll&#034;<\/span><span class=\"token punctuation\">,<\/span> SetLastError <span class=\"token operator\">&#061;<\/span> <span class=\"token boolean\">true<\/span><span class=\"token punctuation\">)<\/span><\/span><\/span><span class=\"token punctuation\">]<\/span><br \/>\n    <span class=\"token keyword\">internal<\/span> <span class=\"token keyword\">static<\/span> <span class=\"token keyword\">partial<\/span> <span class=\"token return-type class-name\"><span class=\"token keyword\">bool<\/span><\/span> <span class=\"token function\">ReadFile<\/span><span class=\"token punctuation\">(<\/span><br \/>\n        <span class=\"token class-name\">SafeFileHandle<\/span> hFile<span class=\"token punctuation\">,<\/span><br \/>\n        <span class=\"token keyword\">byte<\/span><span class=\"token operator\">*<\/span> lpBuffer<span class=\"token punctuation\">,<\/span><br \/>\n        <span class=\"token class-name\"><span class=\"token keyword\">int<\/span><\/span> nNumberOfBytesToRead<span class=\"token punctuation\">,<\/span><br \/>\n        <span class=\"token keyword\">out<\/span> <span class=\"token class-name\"><span class=\"token keyword\">int<\/span><\/span> lpNumberOfBytesRead<span class=\"token punctuation\">,<\/span><br \/>\n        NativeOverlapped<span class=\"token operator\">*<\/span> lpOverlapped<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<h4>5.5 \u53c2\u6570\u8f6c\u6362&#xff1a;C \u6807\u51c6 mode \u2192 Windows dwCreationDisposition<\/h4>\n<p>\u8fd0\u884c\u65f6\u5e93\u5230 Win32 API \u7684\u7a7f\u900f\u6d89\u53ca\u5927\u91cf\u7684\u53c2\u6570\u683c\u5f0f\u8f6c\u6362\u3002\u4ee5\u4e0b\u662f\u6587\u4ef6\u6253\u5f00\u6a21\u5f0f\u7684\u8f6c\u6362\u8868&#xff1a;<\/p>\n<table>\n<tr>C \u6807\u51c6 mode\u542b\u4e49dwDesiredAccessdwCreationDispositiondwShareMode<\/tr>\n<tbody>\n<tr>\n<td>\u201cr\u201d<\/td>\n<td>\u53ea\u8bfb&#xff0c;\u6587\u4ef6\u5fc5\u987b\u5b58\u5728<\/td>\n<td>GENERIC_READ<\/td>\n<td>OPEN_EXISTING<\/td>\n<td>FILE_SHARE_READ<\/td>\n<\/tr>\n<tr>\n<td>\u201cw\u201d<\/td>\n<td>\u53ea\u5199&#xff0c;\u521b\u5efa\u6216\u622a\u65ad<\/td>\n<td>GENERIC_WRITE<\/td>\n<td>CREATE_ALWAYS<\/td>\n<td>0<\/td>\n<\/tr>\n<tr>\n<td>\u201ca\u201d<\/td>\n<td>\u8ffd\u52a0&#xff0c;\u521b\u5efa\u6216\u6253\u5f00<\/td>\n<td>FILE_APPEND_DATA<\/td>\n<td>OPEN_ALWAYS<\/td>\n<td>0<\/td>\n<\/tr>\n<tr>\n<td>\u201cr&#043;\u201d<\/td>\n<td>\u8bfb\u5199&#xff0c;\u6587\u4ef6\u5fc5\u987b\u5b58\u5728<\/td>\n<td>GENERIC_READ | GENERIC_WRITE<\/td>\n<td>OPEN_EXISTING<\/td>\n<td>FILE_SHARE_READ<\/td>\n<\/tr>\n<tr>\n<td>\u201cw&#043;\u201d<\/td>\n<td>\u8bfb\u5199&#xff0c;\u521b\u5efa\u6216\u622a\u65ad<\/td>\n<td>GENERIC_READ | GENERIC_WRITE<\/td>\n<td>CREATE_ALWAYS<\/td>\n<td>0<\/td>\n<\/tr>\n<tr>\n<td>\u201ca&#043;\u201d<\/td>\n<td>\u8bfb\u5199&#xff0c;\u8ffd\u52a0<\/td>\n<td>GENERIC_READ | FILE_APPEND_DATA<\/td>\n<td>OPEN_ALWAYS<\/td>\n<td>0<\/td>\n<\/tr>\n<tr>\n<td>\u201crb\u201d<\/td>\n<td>\u4e8c\u8fdb\u5236\u53ea\u8bfb<\/td>\n<td>GENERIC_READ<\/td>\n<td>OPEN_EXISTING<\/td>\n<td>FILE_SHARE_READ<\/td>\n<\/tr>\n<tr>\n<td>\u201cwb\u201d<\/td>\n<td>\u4e8c\u8fdb\u5236\u53ea\u5199<\/td>\n<td>GENERIC_WRITE<\/td>\n<td>CREATE_ALWAYS<\/td>\n<td>0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>5.6 \u8fd0\u884c\u65f6\u5e93\u5230 Win32 \u7a7f\u900f\u56fe<\/h4>\n<p>  #mermaid-svg-ieGXGMVCf4C1y1qF{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-ieGXGMVCf4C1y1qF .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-ieGXGMVCf4C1y1qF .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-ieGXGMVCf4C1y1qF .error-icon{fill:#552222;}#mermaid-svg-ieGXGMVCf4C1y1qF .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-ieGXGMVCf4C1y1qF .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-ieGXGMVCf4C1y1qF .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-ieGXGMVCf4C1y1qF .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-ieGXGMVCf4C1y1qF .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-ieGXGMVCf4C1y1qF .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-ieGXGMVCf4C1y1qF .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-ieGXGMVCf4C1y1qF .marker{fill:#333333;stroke:#333333;}#mermaid-svg-ieGXGMVCf4C1y1qF .marker.cross{stroke:#333333;}#mermaid-svg-ieGXGMVCf4C1y1qF svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-ieGXGMVCf4C1y1qF p{margin:0;}#mermaid-svg-ieGXGMVCf4C1y1qF .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-ieGXGMVCf4C1y1qF .cluster-label text{fill:#333;}#mermaid-svg-ieGXGMVCf4C1y1qF .cluster-label span{color:#333;}#mermaid-svg-ieGXGMVCf4C1y1qF .cluster-label span p{background-color:transparent;}#mermaid-svg-ieGXGMVCf4C1y1qF .label text,#mermaid-svg-ieGXGMVCf4C1y1qF span{fill:#333;color:#333;}#mermaid-svg-ieGXGMVCf4C1y1qF .node rect,#mermaid-svg-ieGXGMVCf4C1y1qF .node circle,#mermaid-svg-ieGXGMVCf4C1y1qF .node ellipse,#mermaid-svg-ieGXGMVCf4C1y1qF .node polygon,#mermaid-svg-ieGXGMVCf4C1y1qF .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-ieGXGMVCf4C1y1qF .rough-node .label text,#mermaid-svg-ieGXGMVCf4C1y1qF .node .label text,#mermaid-svg-ieGXGMVCf4C1y1qF .image-shape .label,#mermaid-svg-ieGXGMVCf4C1y1qF .icon-shape .label{text-anchor:middle;}#mermaid-svg-ieGXGMVCf4C1y1qF .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-ieGXGMVCf4C1y1qF .rough-node .label,#mermaid-svg-ieGXGMVCf4C1y1qF .node .label,#mermaid-svg-ieGXGMVCf4C1y1qF .image-shape .label,#mermaid-svg-ieGXGMVCf4C1y1qF .icon-shape .label{text-align:center;}#mermaid-svg-ieGXGMVCf4C1y1qF .node.clickable{cursor:pointer;}#mermaid-svg-ieGXGMVCf4C1y1qF .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-ieGXGMVCf4C1y1qF .arrowheadPath{fill:#333333;}#mermaid-svg-ieGXGMVCf4C1y1qF .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-ieGXGMVCf4C1y1qF .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-ieGXGMVCf4C1y1qF .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-ieGXGMVCf4C1y1qF .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-ieGXGMVCf4C1y1qF .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-ieGXGMVCf4C1y1qF .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-ieGXGMVCf4C1y1qF .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-ieGXGMVCf4C1y1qF .cluster text{fill:#333;}#mermaid-svg-ieGXGMVCf4C1y1qF .cluster span{color:#333;}#mermaid-svg-ieGXGMVCf4C1y1qF div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-ieGXGMVCf4C1y1qF .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-ieGXGMVCf4C1y1qF rect.text{fill:none;stroke-width:0;}#mermaid-svg-ieGXGMVCf4C1y1qF .icon-shape,#mermaid-svg-ieGXGMVCf4C1y1qF .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-ieGXGMVCf4C1y1qF .icon-shape p,#mermaid-svg-ieGXGMVCf4C1y1qF .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-ieGXGMVCf4C1y1qF .icon-shape .label rect,#mermaid-svg-ieGXGMVCf4C1y1qF .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-ieGXGMVCf4C1y1qF .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-ieGXGMVCf4C1y1qF .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-ieGXGMVCf4C1y1qF :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>Win32 API \u5c42 (\u4e0b\u4e00\u5c42)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u53c2\u6570\u8f6c\u6362\u5c42<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8fd0\u884c\u65f6\u5e93\u5c42<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u9519\u8bef\u53cd\u5411\u4f20\u64ad<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>CRT: fopen(path, mode)1. ANSI\u2192Unicode\u8def\u5f84\u8f6c\u63622. mode\u89e3\u6790\u2192Win32\u53c2\u65703. HANDLE\u2192fd\u5173\u80544. FILE\u7ed3\u6784\u4f53\u521d\u59cb\u5316<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>CRT: fread(buf, size, count, fp)1. \u68c0\u67e5\u5185\u90e8\u7f13\u51b2\u533a2. \u7f13\u51b2\u533a\u7a7a\u2192ReadFile3. \u7f13\u51b2\u533a\u6ee1\u2192\u62f7\u8d1d\u5230\u7528\u6237buf<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>CRT: fwrite(buf, size, count, fp)1. \u5199\u5165\u5185\u90e8\u7f13\u51b2\u533a2. \u7f13\u51b2\u533a\u6ee1\u2192WriteFile3. fflush\u2192\u5f3a\u5236\u5237\u65b0<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>CRT: fclose(fp)1. \u5237\u65b0\u7f13\u51b2\u533a2. CloseHandle3. \u91ca\u653eFILE\u7ed3\u67844. \u91ca\u653e\u7f13\u51b2\u533a<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>.NET: FileStream.Read()1. \u68c0\u67e5_readPos&lt;_readLen2. \u7f13\u51b2\u533a\u7a7a\u2192ReadCore3. P\/Invoke\u2192ReadFile<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8def\u5f84: char* \u2192 wchar_t*MultiByteToWideChar()<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u6a21\u5f0f: &#039;r&#039;,&#039;w&#039;,&#039;a&#039; \u2192GENERIC_READ\/WRITE\/FILE_APPEND_DATAOPEN_EXISTING\/CREATE_ALWAYS\/OPEN_ALWAYS<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u53e5\u67c4: int fd \u2194 HANDLE_get_osfhandle \/ _open_osfhandle<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u9519\u8bef: GetLastError() \u2192 errno_dosmaperr()<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>CreateFileW()<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>ReadFile()<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>WriteFile()<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>CloseHandle()<\/p>\n<p><\/span><\/p>\n<h4>5.7 ANSI \u5230 Unicode \u7684\u7a7f\u900f<\/h4>\n<p>\u5728 Windows 10\/11 \u4e0a&#xff0c;\u6240\u6709 Win32 API \u7684\u5b9e\u9645\u5b9e\u73b0\u90fd\u662f Unicode \u7248\u672c&#xff08;W \u540e\u7f00&#xff09;\u3002ANSI \u7248\u672c&#xff08;A \u540e\u7f00&#xff09;\u662f\u517c\u5bb9\u5c42&#xff0c;\u5728\u5185\u90e8\u8f6c\u6362\u4e3a Unicode \u540e\u8c03\u7528 W \u7248\u672c&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ kernel32.dll \u5185\u90e8\u5b9e\u73b0 (\u6982\u5ff5\u6027)<\/span><\/p>\n<p><span class=\"token comment\">\/\/ ANSI \u7248\u672c: CreateFileA<\/span><br \/>\nHANDLE WINAPI <span class=\"token function\">CreateFileA<\/span><span class=\"token punctuation\">(<\/span><br \/>\n    LPCSTR lpFileName<span class=\"token punctuation\">,<\/span>    <span class=\"token comment\">\/\/ ANSI \u8def\u5f84<\/span><br \/>\n    DWORD dwDesiredAccess<span class=\"token punctuation\">,<\/span><br \/>\n    DWORD dwShareMode<span class=\"token punctuation\">,<\/span><br \/>\n    LPSECURITY_ATTRIBUTES lpSecurityAttributes<span class=\"token punctuation\">,<\/span><br \/>\n    DWORD dwCreationDisposition<span class=\"token punctuation\">,<\/span><br \/>\n    DWORD dwFlagsAndAttributes<span class=\"token punctuation\">,<\/span><br \/>\n    HANDLE hTemplateFile<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ 1. \u5c06 ANSI \u8def\u5f84\u8f6c\u6362\u4e3a Unicode \u8def\u5f84<\/span><br \/>\n    WCHAR wFileName<span class=\"token punctuation\">[<\/span>MAX_PATH<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">int<\/span> len <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">MultiByteToWideChar<\/span><span class=\"token punctuation\">(<\/span><br \/>\n        CP_ACP<span class=\"token punctuation\">,<\/span>             <span class=\"token comment\">\/\/ \u4ee3\u7801\u9875 (\u7cfb\u7edfANSI\u4ee3\u7801\u9875)<\/span><br \/>\n        <span class=\"token number\">0<\/span><span class=\"token punctuation\">,<\/span>                  <span class=\"token comment\">\/\/ \u6807\u5fd7<\/span><br \/>\n        lpFileName<span class=\"token punctuation\">,<\/span>         <span class=\"token comment\">\/\/ \u6e90 ANSI \u5b57\u7b26\u4e32<\/span><br \/>\n        <span class=\"token operator\">&#8211;<\/span><span class=\"token number\">1<\/span><span class=\"token punctuation\">,<\/span>                 <span class=\"token comment\">\/\/ \u4ee5 null \u7ed3\u5c3e<\/span><br \/>\n        wFileName<span class=\"token punctuation\">,<\/span>          <span class=\"token comment\">\/\/ \u76ee\u6807 Unicode \u7f13\u51b2\u533a<\/span><br \/>\n        MAX_PATH            <span class=\"token comment\">\/\/ \u7f13\u51b2\u533a\u5927\u5c0f<\/span><br \/>\n    <span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>len <span class=\"token operator\">&#061;&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token function\">SetLastError<\/span><span class=\"token punctuation\">(<\/span>ERROR_INVALID_PARAMETER<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> INVALID_HANDLE_VALUE<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 2. \u8c03\u7528 Unicode \u7248\u672c<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> <span class=\"token function\">CreateFileW<\/span><span class=\"token punctuation\">(<\/span><br \/>\n        wFileName<span class=\"token punctuation\">,<\/span><br \/>\n        dwDesiredAccess<span class=\"token punctuation\">,<\/span><br \/>\n        dwShareMode<span class=\"token punctuation\">,<\/span><br \/>\n        lpSecurityAttributes<span class=\"token punctuation\">,<\/span><br \/>\n        dwCreationDisposition<span class=\"token punctuation\">,<\/span><br \/>\n        dwFlagsAndAttributes<span class=\"token punctuation\">,<\/span><br \/>\n        hTemplateFile<br \/>\n    <span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>\u8fd9\u610f\u5473\u7740\u5982\u679c\u8fd0\u884c\u65f6\u5e93\u76f4\u63a5\u8c03\u7528 A \u7248\u672c API&#xff0c;\u4f1a\u591a\u4e00\u5c42 ANSI\u2192Unicode \u8f6c\u6362\u7a7f\u900f\u3002\u73b0\u4ee3\u8fd0\u884c\u65f6\u5e93\u901a\u5e38\u76f4\u63a5\u8c03\u7528 W \u7248\u672c\u4ee5\u907f\u514d\u8fd9\u4e2a\u5f00\u9500\u3002<\/p>\n<h4>5.8 Win32 API \u7684 DLL \u6620\u5c04<\/h4>\n<p>Win32 API \u6309\u529f\u80fd\u9886\u57df\u5206\u5e03\u5728\u4e0d\u540c\u7684 DLL \u4e2d\u3002\u8fd0\u884c\u65f6\u5e93\u9700\u8981\u6b63\u786e\u94fe\u63a5\u5230\u5bf9\u5e94 DLL&#xff1a;<\/p>\n<table>\n<tr>\u529f\u80fd\u9886\u57dfDLL\u5178\u578b\u51fd\u6570<\/tr>\n<tbody>\n<tr>\n<td>\u6587\u4ef6\/\u8fdb\u7a0b\/\u7ebf\u7a0b\/\u5185\u5b58<\/td>\n<td>kernel32.dll<\/td>\n<td>CreateFileW, ReadFile, CreateProcessW, VirtualAlloc<\/td>\n<\/tr>\n<tr>\n<td>\u7a97\u53e3\/\u6d88\u606f<\/td>\n<td>user32.dll<\/td>\n<td>CreateWindowExW, SendMessageW, MessageBoxW<\/td>\n<\/tr>\n<tr>\n<td>\u56fe\u5f62\/GDI<\/td>\n<td>gdi32.dll<\/td>\n<td>CreateDCW, TextOutW, BitBlt<\/td>\n<\/tr>\n<tr>\n<td>\u5b89\u5168\/\u6ce8\u518c\u8868<\/td>\n<td>advapi32.dll<\/td>\n<td>RegOpenKeyExW, CryptAcquireContextW<\/td>\n<\/tr>\n<tr>\n<td>COM\/OLE<\/td>\n<td>ole32.dll<\/td>\n<td>CoCreateInstance, CoInitializeEx<\/td>\n<\/tr>\n<tr>\n<td>Shell<\/td>\n<td>shell32.dll<\/td>\n<td>ShellExecuteW, SHGetFolderPathW<\/td>\n<\/tr>\n<tr>\n<td>\u7f51\u7edc<\/td>\n<td>ws2_32.dll<\/td>\n<td>socket, connect, send, recv<\/td>\n<\/tr>\n<tr>\n<td>Winsock \u6269\u5c55<\/td>\n<td>mswsock.dll<\/td>\n<td>AcceptEx, TransmitFile<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u5728 x64 Windows \u4e0a&#xff0c;kernel32.dll \u4e2d\u7684\u8bb8\u591a\u51fd\u6570\u5b9e\u9645\u4e0a\u53ea\u662f\u8f6c\u53d1\u5230 kernelbase.dll&#xff08;Kernel Base API&#xff09;\u3002\u4f8b\u5982 CreateFileW \u5728 kernel32.dll \u4e2d\u53ef\u80fd\u53ea\u6709\u4e00\u6761 jmp kernelbase.CreateFileW \u6307\u4ee4\u3002\u8fd9\u79cd\u95f4\u63a5\u8f6c\u53d1\u662f Windows API \u96c6\u5316&#xff08;API Set&#xff09;\u67b6\u6784\u7684\u4e00\u90e8\u5206\u3002<\/p>\n<h4>5.9 Win32 API \u96c6\u5316&#xff08;API Sets&#xff09;<\/h4>\n<p>\u4ece Windows 7 \u5f00\u59cb&#xff0c;\u5fae\u8f6f\u5f15\u5165\u4e86 API Set \u673a\u5236\u3002\u8bb8\u591a Win32 API \u4e0d\u518d\u76f4\u63a5\u7531\u4f20\u7edf DLL&#xff08;\u5982 kernel32.dll&#xff09;\u5b9e\u73b0&#xff0c;\u800c\u662f\u7531 API Set DLL&#xff08;\u5982 api-ms-win-core-file-l1-1-0.dll&#xff09;\u5b9e\u73b0\u3002\u4f20\u7edf DLL \u901a\u8fc7\u8f6c\u53d1\u6869&#xff08;forwarding stub&#xff09;\u5c06\u8c03\u7528\u8def\u7531\u5230\u6b63\u786e\u7684 API Set\u3002<\/p>\n<p>kernel32.dll!CreateFileW<br \/>\n    \u2192 jmp kernelbase.dll!CreateFileW<br \/>\n        \u2192 \u8c03\u7528 ntdll.dll!NtCreateFile (\u7a7f\u900f\u5230 NT API \u5c42)<\/p>\n<p>API Set \u673a\u5236\u7684\u597d\u5904\u662f\u89e3\u8026&#xff1a;\u7cfb\u7edf\u53ef\u4ee5\u6839\u636e\u5b9e\u9645\u9700\u8981\u5c06 API \u8def\u7531\u5230\u4e0d\u540c\u7684\u5b9e\u73b0 DLL&#xff0c;\u800c\u5e94\u7528\u7a0b\u5e8f\u65e0\u9700\u5173\u5fc3\u3002<\/p>\n<h4>5.10 \u672c\u5c42\u7a7f\u900f\u603b\u7ed3<\/h4>\n<p>\u8fd0\u884c\u65f6\u5e93\u5230 Win32 API \u7684\u7a7f\u900f\u662f\u7528\u6237\u6001\u5185\u6700\u540e\u4e00\u6b21&#034;\u7eaf\u51fd\u6570\u8c03\u7528&#034;\u7a7f\u900f\u3002\u8fd9\u5c42\u7a7f\u900f\u7684\u5173\u952e\u8981\u70b9&#xff1a;<\/p>\n<ul>\n<li>\u53c2\u6570\u683c\u5f0f\u4ece\u8bed\u8a00\u6807\u51c6\u683c\u5f0f\u8f6c\u6362\u4e3a Win32 \u683c\u5f0f&#xff08;\u8def\u5f84\u7f16\u7801\u3001\u6253\u5f00\u6a21\u5f0f\u3001\u9519\u8bef\u7801&#xff09;<\/li>\n<li>ANSI\u2192Unicode \u8f6c\u6362\u662f\u4e00\u4e2a\u989d\u5916\u7684\u7a7f\u900f\u6b65\u9aa4&#xff08;\u5982\u679c\u8c03\u7528 A \u7248\u672c API&#xff09;<\/li>\n<li>API Set \u67b6\u6784\u4f7f\u5f97\u51fd\u6570\u8c03\u7528\u53ef\u80fd\u7ecf\u8fc7\u8f6c\u53d1\u6869<\/li>\n<li>\u53e5\u67c4\u7ba1\u7406\u7cfb\u7edf\u4ece\u8fd0\u884c\u65f6\u5e93\u7684 fd \u8f6c\u6362\u4e3a Win32 \u7684 HANDLE<\/li>\n<li>\u8fd9\u5c42\u7a7f\u900f\u4e4b\u540e&#xff0c;\u4e0b\u4e00\u6b65\u5c06\u8fdb\u5165 NT API \u5c42\u2014\u2014Win32 API \u7684\u5e95\u5c42\u5b9e\u73b0<\/li>\n<\/ul>\n<hr \/>\n<h3>6. \u7b2c4\u5c42\u7a7f\u900f&#xff1a;Windows API\u2192NT API<\/h3>\n<h4>6.1 \u5c01\u88c5\u8fb9\u754c&#xff1a;NT API \u51fd\u6570\u7b7e\u540d\u548c\u53c2\u6570\u683c\u5f0f<\/h4>\n<p>Windows API \u5230 NT API \u7684\u7a7f\u900f\u8fb9\u754c\u662f NT API \u51fd\u6570\u7b7e\u540d\u548c NT \u6570\u636e\u7ed3\u6784\u3002NT API \u4f7f\u7528\u4e0e Win32 API \u5b8c\u5168\u4e0d\u540c\u7684\u6570\u636e\u7c7b\u578b\u548c\u53c2\u6570\u683c\u5f0f&#xff0c;\u8fd9\u662f Windows NT \u5185\u6838\u7684\u539f\u751f\u63a5\u53e3\u3002<\/p>\n<p>Win32 API \u4e0e NT API \u7684\u5173\u952e\u5dee\u5f02&#xff1a;<\/p>\n<table>\n<tr>\u7ef4\u5ea6Win32 APINT API<\/tr>\n<tbody>\n<tr>\n<td>\u5b57\u7b26\u4e32\u7c7b\u578b<\/td>\n<td>LPCWSTR (\u4ee5null\u7ed3\u5c3e\u7684wchar_t*)<\/td>\n<td>UNICODE_STRING (\u957f\u5ea6\u524d\u7f00&#043;\u7f13\u51b2\u533a\u6307\u9488)<\/td>\n<\/tr>\n<tr>\n<td>\u8def\u5f84\u683c\u5f0f<\/td>\n<td>C:\\\\file.txt<\/td>\n<td>\\\\??\\\\C:\\\\file.txt \u6216 \\\\Device\\\\HarddiskVolume1\\\\file.txt<\/td>\n<\/tr>\n<tr>\n<td>\u5bf9\u8c61\u5c5e\u6027<\/td>\n<td>\u5206\u6563\u5728\u591a\u4e2a\u53c2\u6570\u4e2d<\/td>\n<td>\u5c01\u88c5\u5728 OBJECT_ATTRIBUTES \u7ed3\u6784\u4f53\u4e2d<\/td>\n<\/tr>\n<tr>\n<td>\u5b89\u5168\u63cf\u8ff0\u7b26<\/td>\n<td>SECURITY_ATTRIBUTES<\/td>\n<td>SECURITY_DESCRIPTOR (\u901a\u8fc7 OBJECT_ATTRIBUTES)<\/td>\n<\/tr>\n<tr>\n<td>\u9519\u8bef\u7801<\/td>\n<td>Win32 Error (DWORD)<\/td>\n<td>NTSTATUS (LONG)<\/td>\n<\/tr>\n<tr>\n<td>\u8fd4\u56de\u503c<\/td>\n<td>BOOL\/HANDLE<\/td>\n<td>NTSTATUS (LONG)<\/td>\n<\/tr>\n<tr>\n<td>\u5185\u5b58\u5206\u914d<\/td>\n<td>HeapAlloc\/LocalAlloc<\/td>\n<td>RtlAllocateHeap (\u8fdb\u7a0b\u9ed8\u8ba4\u5806)<\/td>\n<\/tr>\n<tr>\n<td>\u51fd\u6570\u547d\u540d<\/td>\n<td>CreateFileW\/CreateFileA<\/td>\n<td>NtCreateFile (\u65e0A\/W\u533a\u5206, \u4ec5Unicode)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>6.2 \u7a7f\u900f\u65b9\u5f0f&#xff1a;Win32 API \u5185\u90e8\u8c03\u7528 NT API<\/h4>\n<p>Win32 API \u5728 kernel32.dll\/kernelbase.dll \u5185\u90e8\u76f4\u63a5\u8c03\u7528 ntdll.dll \u5bfc\u51fa\u7684 NT API \u51fd\u6570\u3002\u8fd9\u662f\u4e00\u79cd\u666e\u901a\u7684\u51fd\u6570\u8c03\u7528\u2014\u2014Win32 API \u51fd\u6570\u7684\u4ee3\u7801\u4e2d\u5305\u542b\u5bf9 NT API \u51fd\u6570\u7684 call \u6307\u4ee4\u3002<\/p>\n<p>kernelbase.dll!CreateFileW<br \/>\n    \u2192 \u6784\u5efa OBJECT_ATTRIBUTES<br \/>\n    \u2192 \u6784\u5efa UNICODE_STRING<br \/>\n    \u2192 \u8c03\u7528 ntdll.dll!NtCreateFile<\/p>\n<p>\u8fd9\u5c42\u7a7f\u900f\u4e0d\u6d89\u53ca\u7279\u6743\u7ea7\u5207\u6362&#xff08;\u4ecd\u5728 Ring 3&#xff09;&#xff0c;\u4f46\u6d89\u53ca\u5927\u91cf\u7684\u53c2\u6570\u683c\u5f0f\u8f6c\u6362\u3002<\/p>\n<h4>6.3 \u793a\u4f8b&#xff1a;CreateFileW \u2192 NtCreateFile<\/h4>\n<p>CreateFileW \u7684\u5b8c\u6574\u5b9e\u73b0\u8def\u5f84&#xff08;\u6982\u5ff5\u6027&#xff0c;\u57fa\u4e8e Windows 10 x64 \u9006\u5411\u5206\u6790&#xff09;&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ kernelbase.dll \u5185\u90e8\u5b9e\u73b0 (\u6982\u5ff5\u6027, \u57fa\u4e8e\u9006\u5411\u5206\u6790)<\/span><\/p>\n<p>HANDLE WINAPI <span class=\"token function\">CreateFileW<\/span><span class=\"token punctuation\">(<\/span><br \/>\n    LPCWSTR lpFileName<span class=\"token punctuation\">,<\/span>              <span class=\"token comment\">\/\/ Win32 \u8def\u5f84: &#034;C:\\\\test.txt&#034;<\/span><br \/>\n    DWORD dwDesiredAccess<span class=\"token punctuation\">,<\/span>          <span class=\"token comment\">\/\/ GENERIC_READ \u7b49<\/span><br \/>\n    DWORD dwShareMode<span class=\"token punctuation\">,<\/span>              <span class=\"token comment\">\/\/ FILE_SHARE_READ \u7b49<\/span><br \/>\n    LPSECURITY_ATTRIBUTES lpSecurityAttributes<span class=\"token punctuation\">,<\/span> <span class=\"token comment\">\/\/ \u5b89\u5168\u5c5e\u6027<\/span><br \/>\n    DWORD dwCreationDisposition<span class=\"token punctuation\">,<\/span>    <span class=\"token comment\">\/\/ OPEN_EXISTING \u7b49<\/span><br \/>\n    DWORD dwFlagsAndAttributes<span class=\"token punctuation\">,<\/span>     <span class=\"token comment\">\/\/ FILE_ATTRIBUTE_NORMAL \u7b49<\/span><br \/>\n    HANDLE hTemplateFile<span class=\"token punctuation\">)<\/span>           <span class=\"token comment\">\/\/ \u6a21\u677f\u6587\u4ef6\u53e5\u67c4<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    NTSTATUS status<span class=\"token punctuation\">;<\/span><br \/>\n    HANDLE hFile <span class=\"token operator\">&#061;<\/span> <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    UNICODE_STRING ntFileName<span class=\"token punctuation\">;<\/span>      <span class=\"token comment\">\/\/ NT \u8def\u5f84\u540d<\/span><br \/>\n    OBJECT_ATTRIBUTES objectAttributes<span class=\"token punctuation\">;<\/span> <span class=\"token comment\">\/\/ \u5bf9\u8c61\u5c5e\u6027<\/span><br \/>\n    IO_STATUS_BLOCK ioStatusBlock<span class=\"token punctuation\">;<\/span><br \/>\n    ULONG createDisposition <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    ULONG createOptions <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    ULONG eaSize <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    PVOID eaBuffer <span class=\"token operator\">&#061;<\/span> <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    LARGE_INTEGER allocationSize <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">{<\/span> <span class=\"token number\">0<\/span> <span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ &#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061; \u53c2\u6570\u8f6c\u6362\u9636\u6bb5 &#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 1. \u8def\u5f84\u8f6c\u6362: Win32\u8def\u5f84 \u2192 NT\u8def\u5f84<\/span><br \/>\n    <span class=\"token comment\">\/\/ &#034;C:\\\\test.txt&#034; \u2192 &#034;\\\\??\\\\C:\\\\test.txt&#034;<\/span><br \/>\n    <span class=\"token comment\">\/\/ &#034;C:\\\\&#034; \u5bf9\u5e94 NT \u5bf9\u8c61\u76ee\u5f55 &#034;\\\\??\\\\&#034;<\/span><br \/>\n    <span class=\"token comment\">\/\/ UNC \u8def\u5f84 &#034;\\\\\\\\server\\\\share&#034; \u2192 &#034;\\\\??\\\\UNC\\\\server\\\\share&#034;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token operator\">!<\/span><span class=\"token function\">RtlDosPathNameToNtPathName_U<\/span><span class=\"token punctuation\">(<\/span><br \/>\n            lpFileName<span class=\"token punctuation\">,<\/span>       <span class=\"token comment\">\/\/ \u8f93\u5165: &#034;C:\\\\test.txt&#034;<\/span><br \/>\n            <span class=\"token operator\">&amp;<\/span>ntFileName<span class=\"token punctuation\">,<\/span>      <span class=\"token comment\">\/\/ \u8f93\u51fa: UNICODE_STRING {Length, Buffer&#061;&#034;\\\\??\\\\C:\\\\test.txt&#034;}<\/span><br \/>\n            <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">,<\/span>             <span class=\"token comment\">\/\/ \u53ef\u9009: \u6587\u4ef6\u90e8\u5206<\/span><br \/>\n            <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span>            <span class=\"token comment\">\/\/ \u53ef\u9009: \u76f8\u5bf9\u8def\u5f84\u4fe1\u606f<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token function\">BaseSetLastNTError<\/span><span class=\"token punctuation\">(<\/span>STATUS_OBJECT_NAME_INVALID<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> INVALID_HANDLE_VALUE<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 2. \u6784\u5efa OBJECT_ATTRIBUTES \u7ed3\u6784<\/span><br \/>\n    <span class=\"token function\">InitializeObjectAttributes<\/span><span class=\"token punctuation\">(<\/span><br \/>\n        <span class=\"token operator\">&amp;<\/span>objectAttributes<span class=\"token punctuation\">,<\/span>    <span class=\"token comment\">\/\/ \u8f93\u51fa\u7ed3\u6784<\/span><br \/>\n        <span class=\"token operator\">&amp;<\/span>ntFileName<span class=\"token punctuation\">,<\/span>          <span class=\"token comment\">\/\/ \u5bf9\u8c61\u540d: &#034;\\\\??\\\\C:\\\\test.txt&#034;<\/span><br \/>\n        OBJ_CASE_INSENSITIVE <span class=\"token operator\">|<\/span> <span class=\"token punctuation\">(<\/span>lpSecurityAttributes <span class=\"token operator\">?<\/span><br \/>\n            OBJ_INHERIT <span class=\"token operator\">:<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token comment\">\/\/ \u5c5e\u6027\u6807\u5fd7<\/span><br \/>\n        <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">,<\/span>                 <span class=\"token comment\">\/\/ \u6839\u76ee\u5f55\u53e5\u67c4 (\u7528\u4e8e\u76f8\u5bf9\u8def\u5f84)<\/span><br \/>\n        lpSecurityAttributes <span class=\"token operator\">?<\/span><br \/>\n            lpSecurityAttributes<span class=\"token operator\">-&gt;<\/span>lpSecurityDescriptor <span class=\"token operator\">:<\/span> <span class=\"token constant\">NULL<\/span><br \/>\n                              <span class=\"token comment\">\/\/ \u5b89\u5168\u63cf\u8ff0\u7b26<\/span><br \/>\n    <span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 3. dwDesiredAccess \u8f6c\u6362<\/span><br \/>\n    <span class=\"token comment\">\/\/ GENERIC_READ\/WRITE \u9700\u8981\u6620\u5c04\u4e3a\u5177\u4f53\u7684\u8bbf\u95ee\u6743\u9650<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u4f46 NT API \u4e5f\u63a5\u53d7 GENERIC_* \u5e76\u7531\u5bf9\u8c61\u7c7b\u578b\u8fdb\u884c\u6620\u5c04<\/span><br \/>\n    <span class=\"token comment\">\/\/ (\u5927\u90e8\u5206\u60c5\u51b5\u4e0b\u53ef\u4ee5\u76f4\u63a5\u4f20\u9012)<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 4. dwCreationDisposition \u8f6c\u6362<\/span><br \/>\n    <span class=\"token keyword\">switch<\/span> <span class=\"token punctuation\">(<\/span>dwCreationDisposition<span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token keyword\">case<\/span> CREATE_NEW<span class=\"token operator\">:<\/span>        <span class=\"token comment\">\/\/ \u6587\u4ef6\u4e0d\u5b58\u5728\u5219\u521b\u5efa, \u5df2\u5b58\u5728\u5219\u5931\u8d25<\/span><br \/>\n            createDisposition <span class=\"token operator\">&#061;<\/span> FILE_CREATE<span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">break<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">case<\/span> CREATE_ALWAYS<span class=\"token operator\">:<\/span>     <span class=\"token comment\">\/\/ \u603b\u662f\u521b\u5efa, \u8986\u76d6\u5df2\u6709\u6587\u4ef6<\/span><br \/>\n            createDisposition <span class=\"token operator\">&#061;<\/span> FILE_OVERWRITE_IF<span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">break<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">case<\/span> OPEN_EXISTING<span class=\"token operator\">:<\/span>     <span class=\"token comment\">\/\/ \u6253\u5f00\u5df2\u6709\u6587\u4ef6, \u4e0d\u5b58\u5728\u5219\u5931\u8d25<\/span><br \/>\n            createDisposition <span class=\"token operator\">&#061;<\/span> FILE_OPEN<span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">break<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">case<\/span> OPEN_ALWAYS<span class=\"token operator\">:<\/span>       <span class=\"token comment\">\/\/ \u6253\u5f00, \u4e0d\u5b58\u5728\u5219\u521b\u5efa<\/span><br \/>\n            createDisposition <span class=\"token