Dump文件数据存储格式(二)
四、系统信息流
流目录后面紧接着就是流数据了。第一个流数据就是系统信息流。
可知,这个流的起始于文件偏移0xEC,大小是0x38,也就是56个字节。
从上图可知,系统信息流就是紧挨着流目录尾部。这个流包含了如下操作系统和处理器信息:处理器架构、级别、版本,CPU信息等。数据结构如下:
typedef struct _MINIDUMP_SYSTEM_INFO { USHORT ProcessorArchitecture; USHORT ProcessorLevel; USHORT ProcessorRevision; union { USHORT Reserved0; struct { UCHAR NumberOfProcessors; UCHAR ProductType; }; }; ULONG32 MajorVersion; ULONG32 MinorVersion; ULONG32 BuildNumber; ULONG32 PlatformId; RVA CSDVersionRva; union { ULONG32 Reserved1; struct { USHORT SuiteMask; USHORT Reserved2; }; }; CPU_INFORMATION Cpu; } MINIDUMP_SYSTEM_INFO, *PMINIDUMP_SYSTEM_INFO;
ProcessorArchitecture
系统的处理器架构。此成员可以是以下值之一。Value Meaning - PROCESSOR_ARCHITECTURE_AMD64
- 9
x64 (AMD or Intel) - PROCESSOR_ARCHITECTURE_ARM
- 5
ARM - PROCESSOR_ARCHITECTURE_IA64
- 6
Intel Itanium - PROCESSOR_ARCHITECTURE_INTEL
- 0
x86 - PROCESSOR_ARCHITECTURE_UNKNOWN
- 0xffff
Unknown processor ProcessorLevel
系统依赖于架构的处理器级别。如果ProcessorArchitecture 是 PROCESSOR_ARCHITECTURE_IA64, ProcessorLevel 的值是1。如果ProcessorArchitecture 是 PROCESSOR_ARCHITECTURE_INTEL, ProcessorLevel 可以是取如下值:
Value Meaning - 3
Intel 80386 - 4
Intel 80486 - 5
Intel Pentium - 6
Intel Pentium Pro or Pentium II ProcessorRevision
依赖架构的处理器版本。Processor Value Intel 80386 or 80486 A value of the form xxyz. If xx is equal to 0xFF, y - 0xA is the model number, and z is the stepping identifier. For example, an Intel 80486-D0 system returns 0xFFD0.
If xx is not equal to 0xFF, xx + 'A' is the stepping letter and yz is the minor stepping.
Intel Pentium, Cyrix, or NextGen 586 A value of the form xxyy, where xx is the model number and yy is the stepping. Display this value of 0x0201 as follows: Model xx, Stepping yy
Reserved0
此成员保留供将来使用,并且必须为零。NumberOfProcessors
系统中处理器的数量。ProductType
有关系统的任何其他信息。此成员可以是以下值之一。Value Meaning - VER_NT_DOMAIN_CONTROLLER
- 0x0000002
The system is a domain controller. - VER_NT_SERVER
- 0x0000003
The system is a server. - VER_NT_WORKSTATION
- 0x0000001
The system is running Windows XP, Windows Vista, Windows 7, or Windows 8. MajorVersion
操作系统的主要版本号。此成员可以是4、5或6。MinorVersion
操作系统的次要版本号。BuildNumber
操作系统的内部版本号。PlatformId
操作系统平台。此成员可以是以下值之一。Value Meaning - VER_PLATFORM_WIN32s
- 0
Not supported - VER_PLATFORM_WIN32_WINDOWS
- 1
Not supported. - VER_PLATFORM_WIN32_NT
- 2
The operating system platform is Windows. CSDVersionRva
MINIDUMP_STRING RVA,该字符串描述系统上安装的最新Service Pack。如果未安装Service Pack,则字符串为空。Reserved1
此成员保留供将来使用SuiteMask
标识系统上可用的产品套件的位标志。此成员可以是以下值的组合。Value Meaning - VER_SUITE_BACKOFFICE
- 0x00000004
Microsoft BackOffice components are installed. - VER_SUITE_BLADE
- 0x00000400
Windows Server 2003, Web Edition is installed. - VER_SUITE_COMPUTE_SERVER
- 0x00004000
Windows Server 2003, Compute Cluster Edition is installed. - VER_SUITE_DATACENTER
- 0x00000080
Windows Server 2008 R2 Datacenter, Windows Server 2008 Datacenter, or Windows Server 2003, Datacenter Edition is installed. - VER_SUITE_ENTERPRISE
- 0x00000002
Windows Server 2008 R2 Enterprise, Windows Server 2008 Enterprise, or Windows Server 2003, Enterprise Edition is installed. - VER_SUITE_EMBEDDEDNT
- 0x00000040
Windows Embedded is installed. - VER_SUITE_PERSONAL
- 0x00000200
Windows XP Home Edition is installed. - VER_SUITE_SINGLEUSERTS
- 0x00000100
Remote Desktop is supported, but only one interactive session is supported. This value is set unless the system is running in application server mode. - VER_SUITE_SMALLBUSINESS
- 0x00000001
Microsoft Small Business Server was once installed on the system, but may have been upgraded to another version of Windows. - VER_SUITE_SMALLBUSINESS_RESTRICTED
- 0x00000020
Microsoft Small Business Server is installed with the restrictive client license in force. - VER_SUITE_STORAGE_SERVER
- 0x00002000
Windows Storage Server is installed. - VER_SUITE_TERMINAL
- 0x00000010
Terminal Services is installed. This value is always set. If VER_SUITE_TERMINAL is set but VER_SUITE_SINGLEUSERTS is not set, the system is running in application server mode.
Reserved2
此成员保留供将来使用
Cpu
CPU相关信息,CPU_INFORMATION
union是数据组织形式。下面详细说明
CPU_INFORMATION成员如下:
union { struct X86CpuInfo { ULONG32 VendorID[3]; ULONG32 VersionInformation; ULONG32 FeatureInformation; ULONG32 AMDExtendedCpuFeatures }; struct OtherCpuInfo { ULONG64 ProcesssorFeatures[2] }; }
X86CpuInfo
从CPUID指令获得的CPU信息。只有x86计算机支持此结构。
-
VendorId
CPUID子函数0。数组元素如下 -
ersionInformation
CPUID子功能1。EAX的值。 -
FeatureInformation
CPUID子功能1。EDX的值。 -
AMDExtendedCpuFeatures
CPUID子功能80000001。EBX值。仅当供应商为“AuthenticAMD”时才支持此成员。
OtherCpuInfo
其他CPU信息。只有非x86计算机才支持此结构。
-
ProcessorFeatures
它的值参考 IsProcessorFeaturePresent function.
从上面的数据结构成员意思,我们可以得出,这个dmp文件的产生的系统信息如下:x86架构的奔5及以上级别windows平台,8核CPU。
用windbg加载看看
为虫子生,为虫子死,为虫子奋斗一辈子