operator\">&#061;<\/span> FILE_OPEN_IF<span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">break<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">case<\/span> TRUNCATE_EXISTING<span class=\"token operator\">:<\/span> <span class=\"token comment\">\/\/ \u6253\u5f00\u5e76\u622a\u65ad<\/span><br \/>\n            createDisposition <span class=\"token operator\">&#061;<\/span> FILE_OVERWRITE<span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">break<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">default<\/span><span class=\"token operator\">:<\/span><br \/>\n            <span class=\"token function\">RtlFreeUnicodeString<\/span><span class=\"token punctuation\">(<\/span><span class=\"token operator\">&amp;<\/span>ntFileName<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token function\">BaseSetLastNTError<\/span><span class=\"token punctuation\">(<\/span>STATUS_INVALID_PARAMETER<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">return<\/span> INVALID_HANDLE_VALUE<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 5. dwFlagsAndAttributes \u8f6c\u6362<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u9ad816\u4f4d: \u6587\u4ef6\u5c5e\u6027 (FILE_ATTRIBUTE_*)<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u4f4e16\u4f4d: \u6807\u5fd7 (FILE_FLAG_*)<\/span><br \/>\n    ULONG fileAttributes <span class=\"token operator\">&#061;<\/span> dwFlagsAndAttributes <span class=\"token operator\">&amp;<\/span> <span class=\"token number\">0xFFFF<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>dwFlagsAndAttributes <span class=\"token operator\">&amp;<\/span> FILE_FLAG_BACKUP_SEMANTICS<span class=\"token punctuation\">)<\/span><br \/>\n        createOptions <span class=\"token operator\">|&#061;<\/span> FILE_OPEN_FOR_BACKUP_INTENT<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>dwFlagsAndAttributes <span class=\"token operator\">&amp;<\/span> FILE_FLAG_DELETE_ON_CLOSE<span class=\"token punctuation\">)<\/span><br \/>\n        createOptions <span class=\"token operator\">|&#061;<\/span> FILE_DELETE_ON_CLOSE<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>dwFlagsAndAttributes <span class=\"token operator\">&amp;<\/span> FILE_FLAG_NO_BUFFERING<span class=\"token punctuation\">)<\/span><br \/>\n        createOptions <span class=\"token operator\">|&#061;<\/span> FILE_NO_INTERMEDIATE_BUFFERING<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>dwFlagsAndAttributes <span class=\"token operator\">&amp;<\/span> FILE_FLAG_OPEN_REPARSE_POINT<span class=\"token punctuation\">)<\/span><br \/>\n        createOptions <span class=\"token operator\">|&#061;<\/span> FILE_OPEN_REPARSE_POINT<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>dwFlagsAndAttributes <span class=\"token operator\">&amp;<\/span> FILE_FLAG_OVERLAPPED<span class=\"token punctuation\">)<\/span><br \/>\n        createOptions <span class=\"token operator\">|&#061;<\/span> FILE_SYNCHRONOUS_IO_NONALERT<span class=\"token punctuation\">;<\/span> <span class=\"token comment\">\/\/ \u6ce8\u610f: \u53cd\u8f6c!<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>dwFlagsAndAttributes <span class=\"token operator\">&amp;<\/span> FILE_FLAG_RANDOM_ACCESS<span class=\"token punctuation\">)<\/span><br \/>\n        createOptions <span class=\"token operator\">|&#061;<\/span> FILE_RANDOM_ACCESS<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>dwFlagsAndAttributes <span class=\"token operator\">&amp;<\/span> FILE_FLAG_SEQUENTIAL_SCAN<span class=\"token punctuation\">)<\/span><br \/>\n        createOptions <span class=\"token operator\">|&#061;<\/span> FILE_SEQUENTIAL_ONLY<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>dwFlagsAndAttributes <span class=\"token operator\">&amp;<\/span> FILE_FLAG_WRITE_THROUGH<span class=\"token punctuation\">)<\/span><br \/>\n        createOptions <span class=\"token operator\">|&#061;<\/span> FILE_WRITE_THROUGH<span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ \u6ce8\u610f: \u540c\u6b65I\/O\u65f6\u9700\u8981\u8bbe\u7f6e SYNCHRONIZE \u8bbf\u95ee\u6743\u9650<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token operator\">!<\/span><span class=\"token punctuation\">(<\/span>dwFlagsAndAttributes <span class=\"token operator\">&amp;<\/span> FILE_FLAG_OVERLAPPED<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        dwDesiredAccess <span class=\"token operator\">|&#061;<\/span> SYNCHRONIZE<span class=\"token punctuation\">;<\/span><br \/>\n        createOptions <span class=\"token operator\">|&#061;<\/span> FILE_SYNCHRONOUS_IO_NONALERT<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ &#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061; \u8c03\u7528 NT API &#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 6. \u8c03\u7528 NtCreateFile \u2014 \u7a7f\u900f\u5230 NT API \u5c42<\/span><br \/>\n    status <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">NtCreateFile<\/span><span class=\"token punctuation\">(<\/span><br \/>\n        <span class=\"token operator\">&amp;<\/span>hFile<span class=\"token punctuation\">,<\/span>                  <span class=\"token comment\">\/\/ FileHandle (\u8f93\u51fa)<\/span><br \/>\n        dwDesiredAccess<span class=\"token punctuation\">,<\/span>         <span class=\"token comment\">\/\/ DesiredAccess<\/span><br \/>\n        <span class=\"token operator\">&amp;<\/span>objectAttributes<span class=\"token punctuation\">,<\/span>       <span class=\"token comment\">\/\/ ObjectAttributes<\/span><br \/>\n        <span class=\"token operator\">&amp;<\/span>ioStatusBlock<span class=\"token punctuation\">,<\/span>          <span class=\"token comment\">\/\/ IoStatusBlock (\u8f93\u51fa)<\/span><br \/>\n        <span class=\"token operator\">&amp;<\/span>allocationSize<span class=\"token punctuation\">,<\/span>         <span class=\"token comment\">\/\/ AllocationSize (\u53ef\u9009)<\/span><br \/>\n        fileAttributes<span class=\"token punctuation\">,<\/span>          <span class=\"token comment\">\/\/ FileAttributes<\/span><br \/>\n        dwShareMode<span class=\"token punctuation\">,<\/span>             <span class=\"token comment\">\/\/ ShareAccess<\/span><br \/>\n        createDisposition<span class=\"token punctuation\">,<\/span>       <span class=\"token comment\">\/\/ CreateDisposition<\/span><br \/>\n        createOptions<span class=\"token punctuation\">,<\/span>           <span class=\"token comment\">\/\/ CreateOptions<\/span><br \/>\n        eaBuffer<span class=\"token punctuation\">,<\/span>                <span class=\"token comment\">\/\/ EaBuffer (\u6269\u5c55\u5c5e\u6027, \u53ef\u9009)<\/span><br \/>\n        eaSize                   <span class=\"token comment\">\/\/ EaLength<\/span><br \/>\n    <span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ &#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061; \u7ed3\u679c\u5904\u7406 &#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;&#061;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 7. \u91ca\u653e NT \u8def\u5f84\u540d\u7f13\u51b2\u533a<\/span><br \/>\n    <span class=\"token function\">RtlFreeUnicodeString<\/span><span class=\"token punctuation\">(<\/span><span class=\"token operator\">&amp;<\/span>ntFileName<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 8. \u9519\u8bef\u7801\u8f6c\u6362: NTSTATUS \u2192 Win32 Error<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token operator\">!<\/span><span class=\"token function\">NT_SUCCESS<\/span><span class=\"token punctuation\">(<\/span>status<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token function\">BaseSetLastNTError<\/span><span class=\"token punctuation\">(<\/span>status<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>  <span class=\"token comment\">\/\/ \u2192 SetLastError(win32_error)<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> INVALID_HANDLE_VALUE<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 9. \u7279\u6b8a\u5904\u7406: TRUNCATE_EXISTING \u9700\u8981\u68c0\u67e5\u6587\u4ef6\u662f\u5426\u88ab\u622a\u65ad<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>dwCreationDisposition <span class=\"token operator\">&#061;&#061;<\/span> TRUNCATE_EXISTING<span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token comment\">\/\/ \u68c0\u67e5 ioStatusBlock.Information \u662f\u5426\u4e3a FILE_OVERWRITTEN<\/span><br \/>\n        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>ioStatusBlock<span class=\"token punctuation\">.<\/span>Information <span class=\"token operator\">!&#061;<\/span> FILE_OVERWRITTEN<span class=\"token punctuation\">)<\/span><br \/>\n        <span class=\"token punctuation\">{<\/span><br \/>\n            <span class=\"token function\">NtClose<\/span><span class=\"token punctuation\">(<\/span>hFile<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token function\">BaseSetLastNTError<\/span><span class=\"token punctuation\">(<\/span>STATUS_OBJECT_NAME_NOT_FOUND<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">return<\/span> INVALID_HANDLE_VALUE<span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token keyword\">return<\/span> hFile<span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<h4>6.4 \u53c2\u6570\u683c\u5f0f\u8f6c\u6362\u8be6\u89e3<\/h4>\n<h5>6.4.1 LPCWSTR \u2192 UNICODE_STRING \u2192 OBJECT_ATTRIBUTES<\/h5>\n<p>\u8fd9\u662f Win32\u2192NT \u7a7f\u900f\u4e2d\u6700\u6838\u5fc3\u7684\u53c2\u6570\u8f6c\u6362&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ \u8f93\u5165: Win32 \u8def\u5f84<\/span><br \/>\nLPCWSTR lpFileName <span class=\"token operator\">&#061;<\/span> L<span class=\"token string\">&#034;C:\\\\\\\\test.txt&#034;<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token comment\">\/\/ \u6b65\u9aa41: \u8f6c\u6362\u4e3a NT \u8def\u5f84 &#043; UNICODE_STRING<\/span><br \/>\nUNICODE_STRING ntFileName<span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token comment\">\/\/ ntFileName.Buffer &#061; L&#034;\\\\??\\\\C:\\\\test.txt&#034;<\/span><br \/>\n<span class=\"token comment\">\/\/ ntFileName.Length &#061; 28  (14\u4e2awchar \u00d7 2\u5b57\u8282)<\/span><br \/>\n<span class=\"token comment\">\/\/ ntFileName.MaximumLength &#061; 30 (\u542bnull\u7ec8\u7ed3\u7b26)<\/span><\/p>\n<p><span class=\"token comment\">\/\/ UNICODE_STRING \u7ed3\u6784\u5b9a\u4e49 (\u6765\u81ea ntdef.h):<\/span><br \/>\n<span class=\"token keyword\">typedef<\/span> <span class=\"token keyword\">struct<\/span> <span class=\"token class-name\">_UNICODE_STRING<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    USHORT Length<span class=\"token punctuation\">;<\/span>           <span class=\"token comment\">\/\/ \u5f53\u524d\u957f\u5ea6(\u5b57\u8282, \u4e0d\u542bnull)<\/span><br \/>\n    USHORT MaximumLength<span class=\"token punctuation\">;<\/span>   <span class=\"token comment\">\/\/ \u7f13\u51b2\u533a\u6700\u5927\u957f\u5ea6(\u5b57\u8282, \u542bnull)<\/span><br \/>\n    PWSTR  Buffer<span class=\"token punctuation\">;<\/span>          <span class=\"token comment\">\/\/ \u6307\u5411\u5bbd\u5b57\u7b26\u7f13\u51b2\u533a<\/span><br \/>\n<span class=\"token punctuation\">}<\/span> UNICODE_STRING<span class=\"token punctuation\">,<\/span> <span class=\"token operator\">*<\/span>PUNICODE_STRING<span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token comment\">\/\/ \u6b65\u9aa42: \u5305\u88c5\u5230 OBJECT_ATTRIBUTES<\/span><br \/>\nOBJECT_ATTRIBUTES objectAttributes<span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token comment\">\/\/ objectAttributes.Length &#061; sizeof(OBJECT_ATTRIBUTES) \/\/ &#061; 48\u5b57\u8282<\/span><br \/>\n<span class=\"token comment\">\/\/ objectAttributes.RootDirectory &#061; NULL<\/span><br \/>\n<span class=\"token comment\">\/\/ objectAttributes.ObjectName &#061; &amp;ntFileName           \/\/ \u6307\u5411\u8def\u5f84\u540d<\/span><br \/>\n<span class=\"token comment\">\/\/ objectAttributes.Attributes &#061; OBJ_CASE_INSENSITIVE  \/\/ \u5927\u5c0f\u5199\u4e0d\u654f\u611f<\/span><br \/>\n<span class=\"token comment\">\/\/ objectAttributes.SecurityDescriptor &#061; NULL \u6216\u6765\u81ea lpSecurityAttributes<\/span><br \/>\n<span class=\"token comment\">\/\/ objectAttributes.SecurityQualityOfService &#061; NULL<\/span><\/p>\n<p><span class=\"token comment\">\/\/ OBJECT_ATTRIBUTES \u7ed3\u6784\u5b9a\u4e49 (\u6765\u81ea ntdef.h):<\/span><br \/>\n<span class=\"token keyword\">typedef<\/span> <span class=\"token keyword\">struct<\/span> <span class=\"token class-name\">_OBJECT_ATTRIBUTES<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    ULONG Length<span class=\"token punctuation\">;<\/span>                    <span class=\"token comment\">\/\/ \u7ed3\u6784\u5927\u5c0f &#061; 48<\/span><br \/>\n    HANDLE RootDirectory<span class=\"token punctuation\">;<\/span>            <span class=\"token comment\">\/\/ \u6839\u76ee\u5f55\u53e5\u67c4(\u76f8\u5bf9\u8def\u5f84\u65f6\u4f7f\u7528)<\/span><br \/>\n    PUNICODE_STRING ObjectName<span class=\"token punctuation\">;<\/span>      <span class=\"token comment\">\/\/ \u5bf9\u8c61\u540d(\u8def\u5f84)<\/span><br \/>\n    ULONG Attributes<span class=\"token punctuation\">;<\/span>                <span class=\"token comment\">\/\/ \u5c5e\u6027\u6807\u5fd7<\/span><br \/>\n    PVOID SecurityDescriptor<span class=\"token punctuation\">;<\/span>        <span class=\"token comment\">\/\/ \u5b89\u5168\u63cf\u8ff0\u7b26<\/span><br \/>\n    PVOID SecurityQualityOfService<span class=\"token punctuation\">;<\/span>  <span class=\"token comment\">\/\/ \u5b89\u5168\u670d\u52a1\u8d28\u91cf<\/span><br \/>\n<span class=\"token punctuation\">}<\/span> OBJECT_ATTRIBUTES<span class=\"token punctuation\">,<\/span> <span class=\"token operator\">*<\/span>POBJECT_ATTRIBUTES<span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token comment\">\/\/ \u521d\u59cb\u5316\u5b8f:<\/span><br \/>\n<span class=\"token macro property\"><span class=\"token directive-hash\">#<\/span><span class=\"token directive keyword\">define<\/span> <span class=\"token macro-name function\">InitializeObjectAttributes<\/span><span class=\"token expression\"><span class=\"token punctuation\">(<\/span>p<span class=\"token punctuation\">,<\/span> n<span class=\"token punctuation\">,<\/span> a<span class=\"token punctuation\">,<\/span> r<span class=\"token punctuation\">,<\/span> s<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span> <\/span><span class=\"token punctuation\">\\\\<\/span><br \/>\n    <span class=\"token expression\"><span class=\"token punctuation\">(<\/span>p<span class=\"token punctuation\">)<\/span><span class=\"token operator\">-&gt;<\/span>Length <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">sizeof<\/span><span class=\"token punctuation\">(<\/span>OBJECT_ATTRIBUTES<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>         <\/span><span class=\"token punctuation\">\\\\<\/span><br \/>\n    <span class=\"token expression\"><span class=\"token punctuation\">(<\/span>p<span class=\"token punctuation\">)<\/span><span class=\"token operator\">-&gt;<\/span>RootDirectory <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span>r<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>                        <\/span><span class=\"token punctuation\">\\\\<\/span><br \/>\n    <span class=\"token expression\"><span class=\"token punctuation\">(<\/span>p<span class=\"token punctuation\">)<\/span><span class=\"token operator\">-&gt;<\/span>Attributes <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span>a<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>                           <\/span><span class=\"token punctuation\">\\\\<\/span><br \/>\n    <span class=\"token expression\"><span class=\"token punctuation\">(<\/span>p<span class=\"token punctuation\">)<\/span><span class=\"token operator\">-&gt;<\/span>ObjectName <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span>n<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>                           <\/span><span class=\"token punctuation\">\\\\<\/span><br \/>\n    <span class=\"token expression\"><span class=\"token punctuation\">(<\/span>p<span class=\"token punctuation\">)<\/span><span class=\"token operator\">-&gt;<\/span>SecurityDescriptor <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span>s<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>                   <\/span><span class=\"token punctuation\">\\\\<\/span><br \/>\n    <span class=\"token expression\"><span class=\"token punctuation\">(<\/span>p<span class=\"token punctuation\">)<\/span><span class=\"token operator\">-&gt;<\/span>SecurityQualityOfService <span class=\"token operator\">&#061;<\/span> <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">;<\/span>            <\/span><span class=\"token punctuation\">\\\\<\/span><br \/>\n<span class=\"token expression\"><span class=\"token punctuation\">}<\/span><\/span><\/span><\/p>\n<h5>6.4.2 dwCreationDisposition \u8f6c\u6362\u8868<\/h5>\n<table>\n<tr>Win32 \u503c\u6570\u503cNT \u503c\u6570\u503c\u542b\u4e49<\/tr>\n<tbody>\n<tr>\n<td>CREATE_NEW<\/td>\n<td>1<\/td>\n<td>FILE_CREATE<\/td>\n<td>2<\/td>\n<td>\u521b\u5efa\u65b0\u6587\u4ef6&#xff0c;\u5df2\u5b58\u5728\u5219\u5931\u8d25<\/td>\n<\/tr>\n<tr>\n<td>CREATE_ALWAYS<\/td>\n<td>2<\/td>\n<td>FILE_OVERWRITE_IF<\/td>\n<td>5<\/td>\n<td>\u521b\u5efa\u6216\u8986\u76d6<\/td>\n<\/tr>\n<tr>\n<td>OPEN_EXISTING<\/td>\n<td>3<\/td>\n<td>FILE_OPEN<\/td>\n<td>1<\/td>\n<td>\u6253\u5f00\u5df2\u6709\u6587\u4ef6<\/td>\n<\/tr>\n<tr>\n<td>OPEN_ALWAYS<\/td>\n<td>4<\/td>\n<td>FILE_OPEN_IF<\/td>\n<td>3<\/td>\n<td>\u6253\u5f00\u6216\u521b\u5efa<\/td>\n<\/tr>\n<tr>\n<td>TRUNCATE_EXISTING<\/td>\n<td>5<\/td>\n<td>FILE_OVERWRITE<\/td>\n<td>4<\/td>\n<td>\u6253\u5f00\u5e76\u622a\u65ad<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h5>6.4.3 dwFlagsAndAttributes \u8f6c\u6362<\/h5>\n<p>Win32 \u7684 dwFlagsAndAttributes \u53c2\u6570\u6df7\u5408\u4e86\u4e24\u79cd\u4e0d\u540c\u7c7b\u578b\u7684\u4fe1\u606f&#xff0c;\u9700\u8981\u62c6\u5206\u8f6c\u6362&#xff1a;<\/p>\n<p>dwFlagsAndAttributes &#061; 0x80100080<br \/>\n                       \u2191\u2191\u2191\u2191      \u2191\u2191\u2191\u2191<br \/>\n                       \u6807\u5fd7\u90e8\u5206    \u6587\u4ef6\u5c5e\u6027\u90e8\u5206<br \/>\n                       (FILE_FLAG_*) (FILE_ATTRIBUTE_*)<\/p>\n<table>\n<tr>Win32 \u6807\u5fd7\u503cNT CreateOption\u503c<\/tr>\n<tbody>\n<tr>\n<td>FILE_FLAG_BACKUP_SEMANTICS<\/td>\n<td>0x02000000<\/td>\n<td>FILE_OPEN_FOR_BACKUP_INTENT<\/td>\n<td>0x00004000<\/td>\n<\/tr>\n<tr>\n<td>FILE_FLAG_DELETE_ON_CLOSE<\/td>\n<td>0x04000000<\/td>\n<td>FILE_DELETE_ON_CLOSE<\/td>\n<td>0x00001000<\/td>\n<\/tr>\n<tr>\n<td>FILE_FLAG_NO_BUFFERING<\/td>\n<td>0x20000000<\/td>\n<td>FILE_NO_INTERMEDIATE_BUFFERING<\/td>\n<td>0x00000008<\/td>\n<\/tr>\n<tr>\n<td>FILE_FLAG_OPEN_REPARSE_POINT<\/td>\n<td>0x00200000<\/td>\n<td>FILE_OPEN_REPARSE_POINT<\/td>\n<td>0x00200000<\/td>\n<\/tr>\n<tr>\n<td>FILE_FLAG_OVERLAPPED<\/td>\n<td>0x40000000<\/td>\n<td>(\u6e05\u9664\u540c\u6b65\u6807\u5fd7)<\/td>\n<td>\u2014<\/td>\n<\/tr>\n<tr>\n<td>FILE_FLAG_RANDOM_ACCESS<\/td>\n<td>0x10000000<\/td>\n<td>FILE_RANDOM_ACCESS<\/td>\n<td>0x00000800<\/td>\n<\/tr>\n<tr>\n<td>FILE_FLAG_SEQUENTIAL_SCAN<\/td>\n<td>0x08000000<\/td>\n<td>FILE_SEQUENTIAL_ONLY<\/td>\n<td>0x00000004<\/td>\n<\/tr>\n<tr>\n<td>FILE_FLAG_WRITE_THROUGH<\/td>\n<td>0x80000000<\/td>\n<td>FILE_WRITE_THROUGH<\/td>\n<td>0x00000002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>6.5 \u9519\u8bef\u7801\u8f6c\u6362&#xff1a;NTSTATUS \u2192 Win32 Error Code<\/h4>\n<p>NT API \u8fd4\u56de NTSTATUS&#xff0c;Win32 API \u9700\u8981\u8f6c\u6362\u4e3a GetLastError() \u683c\u5f0f\u3002\u8f6c\u6362\u7531 BaseSetLastNTError \u5b8c\u6210&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ kernelbase.dll \u5185\u90e8\u5b9e\u73b0<\/span><br \/>\nVOID <span class=\"token function\">BaseSetLastNTError<\/span><span class=\"token punctuation\">(<\/span>NTSTATUS Status<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    DWORD win32Error <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">RtlNtStatusToDosError<\/span><span class=\"token punctuation\">(<\/span>Status<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token function\">SetLastError<\/span><span class=\"token punctuation\">(<\/span>win32Error<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>\u5e38\u89c1 NTSTATUS \u5230 Win32 Error \u7684\u6620\u5c04&#xff1a;<\/p>\n<table>\n<tr>NTSTATUS\u503cWin32 Error\u503c\u542b\u4e49<\/tr>\n<tbody>\n<tr>\n<td>STATUS_SUCCESS<\/td>\n<td>0x00000000<\/td>\n<td>ERROR_SUCCESS<\/td>\n<td>0<\/td>\n<td>\u6210\u529f<\/td>\n<\/tr>\n<tr>\n<td>STATUS_OBJECT_NAME_NOT_FOUND<\/td>\n<td>0xC0000034<\/td>\n<td>ERROR_FILE_NOT_FOUND<\/td>\n<td>2<\/td>\n<td>\u6587\u4ef6\u4e0d\u5b58\u5728<\/td>\n<\/tr>\n<tr>\n<td>STATUS_OBJECT_PATH_NOT_FOUND<\/td>\n<td>0xC000003A<\/td>\n<td>ERROR_PATH_NOT_FOUND<\/td>\n<td>3<\/td>\n<td>\u8def\u5f84\u4e0d\u5b58\u5728<\/td>\n<\/tr>\n<tr>\n<td>STATUS_ACCESS_DENIED<\/td>\n<td>0xC0000022<\/td>\n<td>ERROR_ACCESS_DENIED<\/td>\n<td>5<\/td>\n<td>\u62d2\u7edd\u8bbf\u95ee<\/td>\n<\/tr>\n<tr>\n<td>STATUS_OBJECT_NAME_COLLISION<\/td>\n<td>0xC0000035<\/td>\n<td>ERROR_FILE_EXISTS<\/td>\n<td>80<\/td>\n<td>\u6587\u4ef6\u5df2\u5b58\u5728<\/td>\n<\/tr>\n<tr>\n<td>STATUS_SHARING_VIOLATION<\/td>\n<td>0xC0000043<\/td>\n<td>ERROR_SHARING_VIOLATION<\/td>\n<td>32<\/td>\n<td>\u5171\u4eab\u51b2\u7a81<\/td>\n<\/tr>\n<tr>\n<td>STATUS_DISK_FULL<\/td>\n<td>0xC000007F<\/td>\n<td>ERROR_DISK_FULL<\/td>\n<td>112<\/td>\n<td>\u78c1\u76d8\u6ee1<\/td>\n<\/tr>\n<tr>\n<td>STATUS_INSUFFICIENT_RESOURCES<\/td>\n<td>0xC000009A<\/td>\n<td>ERROR_NOT_ENOUGH_MEMORY<\/td>\n<td>8<\/td>\n<td>\u8d44\u6e90\u4e0d\u8db3<\/td>\n<\/tr>\n<tr>\n<td>STATUS_INVALID_DEVICE_REQUEST<\/td>\n<td>0xC0000010<\/td>\n<td>ERROR_INVALID_FUNCTION<\/td>\n<td>1<\/td>\n<td>\u65e0\u6548\u8bbe\u5907\u8bf7\u6c42<\/td>\n<\/tr>\n<tr>\n<td>STATUS_END_OF_FILE<\/td>\n<td>0xC0000011<\/td>\n<td>ERROR_HANDLE_EOF<\/td>\n<td>38<\/td>\n<td>\u6587\u4ef6\u7ed3\u675f<\/td>\n<\/tr>\n<tr>\n<td>STATUS_FILE_IS_A_DIRECTORY<\/td>\n<td>0xC00000BA<\/td>\n<td>ERROR_ACCESS_DENIED<\/td>\n<td>5<\/td>\n<td>\u6587\u4ef6\u662f\u76ee\u5f55<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>6.6 Win32 \u5230 NT \u7a7f\u900f\u56fe<\/h4>\n<p>  #mermaid-svg-T26mnZBcXHeQvt1d{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-T26mnZBcXHeQvt1d .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-T26mnZBcXHeQvt1d .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-T26mnZBcXHeQvt1d .error-icon{fill:#552222;}#mermaid-svg-T26mnZBcXHeQvt1d .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-T26mnZBcXHeQvt1d .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-T26mnZBcXHeQvt1d .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-T26mnZBcXHeQvt1d .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-T26mnZBcXHeQvt1d .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-T26mnZBcXHeQvt1d .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-T26mnZBcXHeQvt1d .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-T26mnZBcXHeQvt1d .marker{fill:#333333;stroke:#333333;}#mermaid-svg-T26mnZBcXHeQvt1d .marker.cross{stroke:#333333;}#mermaid-svg-T26mnZBcXHeQvt1d svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-T26mnZBcXHeQvt1d p{margin:0;}#mermaid-svg-T26mnZBcXHeQvt1d .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-T26mnZBcXHeQvt1d .cluster-label text{fill:#333;}#mermaid-svg-T26mnZBcXHeQvt1d .cluster-label span{color:#333;}#mermaid-svg-T26mnZBcXHeQvt1d .cluster-label span p{background-color:transparent;}#mermaid-svg-T26mnZBcXHeQvt1d .label text,#mermaid-svg-T26mnZBcXHeQvt1d span{fill:#333;color:#333;}#mermaid-svg-T26mnZBcXHeQvt1d .node rect,#mermaid-svg-T26mnZBcXHeQvt1d .node circle,#mermaid-svg-T26mnZBcXHeQvt1d .node ellipse,#mermaid-svg-T26mnZBcXHeQvt1d .node polygon,#mermaid-svg-T26mnZBcXHeQvt1d .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-T26mnZBcXHeQvt1d .rough-node .label text,#mermaid-svg-T26mnZBcXHeQvt1d .node .label text,#mermaid-svg-T26mnZBcXHeQvt1d .image-shape .label,#mermaid-svg-T26mnZBcXHeQvt1d .icon-shape .label{text-anchor:middle;}#mermaid-svg-T26mnZBcXHeQvt1d .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-T26mnZBcXHeQvt1d .rough-node .label,#mermaid-svg-T26mnZBcXHeQvt1d .node .label,#mermaid-svg-T26mnZBcXHeQvt1d .image-shape .label,#mermaid-svg-T26mnZBcXHeQvt1d .icon-shape .label{text-align:center;}#mermaid-svg-T26mnZBcXHeQvt1d .node.clickable{cursor:pointer;}#mermaid-svg-T26mnZBcXHeQvt1d .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-T26mnZBcXHeQvt1d .arrowheadPath{fill:#333333;}#mermaid-svg-T26mnZBcXHeQvt1d .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-T26mnZBcXHeQvt1d .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-T26mnZBcXHeQvt1d .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-T26mnZBcXHeQvt1d .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-T26mnZBcXHeQvt1d .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-T26mnZBcXHeQvt1d .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-T26mnZBcXHeQvt1d .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-T26mnZBcXHeQvt1d .cluster text{fill:#333;}#mermaid-svg-T26mnZBcXHeQvt1d .cluster span{color:#333;}#mermaid-svg-T26mnZBcXHeQvt1d div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-T26mnZBcXHeQvt1d .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-T26mnZBcXHeQvt1d rect.text{fill:none;stroke-width:0;}#mermaid-svg-T26mnZBcXHeQvt1d .icon-shape,#mermaid-svg-T26mnZBcXHeQvt1d .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-T26mnZBcXHeQvt1d .icon-shape p,#mermaid-svg-T26mnZBcXHeQvt1d .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-T26mnZBcXHeQvt1d .icon-shape .label rect,#mermaid-svg-T26mnZBcXHeQvt1d .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-T26mnZBcXHeQvt1d .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-T26mnZBcXHeQvt1d .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-T26mnZBcXHeQvt1d :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u7ed3\u679c\u5904\u7406\u5c42<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\" style=\"--darkreader-inline-color: var(--darkreader-text-ffffff, #e8e6e3)\"><\/p>\n<p>NT API \u5c42 (ntdll.dll)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u53c2\u6570\u8f6c\u6362\u5c42<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>Win32 API \u5c42 (kernelbase.dll)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u6210\u529f<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u5931\u8d25<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u8fd4\u56de HANDLE<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>CreateFileW(lpFileName, dwDesiredAccess,dwShareMode, lpSecurityAttributes,dwCreationDisposition,dwFlagsAndAttributes, hTemplateFile)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8def\u5f84\u8f6c\u6362RtlDosPathNameToNtPathName_UC:\\\\\\\\test.txt \u2192 \\\\\\\\??\\\\\\\\C:\\\\\\\\test.txt<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>UNICODE_STRING \u6784\u5efa{Length&#061;28, Buffer&#061;L&#039;\\\\\\\\??\\\\\\\\C:\\\\\\\\test.txt&#039;}<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>OBJECT_ATTRIBUTES \u6784\u5efa{Length&#061;48, ObjectName&#061;&amp;ntFileName,Attributes&#061;OBJ_CASE_INSENSITIVE}<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>CreationDisposition \u8f6c\u6362OPEN_EXISTING(3) \u2192 FILE_OPEN(1)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>Flags \u8f6c\u6362FILE_FLAG_* \u2192 FILE_* \u9009\u9879\u540c\u6b65IO: \u6dfb\u52a0 SYNCHRONIZE &#043; FILE_SYNCHRONOUS_IO_NONALERT<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>IO_STATUS_BLOCK \u5206\u914d\u6808\u4e0a\u5206\u914d, \u7528\u4e8e\u63a5\u6536\u7ed3\u679c<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>NtCreateFile(&amp;hFile, DesiredAccess,&amp;ObjectAttributes, &amp;IoStatusBlock,&amp;AllocationSize, FileAttributes,ShareAccess, CreateDisposition,CreateOptions, EaBuffer, EaLength)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>NTSTATUS \u68c0\u67e5NT_SUCCESS(status)?<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u9519\u8bef\u7801\u8f6c\u6362RtlNtStatusToDosErrorNTSTATUS \u2192 Win32 Error<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u91ca\u653e NT \u8def\u5f84\u7f13\u51b2\u533aRtlFreeUnicodeString<\/p>\n<p><\/span><\/p>\n<h4>6.7 \u8def\u5f84\u8f6c\u6362\u7684\u7ec6\u8282<\/h4>\n<p>Win32 \u8def\u5f84\u5230 NT \u8def\u5f84\u7684\u8f6c\u6362\u662f\u8fd9\u5c42\u7a7f\u900f\u4e2d\u6700\u590d\u6742\u7684\u90e8\u5206\u3002RtlDosPathNameToNtPathName_U \u51fd\u6570\u6267\u884c\u4ee5\u4e0b\u8f6c\u6362&#xff1a;<\/p>\n<table>\n<tr>Win32 \u8def\u5f84NT \u8def\u5f84\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>C:\\\\file.txt<\/td>\n<td>\\\\??\\\\C:\\\\file.txt<\/td>\n<td>\u9a71\u52a8\u5668\u76d8\u7b26\u6620\u5c04\u5230 \\\\??\\\\ \u5bf9\u8c61\u76ee\u5f55<\/td>\n<\/tr>\n<tr>\n<td>C:\\\\dir\\\\<\/td>\n<td>\\\\??\\\\C:\\\\dir\\\\<\/td>\n<td>\u76ee\u5f55\u8def\u5f84<\/td>\n<\/tr>\n<tr>\n<td>\\\\\\\\server\\\\share\\\\file<\/td>\n<td>\\\\??\\\\UNC\\\\server\\\\share\\\\file<\/td>\n<td>UNC \u8def\u5f84\u6620\u5c04\u5230 \\\\??\\\\UNC\\\\<\/td>\n<\/tr>\n<tr>\n<td>\\\\\\\\.\\\\C:\\\\file.txt<\/td>\n<td>\\\\??\\\\C:\\\\file.txt<\/td>\n<td>\u8bbe\u5907\u8def\u5f84\u6620\u5c04\u5230 \\\\??\\\\<\/td>\n<\/tr>\n<tr>\n<td>\\\\\\\\.\\\\COM1<\/td>\n<td>\\\\??\\\\COM1<\/td>\n<td>\u8bbe\u5907\u540d\u76f4\u63a5\u6620\u5c04<\/td>\n<\/tr>\n<tr>\n<td>C:<\/td>\n<td>\\\\??\\\\C:<\/td>\n<td>\u5f53\u524d\u76ee\u5f55\u76f8\u5bf9\u8def\u5f84<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\\\\??\\\\ \u662f NT \u5bf9\u8c61\u7ba1\u7406\u5668\u4e2d\u7684\u4e00\u4e2a\u7b26\u53f7\u94fe\u63a5\u76ee\u5f55&#xff0c;\u5b83\u6307\u5411\u5f53\u524d\u4f1a\u8bdd\u7684 DOS \u8bbe\u5907\u547d\u540d\u7a7a\u95f4\u3002\u5728\u7cfb\u7edf\u5168\u5c40\u547d\u540d\u7a7a\u95f4\u4e2d&#xff0c;\u5b83\u7b49\u4ef7\u4e8e \\\\Global??\u3002<\/p>\n<p>NT \u5bf9\u8c61\u76ee\u5f55\u7ed3\u6784:<br \/>\n\\\\<br \/>\n\u251c\u2500\u2500 ?? (\u7b26\u53f7\u94fe\u63a5 \u2192 \\\\Global??)<br \/>\n\u2502   \u251c\u2500\u2500 C: \u2192 \\\\Device\\\\HarddiskVolume3<br \/>\n\u2502   \u251c\u2500\u2500 D: \u2192 \\\\Device\\\\HarddiskVolume1<br \/>\n\u2502   \u251c\u2500\u2500 UNC \u2192 \\\\Device\\\\Mup<br \/>\n\u2502   \u2514\u2500\u2500 COM1 \u2192 \\\\Device\\\\Serial0<br \/>\n\u251c\u2500\u2500 Global??<br \/>\n\u2502   \u251c\u2500\u2500 C: \u2192 \\\\Device\\\\HarddiskVolume3<br \/>\n\u2502   \u2514\u2500\u2500 &#8230;<br \/>\n\u251c\u2500\u2500 Device<br \/>\n\u2502   \u251c\u2500\u2500 HarddiskVolume3 (C: \u76d8)<br \/>\n\u2502   \u251c\u2500\u2500 HarddiskVolume1 (D: \u76d8)<br \/>\n\u2502   \u251c\u2500\u2500 Mup (UNC \u8def\u5f84)<br \/>\n\u2502   \u2514\u2500\u2500 &#8230;<br \/>\n\u251c\u2500\u2500 Driver<br \/>\n\u2502   \u251c\u2500\u2500 disk<br \/>\n\u2502   \u251c\u2500\u2500 partmgr<br \/>\n\u2502   \u2514\u2500\u2500 &#8230;<br \/>\n\u2514\u2500\u2500 &#8230;<\/p>\n<h4>6.8 Win32 API \u4e0e NT API \u7684\u5176\u4ed6\u5dee\u5f02<\/h4>\n<p>\u9664\u4e86\u53c2\u6570\u683c\u5f0f\u5dee\u5f02&#xff0c;Win32 API \u548c NT API \u8fd8\u6709\u4e00\u4e9b\u884c\u4e3a\u5dee\u5f02\u9700\u8981\u6ce8\u610f&#xff1a;<\/p>\n<p>\u5f02\u6b65 I\/O \u6a21\u578b&#xff1a;Win32 API \u7684 ReadFile \u5728 FILE_FLAG_OVERLAPPED \u4e0b\u662f\u5f02\u6b65\u7684&#xff0c;\u5426\u5219\u662f\u540c\u6b65\u7684\u3002NT API \u7684 NtReadFile \u9ed8\u8ba4\u662f\u5f02\u6b65\u7684&#xff08;\u8fd4\u56de STATUS_PENDING&#xff09;&#xff0c;\u53ea\u6709\u5728 FILE_SYNCHRONOUS_IO_NONALERT \u6216 FILE_SYNCHRONOUS_IO_ALERT \u9009\u9879\u4e0b\u624d\u662f\u540c\u6b65\u7684\u3002CreateFileW \u5728\u540c\u6b65\u6a21\u5f0f\u4e0b\u81ea\u52a8\u6dfb\u52a0\u8fd9\u4e9b\u9009\u9879\u3002<\/p>\n<p>\u6587\u4ef6 ID vs \u6587\u4ef6\u540d&#xff1a;Win32 API \u4f7f\u7528\u6587\u4ef6\u540d\u6216\u8def\u5f84\u6807\u8bc6\u6587\u4ef6\u3002NT API \u4e5f\u53ef\u4ee5\u4f7f\u7528\u6587\u4ef6 ID&#xff08;\u901a\u8fc7 FILE_OPEN_BY_FILE_ID \u9009\u9879&#xff09;\u76f4\u63a5\u6253\u5f00\u6587\u4ef6&#xff0c;\u65e0\u9700\u8def\u5f84\u540d\u3002<\/p>\n<p>\u4e8b\u52a1\u6027\u64cd\u4f5c&#xff1a;NT API \u652f\u6301\u4e8b\u52a1\u6027 NTFS&#xff08;TxF&#xff09;&#xff0c;\u53ef\u4ee5\u901a\u8fc7 NtCreateFile \u7684 EaBuffer \u53c2\u6570\u5173\u8054\u4e8b\u52a1\u3002Win32 API \u4e0d\u76f4\u63a5\u66b4\u9732\u8fd9\u4e2a\u529f\u80fd\u3002<\/p>\n<p>\u5bf9\u8c61\u540d\u89e3\u6790&#xff1a;NT API \u7684 OBJECT_ATTRIBUTES \u652f\u6301\u76f8\u5bf9\u8def\u5f84\u6253\u5f00\u2014\u2014\u901a\u8fc7 RootDirectory \u53e5\u67c4\u6307\u5b9a\u57fa\u51c6\u76ee\u5f55\u3002Win32 API \u7684\u76f8\u5bf9\u8def\u5f84\u57fa\u4e8e\u5f53\u524d\u5de5\u4f5c\u76ee\u5f55\u3002<\/p>\n<h4>6.9 \u672c\u5c42\u7a7f\u900f\u603b\u7ed3<\/h4>\n<p>Windows API \u5230 NT API \u7684\u7a7f\u900f\u662f\u7528\u6237\u6001\u5185\u6700\u540e\u4e00\u6b21\u53c2\u6570\u683c\u5f0f\u8f6c\u6362\u3002\u8fd9\u5c42\u7a7f\u900f\u7684\u5173\u952e\u8981\u70b9&#xff1a;<\/p>\n<ul>\n<li>\u8def\u5f84\u683c\u5f0f\u4ece Win32 \u683c\u5f0f\u8f6c\u6362\u4e3a NT \u5bf9\u8c61\u8def\u5f84\u683c\u5f0f<\/li>\n<li>\u5206\u6563\u7684 Win32 \u53c2\u6570\u88ab\u91cd\u7ec4\u4e3a OBJECT_ATTRIBUTES \u548c IO_STATUS_BLOCK \u7ed3\u6784<\/li>\n<li>dwCreationDisposition \u4ece Win32 \u679a\u4e3e\u8f6c\u6362\u4e3a NT \u679a\u4e3e<\/li>\n<li>dwFlagsAndAttributes \u88ab\u62c6\u5206\u4e3a\u6587\u4ef6\u5c5e\u6027\u548c\u521b\u5efa\u9009\u9879\u4e24\u90e8\u5206<\/li>\n<li>NTSTATUS \u9519\u8bef\u7801\u8f6c\u6362\u4e3a Win32 Error Code<\/li>\n<li>\u8fd9\u5c42\u7a7f\u900f\u4e4b\u540e&#xff0c;\u8bf7\u6c42\u5df2\u7ecf\u51c6\u5907\u597d\u8fdb\u884c\u7279\u6743\u7ea7\u5207\u6362&#xff08;syscall&#xff09;<\/li>\n<\/ul>\n<hr \/>\n<h3>7. \u7b2c5\u5c42\u7a7f\u900f&#xff1a;NT API\u2192syscall<\/h3>\n<h4>7.1 \u5c01\u88c5\u8fb9\u754c&#xff1a;\u7528\u6237\u6001\/\u5185\u6838\u6001\u5206\u754c\u7ebf&#xff08;Ring 3\u2192Ring 0&#xff09;<\/h4>\n<p>\u8fd9\u662f\u6574\u4e2a\u5173\u7cfb\u94fe\u4e2d\u6700\u5173\u952e\u7684\u7a7f\u900f\u2014\u2014\u4ece\u7528\u6237\u6001\u5230\u5185\u6838\u6001\u7684\u7279\u6743\u7ea7\u5207\u6362\u3002NT API \u5230 syscall \u7684\u7a7f\u900f\u8fb9\u754c\u662f CPU \u7279\u6743\u7ea7\u8fb9\u754c&#xff0c;\u8fd9\u662f\u7531\u786c\u4ef6&#xff08;CPU \u7684\u4fdd\u62a4\u673a\u5236&#xff09;\u5f3a\u5236\u6267\u884c\u7684&#xff0c;\u4e0d\u662f\u8f6f\u4ef6\u7ea6\u5b9a\u3002<\/p>\n<p>x64 \u67b6\u6784\u7684\u7279\u6743\u7ea7&#xff1a;<\/p>\n<ul>\n<li>Ring 0&#xff08;CPL&#061;0&#xff09;&#xff1a;\u5185\u6838\u6001&#xff0c;\u53ef\u4ee5\u6267\u884c\u6240\u6709\u6307\u4ee4\u3001\u8bbf\u95ee\u6240\u6709\u5185\u5b58\u3001\u7ba1\u7406\u786c\u4ef6<\/li>\n<li>Ring 3&#xff08;CPL&#061;3&#xff09;&#xff1a;\u7528\u6237\u6001&#xff0c;\u4e0d\u80fd\u6267\u884c\u7279\u6743\u6307\u4ee4\u3001\u53ea\u80fd\u8bbf\u95ee\u81ea\u5df1\u7684\u865a\u62df\u5730\u5740\u7a7a\u95f4<\/li>\n<\/ul>\n<p>\u7528\u6237\u6001\u4ee3\u7801\u65e0\u6cd5\u76f4\u63a5\u8c03\u7528\u5185\u6838\u51fd\u6570\u3002\u5b83\u5fc5\u987b\u901a\u8fc7 syscall \u6307\u4ee4\u89e6\u53d1 CPU \u7279\u6743\u7ea7\u5207\u6362&#xff0c;\u7531\u5185\u6838\u9a8c\u8bc1\u8bf7\u6c42\u5408\u6cd5\u6027\u540e\u6267\u884c\u3002<\/p>\n<h4>7.2 \u7a7f\u900f\u65b9\u5f0f&#xff1a;syscall \u6307\u4ee4&#xff08;x64&#xff09;<\/h4>\n<p>\u5728 x64 Windows \u4e0a&#xff0c;\u7528\u6237\u6001\u5230\u5185\u6838\u6001\u7684\u5207\u6362\u4f7f\u7528 syscall \u6307\u4ee4\u3002\u8fd9\u662f AMD64 \u67b6\u6784\u63d0\u4f9b\u7684\u5feb\u901f\u7cfb\u7edf\u8c03\u7528\u673a\u5236&#xff0c;\u6bd4\u4f20\u7edf\u7684 INT 0x2E \u4e2d\u65ad\u65b9\u5f0f\u5feb\u5f97\u591a\u3002<\/p>\n<p>syscall \u6307\u4ee4\u7684\u5de5\u4f5c\u539f\u7406&#xff1a;<\/p>\n<li>CPU \u5c06\u5f53\u524d RIP \u4fdd\u5b58\u5230 RCX \u5bc4\u5b58\u5668<\/li>\n<li>CPU \u5c06\u5f53\u524d RFLAGS \u4fdd\u5b58\u5230 R11 \u5bc4\u5b58\u5668<\/li>\n<li>CPU \u4ece IA32_LSTAR MSR \u52a0\u8f7d\u65b0\u7684 RIP&#xff08;\u5185\u6838\u5165\u53e3\u5730\u5740&#xff09;<\/li>\n<li>CPU \u4ece IA32_STAR MSR \u52a0\u8f7d\u65b0\u7684 CS \u548c SS \u6bb5\u9009\u62e9\u5b50<\/li>\n<li>CPU \u6e05\u9664 RFLAGS \u4e2d\u7684\u67d0\u4e9b\u4f4d&#xff08;\u5982 IF \u4e2d\u65ad\u6807\u5fd7&#xff09;<\/li>\n<li>CPU \u5f00\u59cb\u6267\u884c\u5185\u6838\u5165\u53e3\u4ee3\u7801<\/li>\n<h4>7.3 ntdll.dll \u4e2d NtCreateFile \u7684\u6c47\u7f16\u5b9e\u73b0<\/h4>\n<p>ntdll.dll \u4e2d\u7684 NtCreateFile \u51fd\u6570\u5b9e\u9645\u4e0a\u975e\u5e38\u7b80\u77ed\u2014\u2014\u5b83\u53ea\u662f syscall \u6307\u4ee4\u7684\u5305\u88c5\u5668\u3002\u4ee5\u4e0b\u662f x64 Windows 10 \u4e0a NtCreateFile \u7684\u53cd\u6c47\u7f16&#xff1a;<\/p>\n<p>; ntdll.dll!NtCreateFile (x64, Windows 10\/11)<br \/>\n; \u8fd9\u662f\u7528\u6237\u6001\u4fa7\u7684\u5b9e\u73b0, \u4f4d\u4e8e ntdll.dll \u7684 .text \u6bb5<\/p>\n<p>; \u51fd\u6570\u7b7e\u540d (\u6765\u81ea wdm.h):<br \/>\n; NTSTATUS NtCreateFile(<br \/>\n;     OUT PHANDLE             FileHandle,      \/\/ RCX<br \/>\n;     IN ACCESS_MASK          DesiredAccess,   \/\/ RDX<br \/>\n;     IN POBJECT_ATTRIBUTES   ObjectAttributes,\/\/ R8<br \/>\n;     OUT PIO_STATUS_BLOCK    IoStatusBlock,   \/\/ R9<br \/>\n;     IN PLARGE_INTEGER       AllocationSize,  \/\/ [RSP&#043;0x28]<br \/>\n;     IN ULONG                FileAttributes,  \/\/ [RSP&#043;0x30]<br \/>\n;     IN ULONG                ShareAccess,     \/\/ [RSP&#043;0x38]<br \/>\n;     IN ULONG                CreateDisposition,\/\/ [RSP&#043;0x40]<br \/>\n;     IN ULONG                CreateOptions,   \/\/ [RSP&#043;0x48]<br \/>\n;     IN PVOID                EaBuffer,        \/\/ [RSP&#043;0x50]<br \/>\n;     IN ULONG                EaLength         \/\/ [RSP&#043;0x58]<br \/>\n; );<\/p>\n<p>; x64 \u8c03\u7528\u7ea6\u5b9a: \u524d4\u4e2a\u53c2\u6570\u5728 RCX, RDX, R8, R9, \u5176\u4f59\u5728\u6808\u4e0a<\/p>\n<p>ntdll_NtCreateFile:<br \/>\n    ; Windows 10\/11 x64 \u4e0a, syscall\u53f7\u901a\u8fc7 EAX \u4f20\u9012<br \/>\n    ; NtCreateFile \u7684 syscall \u53f7\u56e0 Windows \u7248\u672c\u800c\u5f02<br \/>\n    ; Windows 10 1809: 0x55<br \/>\n    ; Windows 10 1903: 0x55<br \/>\n    ; Windows 10 2004: 0x55<br \/>\n    ; Windows 11 21H2: 0x55 (\u53ef\u80fd\u6709\u53d8\u5316, \u5b9e\u9645\u503c\u9700\u67e5\u8868)<br \/>\n    ; \u6ce8\u610f: syscall \u53f7\u5728\u4e0d\u540c\u7248\u672c\u95f4\u53ef\u80fd\u4e0d\u540c!<\/p>\n<p>    mov     r10, rcx            ; \u5c06\u7b2c\u4e00\u4e2a\u53c2\u6570(FileHandle\u6307\u9488)\u4fdd\u5b58\u5230 R10<br \/>\n                                ; \u56e0\u4e3a syscall \u4f1a\u8986\u76d6 RCX (\u4fdd\u5b58\u8fd4\u56de\u5730\u5740)<\/p>\n<p>    mov     eax, 55h            ; syscall\u53f7 &#061; 0x55 (NtCreateFile)<br \/>\n                                ; \u653e\u5165 EAX, \u5185\u6838\u901a\u8fc7\u6b64\u503c\u67e5\u627e SSDT<\/p>\n<p>    syscall                     ; \u6267\u884c\u7cfb\u7edf\u8c03\u7528!<br \/>\n                                ; CPU \u81ea\u52a8:<br \/>\n                                ;   RCX \u2190 RIP (\u8fd4\u56de\u5730\u5740)<br \/>\n                                ;   R11 \u2190 RFLAGS (\u6807\u5fd7\u5bc4\u5b58\u5668)<br \/>\n                                ;   RIP \u2190 IA32_LSTAR MSR (\u5185\u6838\u5165\u53e3)<br \/>\n                                ;   CS \u2190 IA32_STAR[47:32] | 0 (\u5185\u6838CS)<br \/>\n                                ;   SS \u2190 IA32_STAR[47:32] &#043; 8 (\u5185\u6838SS)<br \/>\n                                ; \u7279\u6743\u7ea7: Ring 3 \u2192 Ring 0<\/p>\n<p>    ; &#8212; syscall \u8fd4\u56de\u540e\u7ee7\u7eed\u6267\u884c &#8212;<\/p>\n<p>    ret                         ; \u8fd4\u56de\u5230\u8c03\u7528\u8005 (kernelbase.dll)<\/p>\n<p>\u6240\u6709 ntdll.dll \u4e2d\u7684 Nt* \u51fd\u6570\u90fd\u9075\u5faa\u76f8\u540c\u7684\u6a21\u5f0f&#xff0c;\u53ea\u662f syscall \u53f7\u4e0d\u540c&#xff1a;<\/p>\n<p>; \u901a\u7528\u6a21\u5f0f (\u6240\u6709 Nt* \u51fd\u6570):<br \/>\nNtXxx:<br \/>\n    mov     r10, rcx        ; \u4fdd\u5b58\u7b2c\u4e00\u4e2a\u53c2\u6570<br \/>\n    mov     eax, &lt;syscall_number&gt;  ; \u52a0\u8f7d syscall \u53f7<br \/>\n    syscall                 ; \u8fdb\u5165\u5185\u6838<br \/>\n    ret                     ; \u8fd4\u56de<\/p>\n<p>; \u51e0\u4e2a\u5e38\u89c1\u7cfb\u7edf\u8c03\u7528\u7684 syscall \u53f7 (Windows 10 2004 x64, \u793a\u4f8b\u503c):<br \/>\n; NtCreateFile       &#061; 0x55<br \/>\n; NtReadFile         &#061; 0x06<br \/>\n; NtWriteFile        &#061; 0x07<br \/>\n; NtClose            &#061; 0x0F<br \/>\n; NtCreateProcess    &#061; 0x4E  (\u5b9e\u9645\u503c\u53ef\u80fd\u4e0d\u540c)<br \/>\n; NtAllocateVirtualMemory &#061; 0x16<br \/>\n; NtQueryInformationProcess &#061; 0x19<br \/>\n; NtSetInformationFile &#061; 0x27<br \/>\n; NtDeviceIoControlFile &#061; 0x07<\/p>\n<h4>7.4 syscall \u6307\u4ee4\u6267\u884c\u6b65\u9aa4\u8be6\u89e3<\/h4>\n<p>     \u5185\u6838\u5165\u53e3<\/p>\n<p>     (KiSystemCallStart)<\/p>\n<p>     MSR\u5bc4\u5b58\u5668<\/p>\n<p>     CPU\u786c\u4ef6<\/p>\n<p>     \u7528\u6237\u6001\u4ee3\u7801<\/p>\n<p>     (ntdll.dll)<\/p>\n<p>      \u5185\u6838\u5165\u53e3<\/p>\n<p>      (KiSystemCallStart)<\/p>\n<p>      MSR\u5bc4\u5b58\u5668<\/p>\n<p>      CPU\u786c\u4ef6<\/p>\n<p>      \u7528\u6237\u6001\u4ee3\u7801<\/p>\n<p>      (ntdll.dll)<\/p>\n<p>  #mermaid-svg-2j7CUbKDEoox05OM{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-2j7CUbKDEoox05OM .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-2j7CUbKDEoox05OM .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-2j7CUbKDEoox05OM .error-icon{fill:#552222;}#mermaid-svg-2j7CUbKDEoox05OM .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-2j7CUbKDEoox05OM .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-2j7CUbKDEoox05OM .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-2j7CUbKDEoox05OM .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-2j7CUbKDEoox05OM .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-2j7CUbKDEoox05OM .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-2j7CUbKDEoox05OM .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-2j7CUbKDEoox05OM .marker{fill:#333333;stroke:#333333;}#mermaid-svg-2j7CUbKDEoox05OM .marker.cross{stroke:#333333;}#mermaid-svg-2j7CUbKDEoox05OM svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-2j7CUbKDEoox05OM p{margin:0;}#mermaid-svg-2j7CUbKDEoox05OM .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-2j7CUbKDEoox05OM text.actor&gt;tspan{fill:black;stroke:none;}#mermaid-svg-2j7CUbKDEoox05OM .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-2j7CUbKDEoox05OM .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-2j7CUbKDEoox05OM .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-2j7CUbKDEoox05OM .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-2j7CUbKDEoox05OM #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-2j7CUbKDEoox05OM .sequenceNumber{fill:white;}#mermaid-svg-2j7CUbKDEoox05OM #sequencenumber{fill:#333;}#mermaid-svg-2j7CUbKDEoox05OM #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-2j7CUbKDEoox05OM .messageText{fill:#333;stroke:none;}#mermaid-svg-2j7CUbKDEoox05OM .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-2j7CUbKDEoox05OM .labelText,#mermaid-svg-2j7CUbKDEoox05OM .labelText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-2j7CUbKDEoox05OM .loopText,#mermaid-svg-2j7CUbKDEoox05OM .loopText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-2j7CUbKDEoox05OM .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-2j7CUbKDEoox05OM .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-2j7CUbKDEoox05OM .noteText,#mermaid-svg-2j7CUbKDEoox05OM .noteText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-2j7CUbKDEoox05OM .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-2j7CUbKDEoox05OM .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-2j7CUbKDEoox05OM .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-2j7CUbKDEoox05OM .actorPopupMenu{position:absolute;}#mermaid-svg-2j7CUbKDEoox05OM .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 \/ 0.4));}#mermaid-svg-2j7CUbKDEoox05OM .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-2j7CUbKDEoox05OM .actor-man circle,#mermaid-svg-2j7CUbKDEoox05OM line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-2j7CUbKDEoox05OM :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>     \u51c6\u5907\u53c2\u6570<\/p>\n<p>     \u6267\u884c syscall \u6307\u4ee4<\/p>\n<p>     CPU \u786c\u4ef6\u81ea\u52a8\u5b8c\u6210\u4ee5\u4e0b\u64cd\u4f5c<\/p>\n<p>     \u7279\u6743\u7ea7\u5207\u6362\u5b8c\u6210: Ring 3 \u2192 Ring 0<\/p>\n<p>     \u6267\u884c\u5185\u6838\u64cd\u4f5c&#8230;<\/p>\n<p>     CPU \u786c\u4ef6\u81ea\u52a8\u5b8c\u6210\u4ee5\u4e0b\u64cd\u4f5c<\/p>\n<p>     \u7279\u6743\u7ea7\u5207\u6362\u5b8c\u6210: Ring 0 \u2192 Ring 3<\/p>\n<p>   mov r10, rcx (\u4fdd\u5b58\u53c2\u65701)<\/p>\n<p>   mov eax, 55h (syscall\u53f7)<\/p>\n<p>   \u6267\u884c syscall \u6307\u4ee4<\/p>\n<p>   1. \u4fdd\u5b58\u8fd4\u56de\u5730\u5740: RCX \u2190 \u5f53\u524dRIP<\/p>\n<p>   2. \u4fdd\u5b58\u6807\u5fd7: R11 \u2190 RFLAGS<\/p>\n<p>   3. \u6e05\u9664RFLAGS\u4e2d\u7684IF (\u5173\u4e2d\u65ad)<\/p>\n<p>   4. \u8bfb\u53d6 IA32_LSTAR (0xC0000082)<\/p>\n<p>   \u8fd4\u56de KiSystemCallStart \u5730\u5740<\/p>\n<p>   5. \u8bfb\u53d6 IA32_STAR (0xC0000081)<\/p>\n<p>   \u8fd4\u56de\u6bb5\u9009\u62e9\u5b50<\/p>\n<p>   6. CS \u2190 STAR[47:32] | RPL&#061;0<\/p>\n<p>   (\u5185\u6838\u4ee3\u7801\u6bb5, Ring 0)<\/p>\n<p>   7. SS \u2190 STAR[47:32] &#043; 8<\/p>\n<p>   (\u5185\u6838\u6570\u636e\u6bb5, Ring 0)<\/p>\n<p>   8. RIP \u2190 KiSystemCallStart<\/p>\n<p>   \u5f00\u59cb\u6267\u884c\u5185\u6838\u4ee3\u7801<\/p>\n<p>   9. \u5207\u6362\u5230\u5185\u6838\u6808<\/p>\n<p>   (\u4ece TSS \u8bfb\u53d6 RSP0)<\/p>\n<p>   10. \u4fdd\u5b58\u7528\u6237\u6001\u6808\u6307\u9488<\/p>\n<p>   (\u7528\u6237SS:RSP \u4fdd\u5b58\u5230\u5185\u6838\u6808)<\/p>\n<p>   11. \u4fdd\u5b58\u7528\u6237\u6001\u4e0a\u4e0b\u6587<\/p>\n<p>   (RCX&#061;\u8fd4\u56de\u5730\u5740, R11&#061;\u6807\u5fd7)<\/p>\n<p>   12. \u6839\u636e EAX \u67e5\u627e SSDT<\/p>\n<p>   13. \u8c03\u7528 NtCreateFile \u5185\u6838\u5b9e\u73b0<\/p>\n<p>   14. \u6062\u590d\u7528\u6237\u6001\u4e0a\u4e0b\u6587<\/p>\n<p>   15. \u6267\u884c sysret \u6307\u4ee4\u8fd4\u56de<\/p>\n<p>   16. RIP \u2190 RCX (\u7528\u6237\u6001\u8fd4\u56de\u5730\u5740)<\/p>\n<p>   17. RFLAGS \u2190 R11 (\u7528\u6237\u6001\u6807\u5fd7)<\/p>\n<p>   18. CS \u2190 STAR[63:48] | RPL&#061;3<\/p>\n<p>   (\u7528\u6237\u4ee3\u7801\u6bb5, Ring 3)<\/p>\n<p>   19. SS \u2190 STAR[63:48] &#043; 8<\/p>\n<p>   (\u7528\u6237\u6570\u636e\u6bb5, Ring 3)<\/p>\n<p>   \u8fd4\u56de\u5230 ntdll.dll \u7684 ret \u6307\u4ee4<\/p>\n<h4>7.5 \u5bc4\u5b58\u5668\u4f7f\u7528\u7ea6\u5b9a<\/h4>\n<p>syscall \u7a7f\u900f\u65f6&#xff0c;\u5bc4\u5b58\u5668\u7684\u4f7f\u7528\u6709\u4e25\u683c\u7ea6\u5b9a&#xff1a;<\/p>\n<table>\n<tr>\u5bc4\u5b58\u5668\u7528\u6237\u6001\u2192\u5185\u6838\u6001\u5185\u6838\u6001\u2192\u7528\u6237\u6001\u7528\u9014<\/tr>\n<tbody>\n<tr>\n<td>RAX<\/td>\n<td>syscall\u53f7<\/td>\n<td>\u8fd4\u56de\u503c(NTSTATUS)<\/td>\n<td>\u7cfb\u7edf\u8c03\u7528\u53f7\/\u8fd4\u56de\u503c<\/td>\n<\/tr>\n<tr>\n<td>RCX<\/td>\n<td>\u88ab\u8986\u76d6(\u4fdd\u5b58RIP)<\/td>\n<td>\u4e0d\u4f7f\u7528<\/td>\n<td>CPU\u81ea\u52a8\u4fdd\u5b58\u8fd4\u56de\u5730\u5740<\/td>\n<\/tr>\n<tr>\n<td>R10<\/td>\n<td>\u7b2c1\u4e2a\u53c2\u6570(\u539fRCX)<\/td>\n<td>\u4e0d\u4f7f\u7528<\/td>\n<td>\u4fdd\u5b58\u88ab\u8986\u76d6\u7684RCX<\/td>\n<\/tr>\n<tr>\n<td>R11<\/td>\n<td>\u88ab\u8986\u76d6(\u4fdd\u5b58RFLAGS)<\/td>\n<td>\u4e0d\u4f7f\u7528<\/td>\n<td>CPU\u81ea\u52a8\u4fdd\u5b58\u6807\u5fd7<\/td>\n<\/tr>\n<tr>\n<td>RDX<\/td>\n<td>\u7b2c2\u4e2a\u53c2\u6570<\/td>\n<td>\u4e0d\u4f7f\u7528<\/td>\n<td>\u53c2\u6570\u4f20\u9012<\/td>\n<\/tr>\n<tr>\n<td>R8<\/td>\n<td>\u7b2c3\u4e2a\u53c2\u6570<\/td>\n<td>\u4e0d\u4f7f\u7528<\/td>\n<td>\u53c2\u6570\u4f20\u9012<\/td>\n<\/tr>\n<tr>\n<td>R9<\/td>\n<td>\u7b2c4\u4e2a\u53c2\u6570<\/td>\n<td>\u4e0d\u4f7f\u7528<\/td>\n<td>\u53c2\u6570\u4f20\u9012<\/td>\n<\/tr>\n<tr>\n<td>RSP<\/td>\n<td>\u5207\u6362\u5230\u5185\u6838\u6808<\/td>\n<td>\u6062\u590d\u7528\u6237\u6808<\/td>\n<td>\u6808\u6307\u9488<\/td>\n<\/tr>\n<tr>\n<td>RIP<\/td>\n<td>\u8df3\u8f6c\u5230\u5185\u6838\u5165\u53e3<\/td>\n<td>\u8fd4\u56de\u7528\u6237\u4ee3\u7801<\/td>\n<td>\u6307\u4ee4\u6307\u9488<\/td>\n<\/tr>\n<tr>\n<td>CS\/SS<\/td>\n<td>\u5207\u6362\u5230Ring 0\u6bb5<\/td>\n<td>\u5207\u6362\u5230Ring 3\u6bb5<\/td>\n<td>\u6bb5\u9009\u62e9\u5b50<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u6ce8\u610f&#xff1a;syscall \u6307\u4ee4\u4e0d\u81ea\u52a8\u5207\u6362\u6808\u2014\u2014\u5185\u6838\u5165\u53e3\u4ee3\u7801\u9700\u8981\u624b\u52a8\u4ece TSS&#xff08;Task State Segment&#xff09;\u8bfb\u53d6 RSP0&#xff08;\u5185\u6838\u6808\u6307\u9488&#xff09;\u5e76\u5207\u6362\u3002<\/p>\n<h4>7.6 SSDT \u67e5\u627e\u8fc7\u7a0b<\/h4>\n<p>\u5185\u6838\u901a\u8fc7 SSDT&#xff08;System Service Descriptor Table&#xff0c;\u7cfb\u7edf\u670d\u52a1\u63cf\u8ff0\u7b26\u8868&#xff09;\u5c06 syscall \u53f7\u6620\u5c04\u5230\u5bf9\u5e94\u7684\u5185\u6838\u51fd\u6570\u5730\u5740\u3002<\/p>\n<p><span class=\"token comment\">\/\/ SSDT \u7ed3\u6784\u5b9a\u4e49 (\u6765\u81ea ntddk.h \u5185\u90e8, \u975e\u516c\u5f00):<\/span><\/p>\n<p><span class=\"token keyword\">typedef<\/span> <span class=\"token keyword\">struct<\/span> <span class=\"token class-name\">_KSYSTEM_SERVICE_TABLE<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    PULONG ServiceTableBase<span class=\"token punctuation\">;<\/span>     <span class=\"token comment\">\/\/ \u670d\u52a1\u51fd\u6570\u5730\u5740\u8868\u57fa\u5740<\/span><br \/>\n    PULONG ServiceCounterTableBase<span class=\"token punctuation\">;<\/span> <span class=\"token comment\">\/\/ \u670d\u52a1\u8ba1\u6570\u5668\u8868(\u7528\u4e8e\u6027\u80fd\u7edf\u8ba1)<\/span><br \/>\n    ULONG  NumberOfServices<span class=\"token punctuation\">;<\/span>     <span class=\"token comment\">\/\/ \u670d\u52a1\u6570\u91cf<\/span><br \/>\n    PUCHAR ParamTableBase<span class=\"token punctuation\">;<\/span>       <span class=\"token comment\">\/\/ \u53c2\u6570\u5b57\u8282\u6570\u8868(\u6bcf\u4e2a\u7cfb\u7edf\u8c03\u7528\u7684\u53c2\u6570\u5927\u5c0f)<\/span><br \/>\n<span class=\"token punctuation\">}<\/span> KSYSTEM_SERVICE_TABLE<span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token comment\">\/\/ SSDT \u662f\u4e00\u4e2a\u5305\u542b4\u4e2a KSYSTEM_SERVICE_TABLE \u7684\u6570\u7ec4:<\/span><br \/>\n<span class=\"token comment\">\/\/ KeServiceDescriptorTable[0] \u2014 NT \u7cfb\u7edf\u670d\u52a1 (Nt* \u51fd\u6570)<\/span><br \/>\n<span class=\"token comment\">\/\/ KeServiceDescriptorTable[1] \u2014 Win32k \u7cfb\u7edf\u670d\u52a1 (NtUser*\/NtGdi* \u51fd\u6570)<\/span><br \/>\n<span class=\"token comment\">\/\/ KeServiceDescriptorTable[2] \u2014 \u672a\u4f7f\u7528 (\u9884\u7559)<\/span><br \/>\n<span class=\"token comment\">\/\/ KeServiceDescriptorTable[3] \u2014 \u672a\u4f7f\u7528 (\u9884\u7559)<\/span><\/p>\n<p><span class=\"token comment\">\/\/ \u5168\u5c40\u53d8\u91cf:<\/span><br \/>\nKSYSTEM_SERVICE_TABLE KeServiceDescriptorTable<span class=\"token punctuation\">[<\/span><span class=\"token number\">4<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>SSDT \u67e5\u627e\u8fc7\u7a0b&#xff1a;<\/p>\n<p>; \u5185\u6838\u4e2d syscall \u53f7\u5230\u51fd\u6570\u5730\u5740\u7684\u67e5\u627e\u8fc7\u7a0b (x64)<br \/>\n; \u5047\u8bbe EAX &#061; 0x55 (NtCreateFile \u7684 syscall \u53f7)<\/p>\n<p>; 1. \u9009\u62e9 SSDT \u8868<br \/>\n;    syscall\u53f7\u7684\u9ad8\u4f4d\u51b3\u5b9a\u4f7f\u7528\u54ea\u4e2a\u8868:<br \/>\n;    bits 11:0  &#061; \u670d\u52a1\u7d22\u5f15(\u8868\u5185\u504f\u79fb)<br \/>\n;    bits 12:12 &#061; \u8868\u9009\u62e9 (0&#061;NT, 1&#061;Win32k)<br \/>\n;    \u5bf9\u4e8e NtCreateFile, \u8868\u9009\u62e9 &#061; 0<\/p>\n<p>; 2. \u4ece KeServiceDescriptorTable[0] \u83b7\u53d6 ServiceTableBase<br \/>\n;    \u5728 x64 \u4e0a, ServiceTableBase \u5b58\u50a8\u7684\u4e0d\u662f\u7edd\u5bf9\u5730\u5740, \u800c\u662f\u76f8\u5bf9\u504f\u79fb<\/p>\n<p>; 3. \u8ba1\u7b97\u51fd\u6570\u5730\u5740:<br \/>\n;    index &#061; eax &amp; 0xFFF          ; \u670d\u52a1\u7d22\u5f15 &#061; 0x055<br \/>\n;    offset &#061; ServiceTableBase[index]  ; \u8bfb\u53d632\u4f4d\u76f8\u5bf9\u504f\u79fb<br \/>\n;    func_addr &#061; ServiceTableBase &#043; (LONG)offset  ; \u7b26\u53f7\u6269\u5c55\u540e\u76f8\u52a0<\/p>\n<p>; \u5177\u4f53\u6c47\u7f16 (KiSystemService \u4e2d\u7684\u4e00\u90e8\u5206):<br \/>\n    mov     r10, rcx              ; \u4fdd\u5b58\u7528\u6237\u8fd4\u56de\u5730\u5740<br \/>\n    mov     edi, eax              ; \u4fdd\u5b58 syscall \u53f7<br \/>\n    shr     edi, 12               ; \u63d0\u53d6\u8868\u9009\u62e9\u4f4d<br \/>\n    and     edi, 1                ; 0 \u6216 1<br \/>\n    mov     r11, KeServiceDescriptorTable  ; \u52a0\u8f7d SSDT \u57fa\u5740<br \/>\n    mov     r11, [r11 &#043; rdi * 0x10] ; \u9009\u62e9\u6b63\u786e\u7684\u8868<br \/>\n    mov     edi, eax              ; \u91cd\u65b0\u52a0\u8f7d syscall \u53f7<br \/>\n    and     edi, 0xFFF            ; \u63d0\u53d6\u670d\u52a1\u7d22\u5f15<br \/>\n    mov     r10, [r11 &#043; rdi * 4]  ; \u8bfb\u53d632\u4f4d\u504f\u79fb(\u76f8\u5bf9ServiceTableBase)<br \/>\n    movsxd  r10, r10d             ; \u7b26\u53f7\u6269\u5c55\u523064\u4f4d<br \/>\n    add     r10, r11              ; \u8ba1\u7b97\u7edd\u5bf9\u5730\u5740: ServiceTableBase &#043; offset<br \/>\n    ; \u73b0\u5728 R10 &#061; \u5185\u6838\u51fd\u6570 NtCreateFile \u7684\u5730\u5740<br \/>\n    ; \u63a5\u4e0b\u6765\u8c03\u7528\u8be5\u51fd\u6570&#8230;<\/p>\n<h4>7.7 SSDT \u4e0e\u7cfb\u7edf\u8c03\u7528\u53f7\u8868<\/h4>\n<p>  #mermaid-svg-5K5iNTioJWIN6LIF{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-5K5iNTioJWIN6LIF .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-5K5iNTioJWIN6LIF .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-5K5iNTioJWIN6LIF .error-icon{fill:#552222;}#mermaid-svg-5K5iNTioJWIN6LIF .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-5K5iNTioJWIN6LIF .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-5K5iNTioJWIN6LIF .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-5K5iNTioJWIN6LIF .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-5K5iNTioJWIN6LIF .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-5K5iNTioJWIN6LIF .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-5K5iNTioJWIN6LIF .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-5K5iNTioJWIN6LIF .marker{fill:#333333;stroke:#333333;}#mermaid-svg-5K5iNTioJWIN6LIF .marker.cross{stroke:#333333;}#mermaid-svg-5K5iNTioJWIN6LIF svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-5K5iNTioJWIN6LIF p{margin:0;}#mermaid-svg-5K5iNTioJWIN6LIF .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-5K5iNTioJWIN6LIF .cluster-label text{fill:#333;}#mermaid-svg-5K5iNTioJWIN6LIF .cluster-label span{color:#333;}#mermaid-svg-5K5iNTioJWIN6LIF .cluster-label span p{background-color:transparent;}#mermaid-svg-5K5iNTioJWIN6LIF .label text,#mermaid-svg-5K5iNTioJWIN6LIF span{fill:#333;color:#333;}#mermaid-svg-5K5iNTioJWIN6LIF .node rect,#mermaid-svg-5K5iNTioJWIN6LIF .node circle,#mermaid-svg-5K5iNTioJWIN6LIF .node ellipse,#mermaid-svg-5K5iNTioJWIN6LIF .node polygon,#mermaid-svg-5K5iNTioJWIN6LIF .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-5K5iNTioJWIN6LIF .rough-node .label text,#mermaid-svg-5K5iNTioJWIN6LIF .node .label text,#mermaid-svg-5K5iNTioJWIN6LIF .image-shape .label,#mermaid-svg-5K5iNTioJWIN6LIF .icon-shape .label{text-anchor:middle;}#mermaid-svg-5K5iNTioJWIN6LIF .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-5K5iNTioJWIN6LIF .rough-node .label,#mermaid-svg-5K5iNTioJWIN6LIF .node .label,#mermaid-svg-5K5iNTioJWIN6LIF .image-shape .label,#mermaid-svg-5K5iNTioJWIN6LIF .icon-shape .label{text-align:center;}#mermaid-svg-5K5iNTioJWIN6LIF .node.clickable{cursor:pointer;}#mermaid-svg-5K5iNTioJWIN6LIF .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-5K5iNTioJWIN6LIF .arrowheadPath{fill:#333333;}#mermaid-svg-5K5iNTioJWIN6LIF .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-5K5iNTioJWIN6LIF .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-5K5iNTioJWIN6LIF .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-5K5iNTioJWIN6LIF .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-5K5iNTioJWIN6LIF .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-5K5iNTioJWIN6LIF .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-5K5iNTioJWIN6LIF .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-5K5iNTioJWIN6LIF .cluster text{fill:#333;}#mermaid-svg-5K5iNTioJWIN6LIF .cluster span{color:#333;}#mermaid-svg-5K5iNTioJWIN6LIF div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-5K5iNTioJWIN6LIF .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-5K5iNTioJWIN6LIF rect.text{fill:none;stroke-width:0;}#mermaid-svg-5K5iNTioJWIN6LIF .icon-shape,#mermaid-svg-5K5iNTioJWIN6LIF .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-5K5iNTioJWIN6LIF .icon-shape p,#mermaid-svg-5K5iNTioJWIN6LIF .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-5K5iNTioJWIN6LIF .icon-shape .label rect,#mermaid-svg-5K5iNTioJWIN6LIF .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-5K5iNTioJWIN6LIF .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-5K5iNTioJWIN6LIF .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-5K5iNTioJWIN6LIF :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u5185\u6838\u6001 (Ring 0)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u7279\u6743\u7ea7\u8fb9\u754c<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u7528\u6237\u6001 (Ring 3)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>SSDT (KeServiceDescriptorTable)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>ServiceTableBase[0]<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>syscall\u6307\u4ee4<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u76f8\u5bf9\u504f\u79fb\u8ba1\u7b97<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>eax&#061;0x55, \u67e5SSDT<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>index&#061;0x55<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/p>\n<p>\u53c2\u6570\u5927\u5c0f<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>ParamTableBase[0]<\/p>\n<p><\/span><\/p>\n<p>           <span class=\"nodeLabel\"><\/p>\n<p>[85] &#061; 0x48(11\u4e2a\u53c2\u6570 \u00d7 ~8\u5b57\u8282 &#061; \u7ea688\u5b57\u8282)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>ntdll.dllNtCreateFile<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>mov r10, rcxmov eax, 0x55syscall<\/p>\n<p><\/span><\/p>\n<p>         <span style=\"--darkreader-inline-color: var(--darkreader-text-ffffff, #e8e6e3)\" class=\"nodeLabel\"><\/p>\n<p>syscall \u6307\u4ee4Ring 3 \u2192 Ring 0CPU\u786c\u4ef6\u6267\u884c<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>KiSystemCallStart\u5185\u6838\u5165\u53e3<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>KSYSTEM_SERVICE_TABLE[0](NT\u7cfb\u7edf\u670d\u52a1)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>KSYSTEM_SERVICE_TABLE[1](Win32k\u7cfb\u7edf\u670d\u52a1)<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>[0] \u2192 NtAccessCheck<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>[6] \u2192 NtReadFile<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>[7] \u2192 NtWriteFile<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>[15] \u2192 NtClose<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>[22] \u2192 NtAllocateVirtualMemory<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>[85] \u2192 NtCreateFile<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>&#8230; \u5176\u4ed6 &#8230;<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>NtCreateFile \u5185\u6838\u5b9e\u73b0(ntoskrnl.exe)<\/p>\n<p><\/span><\/p>\n<h4>7.8 \u53c2\u6570\u63a2\u6d4b&#xff08;Parameter Probing&#xff09;<\/h4>\n<p>\u5185\u6838\u4e0d\u80fd\u4fe1\u4efb\u7528\u6237\u6001\u4f20\u5165\u7684\u6307\u9488\u2014\u2014\u7528\u6237\u6001\u53ef\u80fd\u4f20\u5165\u65e0\u6548\u6216\u6076\u610f\u6307\u9488\u3002\u56e0\u6b64\u5185\u6838\u5728\u8bbf\u95ee\u7528\u6237\u6001\u53c2\u6570\u524d\u5fc5\u987b\u8fdb\u884c&#034;\u63a2\u6d4b&#034;&#xff08;Probe&#xff09;\u3002<\/p>\n<p><span class=\"token comment\">\/\/ \u5185\u6838\u4e2d NtCreateFile \u7684\u53c2\u6570\u63a2\u6d4b (\u6982\u5ff5\u6027)<\/span><\/p>\n<p>NTSTATUS <span class=\"token function\">NtCreateFile<\/span><span class=\"token punctuation\">(<\/span><br \/>\n    OUT PHANDLE FileHandle<span class=\"token punctuation\">,<\/span>           <span class=\"token comment\">\/\/ \u7528\u6237\u6001\u6307\u9488, \u9700\u8981\u63a2\u6d4b<\/span><br \/>\n    IN ACCESS_MASK DesiredAccess<span class=\"token punctuation\">,<\/span>     <span class=\"token comment\">\/\/ \u503c\u7c7b\u578b, \u4e0d\u9700\u8981\u63a2\u6d4b<\/span><br \/>\n    IN POBJECT_ATTRIBUTES ObjectAttributes<span class=\"token punctuation\">,<\/span> <span class=\"token comment\">\/\/ \u7528\u6237\u6001\u6307\u9488, \u9700\u8981\u63a2\u6d4b<\/span><br \/>\n    OUT PIO_STATUS_BLOCK IoStatusBlock<span class=\"token punctuation\">,<\/span>     <span class=\"token comment\">\/\/ \u7528\u6237\u6001\u6307\u9488, \u9700\u8981\u63a2\u6d4b<\/span><br \/>\n    IN PLARGE_INTEGER AllocationSize<span class=\"token punctuation\">,<\/span>       <span class=\"token comment\">\/\/ \u7528\u6237\u6001\u6307\u9488(\u53ef\u9009), \u9700\u8981\u63a2\u6d4b<\/span><br \/>\n    IN ULONG FileAttributes<span class=\"token punctuation\">,<\/span>          <span class=\"token comment\">\/\/ \u503c\u7c7b\u578b<\/span><br \/>\n    IN ULONG ShareAccess<span class=\"token punctuation\">,<\/span>             <span class=\"token comment\">\/\/ \u503c\u7c7b\u578b<\/span><br \/>\n    IN ULONG CreateDisposition<span class=\"token punctuation\">,<\/span>       <span class=\"token comment\">\/\/ \u503c\u7c7b\u578b<\/span><br \/>\n    IN ULONG CreateOptions<span class=\"token punctuation\">,<\/span>           <span class=\"token comment\">\/\/ \u503c\u7c7b\u578b<\/span><br \/>\n    IN PVOID EaBuffer<span class=\"token punctuation\">,<\/span>                <span class=\"token comment\">\/\/ \u7528\u6237\u6001\u6307\u9488(\u53ef\u9009), \u9700\u8981\u63a2\u6d4b<\/span><br \/>\n    IN ULONG EaLength<span class=\"token punctuation\">)<\/span>                <span class=\"token comment\">\/\/ \u503c\u7c7b\u578b<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ 1. \u63a2\u6d4b\u8f93\u51fa\u6307\u9488 (ProbeForWrite)<\/span><br \/>\n    <span class=\"token comment\">\/\/    \u786e\u4fdd\u6307\u9488\u6307\u5411\u7528\u6237\u6001\u5730\u5740\u7a7a\u95f4, \u4e14\u53ef\u5199<\/span><br \/>\n    <span class=\"token function\">ProbeForWriteHandle<\/span><span class=\"token punctuation\">(<\/span>FileHandle<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>     <span class=\"token comment\">\/\/ \u63a2\u6d4b PHANDLE<\/span><br \/>\n    <span class=\"token function\">ProbeForWriteIoStatusBlock<\/span><span class=\"token punctuation\">(<\/span>IoStatusBlock<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token comment\">\/\/ \u63a2\u6d4b PIO_STATUS_BLOCK<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 2. \u63a2\u6d4b\u8f93\u5165\u6307\u9488 (ProbeForRead)<\/span><br \/>\n    <span class=\"token comment\">\/\/    \u786e\u4fdd\u6307\u9488\u6307\u5411\u7528\u6237\u6001\u5730\u5740\u7a7a\u95f4, \u4e14\u53ef\u8bfb<\/span><br \/>\n    <span class=\"token function\">ProbeForRead<\/span><span class=\"token punctuation\">(<\/span>ObjectAttributes<span class=\"token punctuation\">,<\/span><br \/>\n                 <span class=\"token keyword\">sizeof<\/span><span class=\"token punctuation\">(<\/span>OBJECT_ATTRIBUTES<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span><br \/>\n                 <span class=\"token keyword\">sizeof<\/span><span class=\"token punctuation\">(<\/span>ULONG<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>  <span class=\"token comment\">\/\/ \u5bf9\u9f50\u8981\u6c42<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 3. \u6355\u83b7 (Capture) \u7528\u6237\u6001\u6570\u636e\u5230\u5185\u6838\u6808\/\u6c60<\/span><br \/>\n    <span class=\"token comment\">\/\/    \u56e0\u4e3a\u63a2\u6d4b\u901a\u8fc7\u540e, \u7528\u6237\u6001\u53ef\u80fd\u5728\u53e6\u4e00\u7ebf\u7a0b\u4fee\u6539\u6570\u636e(TOCTOU\u653b\u51fb)<\/span><br \/>\n    OBJECT_ATTRIBUTES capturedAttributes<span class=\"token punctuation\">;<\/span><br \/>\n    UNICODE_STRING capturedObjectName<span class=\"token punctuation\">;<\/span><br \/>\n    PVOID capturedSecurityDescriptor <span class=\"token operator\">&#061;<\/span> <span class=\"token constant\">NULL<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ \u6355\u83b7 OBJECT_ATTRIBUTES<\/span><br \/>\n    <span class=\"token function\">RtlCaptureObjectAttributes<\/span><span class=\"token punctuation\">(<\/span><br \/>\n        ObjectAttributes<span class=\"token punctuation\">,<\/span>          <span class=\"token comment\">\/\/ \u7528\u6237\u6001\u6e90<\/span><br \/>\n        <span class=\"token operator\">&amp;<\/span>capturedAttributes<span class=\"token punctuation\">,<\/span>       <span class=\"token comment\">\/\/ \u5185\u6838\u6001\u76ee\u6807<\/span><br \/>\n        <span class=\"token operator\">&amp;<\/span>capturedObjectName<span class=\"token punctuation\">,<\/span>       <span class=\"token comment\">\/\/ \u6355\u83b7\u7684\u540d\u79f0<\/span><br \/>\n        <span class=\"token operator\">&amp;<\/span>capturedSecurityDescriptor <span class=\"token comment\">\/\/ \u6355\u83b7\u7684\u5b89\u5168\u63cf\u8ff0\u7b26<\/span><br \/>\n    <span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 4. \u4e4b\u540e\u7684\u64cd\u4f5c\u4f7f\u7528\u6355\u83b7\u7684\u526f\u672c, \u4e0d\u518d\u8bbf\u95ee\u7528\u6237\u6001\u6307\u9488<\/span><br \/>\n    <span class=\"token comment\">\/\/    (\u76f4\u5230\u6700\u7ec8\u5199\u5165\u8f93\u51fa\u53c2\u6570\u65f6)<\/span><br \/>\n    <span class=\"token comment\">\/\/ &#8230;<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 5. \u64cd\u4f5c\u5b8c\u6210\u540e, \u5c06\u7ed3\u679c\u5199\u56de\u7528\u6237\u6001\u8f93\u51fa\u53c2\u6570<\/span><br \/>\n    <span class=\"token operator\">*<\/span>FileHandle <span class=\"token operator\">&#061;<\/span> hFile<span class=\"token punctuation\">;<\/span>  <span class=\"token comment\">\/\/ \u6b64\u65f6 FileHandle \u4ecd\u6307\u5411\u7528\u6237\u6001<\/span><br \/>\n    <span class=\"token operator\">*<\/span>IoStatusBlock <span class=\"token operator\">&#061;<\/span> ioStatus<span class=\"token punctuation\">;<\/span>  <span class=\"token comment\">\/\/ \u5199\u56de IO_STATUS_BLOCK<\/span><\/p>\n<p>    <span class=\"token keyword\">return<\/span> status<span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>ProbeForRead\/ProbeForWrite \u7684\u5b9e\u73b0\u539f\u7406&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ \u6982\u5ff5\u6027\u5b9e\u73b0:<\/span><br \/>\nVOID <span class=\"token function\">ProbeForRead<\/span><span class=\"token punctuation\">(<\/span><br \/>\n    IN PVOID Address<span class=\"token punctuation\">,<\/span><br \/>\n    IN SIZE_T Length<span class=\"token punctuation\">,<\/span><br \/>\n    IN ULONG Alignment<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ 1. \u68c0\u67e5\u5730\u5740\u662f\u5426\u5728\u7528\u6237\u6001\u5730\u5740\u7a7a\u95f4<\/span><br \/>\n    <span class=\"token comment\">\/\/    x64: \u7528\u6237\u6001\u5730\u5740 &lt; 0x0000_8000_0000_0000<\/span><br \/>\n    ULONG_PTR addr <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span>ULONG_PTR<span class=\"token punctuation\">)<\/span>Address<span class=\"token punctuation\">;<\/span><br \/>\n    ULONG_PTR end <span class=\"token operator\">&#061;<\/span> addr <span class=\"token operator\">&#043;<\/span> Length <span class=\"token operator\">&#8211;<\/span> <span class=\"token number\">1<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>end <span class=\"token operator\">&gt;<\/span> MmUserProbeAddress<span class=\"token punctuation\">)<\/span>  <span class=\"token comment\">\/\/ MmUserProbeAddress &#061; 0x7FFF_FFFF_FFFF<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token function\">ExRaiseAccessViolation<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>  <span class=\"token comment\">\/\/ \u89e6\u53d1\u5f02\u5e38<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 2. \u68c0\u67e5\u5bf9\u9f50<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">(<\/span>addr <span class=\"token operator\">&amp;<\/span> <span class=\"token punctuation\">(<\/span>Alignment <span class=\"token operator\">&#8211;<\/span> <span class=\"token number\">1<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token operator\">!&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token function\">ExRaiseDatatypeMisalignment<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ 3. \u5c1d\u8bd5\u8bbf\u95ee (\u89e6\u53d1\u7f3a\u9875\u65f6, \u9875\u9519\u8bef\u5904\u7406\u5668\u9a8c\u8bc1\u9875\u9762\u5c5e\u4e8e\u7528\u6237\u8fdb\u7a0b)<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u5b9e\u9645\u5b9e\u73b0\u901a\u8fc7\u9875\u8868\u68c0\u67e5, \u8fd9\u91cc\u7b80\u5316<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<h4>7.9 syscall \u7a7f\u900f\u65f6\u5e8f\u56fe<\/h4>\n<p>     \u5185\u6838 (ntoskrnl.exe)<\/p>\n<p>     CPU \u786c\u4ef6<\/p>\n<p>     \u7528\u6237\u6001 (ntdll.dll)<\/p>\n<p>      \u5185\u6838 (ntoskrnl.exe)<\/p>\n<p>      CPU \u786c\u4ef6<\/p>\n<p>      \u7528\u6237\u6001 (ntdll.dll)<\/p>\n<p>  #mermaid-svg-id7YyhKeeooCTj1r{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-id7YyhKeeooCTj1r .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-id7YyhKeeooCTj1r .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-id7YyhKeeooCTj1r .error-icon{fill:#552222;}#mermaid-svg-id7YyhKeeooCTj1r .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-id7YyhKeeooCTj1r .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-id7YyhKeeooCTj1r .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-id7YyhKeeooCTj1r .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-id7YyhKeeooCTj1r .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-id7YyhKeeooCTj1r .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-id7YyhKeeooCTj1r .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-id7YyhKeeooCTj1r .marker{fill:#333333;stroke:#333333;}#mermaid-svg-id7YyhKeeooCTj1r .marker.cross{stroke:#333333;}#mermaid-svg-id7YyhKeeooCTj1r svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-id7YyhKeeooCTj1r p{margin:0;}#mermaid-svg-id7YyhKeeooCTj1r .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-id7YyhKeeooCTj1r text.actor&gt;tspan{fill:black;stroke:none;}#mermaid-svg-id7YyhKeeooCTj1r .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-id7YyhKeeooCTj1r .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-id7YyhKeeooCTj1r .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-id7YyhKeeooCTj1r .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-id7YyhKeeooCTj1r #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-id7YyhKeeooCTj1r .sequenceNumber{fill:white;}#mermaid-svg-id7YyhKeeooCTj1r #sequencenumber{fill:#333;}#mermaid-svg-id7YyhKeeooCTj1r #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-id7YyhKeeooCTj1r .messageText{fill:#333;stroke:none;}#mermaid-svg-id7YyhKeeooCTj1r .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-id7YyhKeeooCTj1r .labelText,#mermaid-svg-id7YyhKeeooCTj1r .labelText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-id7YyhKeeooCTj1r .loopText,#mermaid-svg-id7YyhKeeooCTj1r .loopText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-id7YyhKeeooCTj1r .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-id7YyhKeeooCTj1r .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-id7YyhKeeooCTj1r .noteText,#mermaid-svg-id7YyhKeeooCTj1r .noteText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-id7YyhKeeooCTj1r .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-id7YyhKeeooCTj1r .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-id7YyhKeeooCTj1r .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-id7YyhKeeooCTj1r .actorPopupMenu{position:absolute;}#mermaid-svg-id7YyhKeeooCTj1r .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 \/ 0.4));}#mermaid-svg-id7YyhKeeooCTj1r .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-id7YyhKeeooCTj1r .actor-man circle,#mermaid-svg-id7YyhKeeooCTj1r line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-id7YyhKeeooCTj1r :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>     \u51c6\u5907 syscall<\/p>\n<p>     &#061;&#061;&#061; syscall \u6307\u4ee4\u6267\u884c &#061;&#061;&#061;<\/p>\n<p>     CPU \u786c\u4ef6\u64cd\u4f5c (\u4e0d\u53ef\u4e2d\u65ad)<\/p>\n<p>     CPU \u8df3\u8f6c\u5230\u5185\u6838\u5165\u53e3<\/p>\n<p>     \u5185\u6838\u5165\u53e3\u5904\u7406<\/p>\n<p>     SSDT \u67e5\u627e<\/p>\n<p>     \u53c2\u6570\u63a2\u6d4b<\/p>\n<p>     \u6267\u884c\u5185\u6838\u51fd\u6570<\/p>\n<p>     \u8fd4\u56de\u51c6\u5907<\/p>\n<p>     &#061;&#061;&#061; sysret \u6307\u4ee4\u6267\u884c &#061;&#061;&#061;<\/p>\n<p>     CPU \u786c\u4ef6\u64cd\u4f5c<\/p>\n<p>     CPU \u8fd4\u56de\u7528\u6237\u6001<\/p>\n<p>   mov r10, rcx (\u4fdd\u5b58\u53c2\u65701)<\/p>\n<p>   mov eax, 0x55 (NtCreateFile\u53f7)<\/p>\n<p>   syscall<\/p>\n<p>   RCX \u2190 RIP (\u4fdd\u5b58\u8fd4\u56de\u5730\u5740)<\/p>\n<p>   R11 \u2190 RFLAGS (\u4fdd\u5b58\u6807\u5fd7)<\/p>\n<p>   \u4ece MSR IA32_LSTAR \u52a0\u8f7d\u65b0 RIP<\/p>\n<p>   \u4ece MSR IA32_STAR \u52a0\u8f7d CS\/SS (Ring 0)<\/p>\n<p>   \u6e05\u9664 RFLAGS.IF (\u5173\u4e2d\u65ad)<\/p>\n<p>   CPL: 3 \u2192 0 (\u7279\u6743\u7ea7\u5207\u6362)<\/p>\n<p>   \u6267\u884c KiSystemCallStart<\/p>\n<p>   \u4ece TSS \u8bfb\u53d6 RSP0 (\u5185\u6838\u6808\u6307\u9488)<\/p>\n<p>   \u5207\u6362\u5230\u5185\u6838\u6808 (RSP \u2190 RSP0)<\/p>\n<p>   \u4fdd\u5b58\u7528\u6237\u6001 SS:RSP \u5230\u5185\u6838\u6808<\/p>\n<p>   \u4fdd\u5b58\u7528\u6237\u6001\u4e0a\u4e0b\u6587 (RCX, R11 \u7b49)<\/p>\n<p>   eax&#061;0x55 \u2192 SSDT[0] \u7b2c85\u9879<\/p>\n<p>   \u8bfb\u53d6\u76f8\u5bf9\u504f\u79fb, \u8ba1\u7b97\u7edd\u5bf9\u5730\u5740<\/p>\n<p>   \u83b7\u53d6 NtCreateFile \u5185\u6838\u51fd\u6570\u5730\u5740<\/p>\n<p>   ProbeForWrite(FileHandle)<\/p>\n<p>   ProbeForWrite(IoStatusBlock)<\/p>\n<p>   ProbeForRead(ObjectAttributes)<\/p>\n<p>   \u6355\u83b7\u7528\u6237\u6001\u53c2\u6570\u5230\u5185\u6838\u7a7a\u95f4<\/p>\n<p>   \u8c03\u7528 NtCreateFile \u5185\u6838\u5b9e\u73b0<\/p>\n<p>   (\u5b89\u5168\u68c0\u67e5\/\u5bf9\u8c61\u521b\u5efa\/IRP\u53d1\u9001&#8230;)<\/p>\n<p>   \u5c06\u7ed3\u679c\u5199\u5165\u7528\u6237\u6001\u8f93\u51fa\u53c2\u6570<\/p>\n<p>   RAX \u2190 NTSTATUS (\u8fd4\u56de\u503c)<\/p>\n<p>   \u6062\u590d\u7528\u6237\u6001\u4e0a\u4e0b\u6587<\/p>\n<p>   sysret<\/p>\n<p>   RIP \u2190 RCX (\u6062\u590d\u8fd4\u56de\u5730\u5740)<\/p>\n<p>   RFLAGS \u2190 R11 (\u6062\u590d\u6807\u5fd7)<\/p>\n<p>   \u4ece IA32_STAR \u52a0\u8f7d CS\/SS (Ring 3)<\/p>\n<p>   CPL: 0 \u2192 3 (\u7279\u6743\u7ea7\u5207\u6362)<\/p>\n<p>   \u7ee7\u7eed\u6267\u884c ntdll.dll \u4e2d\u7684 ret \u6307\u4ee4<\/p>\n<p>   RAX &#061; NTSTATUS, \u8fd4\u56de\u8c03\u7528\u8005<\/p>\n<h4>7.10 syscall \u53f7\u7684\u7248\u672c\u5dee\u5f02<\/h4>\n<p>syscall \u53f7\u5728\u4e0d\u540c Windows \u7248\u672c\u95f4\u53ef\u80fd\u4e0d\u540c\u3002\u8fd9\u662f\u5b89\u5168\u8f6f\u4ef6&#xff08;\u5982 EDR\u3001\u6740\u6bd2\u8f6f\u4ef6&#xff09;\u9700\u8981\u6301\u7eed\u66f4\u65b0\u7684\u539f\u56e0\u4e4b\u4e00\u3002\u4ee5\u4e0b\u662f\u4e00\u4e9b\u793a\u4f8b\u503c&#xff08;\u4ec5\u4f9b\u53c2\u8003&#xff0c;\u5b9e\u9645\u503c\u4ee5\u7cfb\u7edf\u4e3a\u51c6&#xff09;&#xff1a;<\/p>\n<p><span class=\"token comment\">\/\/ Windows 10 1607 (Build 14393) x64:<\/span><br \/>\n<span class=\"token macro property\"><span class=\"token directive-hash\">#<\/span><span class=\"token directive keyword\">define<\/span> <span class=\"token macro-name\">NtCreateFile_index<\/span>              <span class=\"token expression\"><span class=\"token number\">0x55<\/span><\/span><\/span><br \/>\n<span class=\"token macro property\"><span class=\"token directive-hash\">#<\/span><span class=\"token directive keyword\">define<\/span> <span class=\"token macro-name\">NtReadFile_index<\/span>                <span class=\"token expression\"><span class=\"token number\">0x06<\/span><\/span><\/span><br \/>\n<span class=\"token macro property\"><span class=\"token directive-hash\">#<\/span><span class=\"token directive keyword\">define<\/span> <span class=\"token macro-name\">NtWriteFile_index<\/span>               <span class=\"token expression\"><span class=\"token number\">0x07<\/span><\/span><\/span><br \/>\n<span class=\"token macro property\"><span class=\"token directive-hash\">#<\/span><span class=\"token directive keyword\">define<\/span> <span class=\"token macro-name\">NtClose_index<\/span>                   <span class=\"token expression\"><span class=\"token number\">0x0F<\/span><\/span><\/span><\/p>\n<p><span class=\"token comment\">\/\/ Windows 10 1809 (Build 17763) x64:<\/span><br \/>\n<span class=\"token macro property\"><span class=\"token directive-hash\">#<\/span><span class=\"token directive keyword\">define<\/span> <span class=\"token macro-name\">NtCreateFile_index<\/span>              <span class=\"token expression\"><span class=\"token number\">0x55<\/span><\/span><\/span><br \/>\n<span class=\"token macro property\"><span class=\"token directive-hash\">#<\/span><span class=\"token directive keyword\">define<\/span> <span class=\"token macro-name\">NtReadFile_index<\/span>                <span class=\"token expression\"><span class=\"token number\">0x06<\/span><\/span><\/span><br \/>\n<span class=\"token macro property\"><span class=\"token directive-hash\">#<\/span><span class=\"token directive keyword\">define<\/span> <span class=\"token macro-name\">NtWriteFile_index<\/span>               <span class=\"token expression\"><span class=\"token number\">0x07<\/span><\/span><\/span><br \/>\n<span class=\"token macro property\"><span class=\"token directive-hash\">#<\/span><span class=\"token directive keyword\">define<\/span> <span class=\"token macro-name\">NtClose_index<\/span>                   <span class=\"token expression\"><span class=\"token number\">0x0F<\/span><\/span><\/span><\/p>\n<p><span class=\"token comment\">\/\/ Windows 11 22H2 (Build 22621) x64:<\/span><br \/>\n<span class=\"token comment\">\/\/ (syscall\u53f7\u53ef\u80fd\u56e0\u65b0\u589e\u7cfb\u7edf\u8c03\u7528\u800c\u53d8\u5316)<\/span><br \/>\n<span class=\"token comment\">\/\/ \u9700\u8981\u901a\u8fc7 ntdll.dll \u5bfc\u51fa\u8868\u52a8\u6001\u83b7\u53d6<\/span><\/p>\n<p>\u7531\u4e8e syscall \u53f7\u4e0d\u7a33\u5b9a&#xff0c;\u7528\u6237\u6001\u7a0b\u5e8f\u4e0d\u5e94\u786c\u7f16\u7801 syscall \u53f7\u2014\u2014\u5e94\u8be5\u901a\u8fc7 ntdll.dll \u7684\u5bfc\u51fa\u8868\u52a8\u6001\u83b7\u53d6\u3002\u8fd9\u4e5f\u662f\u4e3a\u4ec0\u4e48 Nt* \u51fd\u6570\u5fc5\u987b\u901a\u8fc7 ntdll.dll \u8c03\u7528&#xff0c;\u800c\u4e0d\u662f\u76f4\u63a5 syscall\u3002<\/p>\n<h4>7.11 \u672c\u5c42\u7a7f\u900f\u603b\u7ed3<\/h4>\n<p>NT API \u5230 syscall \u7684\u7a7f\u900f\u662f\u6574\u4e2a\u5173\u7cfb\u94fe\u4e2d\u6700\u5173\u952e\u7684\u8fb9\u754c\u7a7f\u8d8a\u2014\u2014\u4ece\u7528\u6237\u6001\u5230\u5185\u6838\u6001\u7684\u7279\u6743\u7ea7\u5207\u6362\u3002\u8fd9\u5c42\u7a7f\u900f\u7684\u5173\u952e\u8981\u70b9&#xff1a;<\/p>\n<ul>\n<li>syscall \u6307\u4ee4\u662f x64 \u4e0a\u7684\u5feb\u901f\u7cfb\u7edf\u8c03\u7528\u673a\u5236&#xff0c;\u7531 CPU \u786c\u4ef6\u6267\u884c\u7279\u6743\u7ea7\u5207\u6362<\/li>\n<li>ntdll.dll \u4e2d\u7684 Nt* \u51fd\u6570\u53ea\u662f syscall \u7684\u5305\u88c5\u5668&#xff1a;mov r10,rcx; mov eax,\u53f7; syscall; ret<\/li>\n<li>\u5185\u6838\u901a\u8fc7 SSDT \u5c06 syscall \u53f7\u6620\u5c04\u5230\u5185\u6838\u51fd\u6570\u5730\u5740<\/li>\n<li>\u5185\u6838\u5fc5\u987b\u5bf9\u7528\u6237\u6001\u6307\u9488\u8fdb\u884c\u63a2\u6d4b&#xff08;Probe&#xff09;&#xff0c;\u9632\u6b62\u6076\u610f\u5730\u5740<\/li>\n<li>\u53c2\u6570\u9700\u8981\u4ece\u7528\u6237\u6001\u6355\u83b7&#xff08;Capture&#xff09;\u5230\u5185\u6838\u7a7a\u95f4&#xff0c;\u9632\u6b62 TOCTOU \u653b\u51fb<\/li>\n<li>syscall \u53f7\u5728\u4e0d\u540c Windows \u7248\u672c\u95f4\u53ef\u80fd\u4e0d\u540c<\/li>\n<\/ul>\n<hr \/>\n","protected":false},"excerpt":{"rendered":"<p>\/* MD \/ \u5bcc\u6587\u672c\u4e2d\u7684 .toc\uff08\u542b\u535a\u5ba2\u56ed\u642c\u5bb6\u7b49\u5d4c\u5957\u7ed3\u6784\uff09\uff1b.toc-box \u5728\u4fa7\u680f\uff0c\u4e0d\u53d7\u5f71\u54cd *\/#content_views .toc,\/* \u7f16\u8f91\u5668\u5e38\u5728\u76ee\u5f55\u524d\u540e\u63d2\u5165\u7a7a p\uff08:empty \u4ecd\u5360 20px\uff09\uff0c\u4e00\u5e76\u53bb\u6389\u907f\u514d\u9876\u7a7a\u9699 *\/#content_views.markdown_views &gt; p:empty:has(+ .toc),#content_views.markdown_views &gt; .toc + p:empty,\/* \u5bcc\u6587\u672c\u65e7\u7248\u76ee\u5f55\u6807\u8bb0 *\/#content<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[13993,13992,13991,13990,149],"topic":[],"class_list":["post-122333","post","type-post","status-publish","format-standard","hentry","category-server","tag-13993","tag-13992","tag-13991","tag-13990","tag-windows"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>01-06 Windows \u8f6f\u4ef6\u4f53\u7cfb - \u7eb5\u5411\u5173\u7cfb\u94fe\u7a7f\u900f\u673a\u5236\u4ece\u5e94\u7528\u5230\u786c\u4ef6\uff08\u4e0a\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/122333.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"01-06 Windows \u8f6f\u4ef6\u4f53\u7cfb - \u7eb5\u5411\u5173\u7cfb\u94fe\u7a7f\u900f\u673a\u5236\u4ece\u5e94\u7528\u5230\u786c\u4ef6\uff08\u4e0a\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\/* MD \/ \u5bcc\u6587\u672c\u4e2d\u7684 .toc\uff08\u542b\u535a\u5ba2\u56ed\u642c\u5bb6\u7b49\u5d4c\u5957\u7ed3\u6784\uff09\uff1b.toc-box \u5728\u4fa7\u680f\uff0c\u4e0d\u53d7\u5f71\u54cd *\/#content_views .toc,\/* \u7f16\u8f91\u5668\u5e38\u5728\u76ee\u5f55\u524d\u540e\u63d2\u5165\u7a7a p\uff08:empty \u4ecd\u5360 20px\uff09\uff0c\u4e00\u5e76\u53bb\u6389\u907f\u514d\u9876\u7a7a\u9699 *\/#content_views.markdown_views &gt; p:empty:has(+ .toc),#content_views.markdown_views &gt; .toc + p:empty,\/* \u5bcc\u6587\u672c\u65e7\u7248\u76ee\u5f55\u6807\u8bb0 *\/#content\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/122333.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-04T10:24:41+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"57 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/122333.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/122333.html\",\"name\":\"01-06 Windows \u8f6f\u4ef6\u4f53\u7cfb - \u7eb5\u5411\u5173\u7cfb\u94fe\u7a7f\u900f\u673a\u5236\u4ece\u5e94\u7528\u5230\u786c\u4ef6\uff08\u4e0a\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-11-04T10:24:41+00:00\",\"dateModified\":\"2026-11-04T10:24:41+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/122333.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/122333.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/122333.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"01-06 Windows \u8f6f\u4ef6\u4f53\u7cfb - \u7eb5\u5411\u5173\u7cfb\u94fe\u7a7f\u900f\u673a\u5236\u4ece\u5e94\u7528\u5230\u786c\u4ef6\uff08\u4e0a\uff09\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"01-06 Windows \u8f6f\u4ef6\u4f53\u7cfb - \u7eb5\u5411\u5173\u7cfb\u94fe\u7a7f\u900f\u673a\u5236\u4ece\u5e94\u7528\u5230\u786c\u4ef6\uff08\u4e0a\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/122333.html","og_locale":"zh_CN","og_type":"article","og_title":"01-06 Windows \u8f6f\u4ef6\u4f53\u7cfb - \u7eb5\u5411\u5173\u7cfb\u94fe\u7a7f\u900f\u673a\u5236\u4ece\u5e94\u7528\u5230\u786c\u4ef6\uff08\u4e0a\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\/* MD \/ \u5bcc\u6587\u672c\u4e2d\u7684 .toc\uff08\u542b\u535a\u5ba2\u56ed\u642c\u5bb6\u7b49\u5d4c\u5957\u7ed3\u6784\uff09\uff1b.toc-box \u5728\u4fa7\u680f\uff0c\u4e0d\u53d7\u5f71\u54cd *\/#content_views .toc,\/* \u7f16\u8f91\u5668\u5e38\u5728\u76ee\u5f55\u524d\u540e\u63d2\u5165\u7a7a p\uff08:empty \u4ecd\u5360 20px\uff09\uff0c\u4e00\u5e76\u53bb\u6389\u907f\u514d\u9876\u7a7a\u9699 *\/#content_views.markdown_views &gt; p:empty:has(+ .toc),#content_views.markdown_views &gt; .toc + p:empty,\/* \u5bcc\u6587\u672c\u65e7\u7248\u76ee\u5f55\u6807\u8bb0 *\/#content","og_url":"https:\/\/www.wsisp.com\/helps\/122333.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-11-04T10:24:41+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"57 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/122333.html","url":"https:\/\/www.wsisp.com\/helps\/122333.html","name":"01-06 Windows \u8f6f\u4ef6\u4f53\u7cfb - \u7eb5\u5411\u5173\u7cfb\u94fe\u7a7f\u900f\u673a\u5236\u4ece\u5e94\u7528\u5230\u786c\u4ef6\uff08\u4e0a\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-11-04T10:24:41+00:00","dateModified":"2026-11-04T10:24:41+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/122333.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/122333.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/122333.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"01-06 Windows \u8f6f\u4ef6\u4f53\u7cfb - \u7eb5\u5411\u5173\u7cfb\u94fe\u7a7f\u900f\u673a\u5236\u4ece\u5e94\u7528\u5230\u786c\u4ef6\uff08\u4e0a\uff09"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/122333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=122333"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/122333\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=122333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=122333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=122333"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=122333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}