Difference between revisions of "Kernel"
Eighthpence (talk | contribs) (Created page with "== See Also == Hard Drive Files") |
m (Mention that some keys are depending on running XBE (details need to be documented)) |
||
(22 intermediate revisions by 4 users not shown) | |||
Line 1: | Line 1: | ||
− | + | The Xbox kernel is called xboxkrnl.exe. It is closely related to the Windows NT [[Wikipedia:Ntoskrnl.exe|ntoskrnl.exe]]. | |
+ | Its image base address is always 0x80010000. | ||
− | [[ | + | == Header modifications == |
+ | |||
+ | xboxkrnl.exe is a mostly standard exe file. | ||
+ | However, the MS-DOS header was patched to contain Xbox specific data in the reserved 20 byte block starting at offset 40: | ||
+ | |||
+ | {| class=wikitable | ||
+ | ! Offset !! Meaning | ||
+ | |- | ||
+ | |40 || Size of uninitialized portion of the .data section | ||
+ | |- | ||
+ | |44 || Size of initialized portion of the .data section | ||
+ | |- | ||
+ | |48 || Memory address of initialized portion of the .data section (usually in [[Flash]]). <br> Used to re-initialize the data section pointed to by the next field. <br> Note that the pointer might be invalid during normal execution as the Flash might not be mapped at all times. | ||
+ | |- | ||
+ | |52 || Memory address where the .data section is stored (usually the same as in the section header + image base). | ||
+ | |} | ||
+ | |||
+ | == Sections == | ||
+ | |||
+ | All sections are identity mapped (meaning file offsets and offsets in RAM match). This is because the kernel is not loaded through a traditional PE / exe loader, but just unpacked into memory. | ||
+ | |||
+ | === .text === | ||
+ | |||
+ | The .text section contains the kernel exports. | ||
+ | |||
+ | === .data === | ||
+ | |||
+ | The .data section stores initialized and uninitialized data. | ||
+ | A copy of the initialized portion of this section is usually stored in the [[BIOS]]. | ||
+ | |||
+ | === STICKY === | ||
+ | |||
+ | Stores variables which must be preserved across a quick-reboot. | ||
+ | |||
+ | === IDEXPRDT === | ||
+ | |||
+ | A Physical Region Descriptor Table (PRDT) for the IDE bus. This section serves as a memory allocation only, it does not have to be initialized when loading the kernel{{citation needed}}. | ||
+ | |||
+ | === INIT === | ||
+ | |||
+ | This section is always the last one. It contains the entrypoint of the kernel. | ||
+ | This does all the cold-boot kernel initialization as described [[Boot_Process#Initialization|here]]. | ||
+ | Later kernels{{FIXME|reason=Which revision? right now it appears that *ALL* kernels will discard this}} will discard this section after initialization. | ||
+ | INIT also contains the [[Boot Animation]], so once the kernel has finished booting it can't do a full hardware re-initialization or play the boot animation anymore. | ||
+ | |||
+ | == Kernel exports == | ||
+ | {| class="wikitable" | ||
+ | |+Kernel exports | ||
+ | |- | ||
+ | !Name | ||
+ | !Ordinal | ||
+ | !x86 Calling Convention | ||
+ | !Notes | ||
+ | |- | ||
+ | |[[Kernel/AvGetSavedDataAddress]] | ||
+ | |1 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/AvSendTVEncoderOption]] | ||
+ | |2 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/AvSetDisplayMode]] | ||
+ | |3 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/AvSetSavedDataAddress]] | ||
+ | |4 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/DbgBreakPoint]] | ||
+ | |5 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/DbgBreakPointWithStatus]] | ||
+ | |6 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/DbgLoadImageSymbols]] | ||
+ | |7 | ||
+ | |stdcall | ||
+ | |Devkits only! | ||
+ | |- | ||
+ | |[[Kernel/DbgPrint]] | ||
+ | |8 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalReadSMCTrayState]] | ||
+ | |9 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/DbgPrompt]] | ||
+ | |10 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/DbgUnLoadImageSymbols]] | ||
+ | |11 | ||
+ | |stdcall | ||
+ | |Devkits only! | ||
+ | |- | ||
+ | |[[Kernel/ExAcquireReadWriteLockExclusive]] | ||
+ | |12 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExAcquireReadWriteLockShared]] | ||
+ | |13 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExAllocatePool]] | ||
+ | |14 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExAllocatePoolWithTag]] | ||
+ | |15 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExEventObjectType]] | ||
+ | |16 | ||
+ | | | ||
+ | |Variable: OBJECT_TYPE | ||
+ | |- | ||
+ | |[[Kernel/ExFreePool]] | ||
+ | |17 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExInitializeReadWriteLock]] | ||
+ | |18 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExInterlockedAddLargeInteger]] | ||
+ | |19 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExInterlockedAddLargeStatistic]] | ||
+ | |20 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExInterlockedCompareExchange64]] | ||
+ | |21 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExMutantObjectType]] | ||
+ | |22 | ||
+ | | | ||
+ | |Variable: OBJECT_TYPE | ||
+ | |- | ||
+ | |[[Kernel/ExQueryPoolBlockSize]] | ||
+ | |23 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExQueryNonVolatileSetting]] | ||
+ | |24 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExReadWriteRefurbInfo]] | ||
+ | |25 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExRaiseException]] | ||
+ | |26 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExRaiseStatus]] | ||
+ | |27 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExReleaseReadWriteLock]] | ||
+ | |28 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExSaveNonVolatileSetting]] | ||
+ | |29 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExSemaphoreObjectType]] | ||
+ | |30 | ||
+ | | | ||
+ | |Variable: OBJECT_TYPE | ||
+ | |- | ||
+ | |[[Kernel/ExTimerObjectType]] | ||
+ | |31 | ||
+ | | | ||
+ | |Variable: OBJECT_TYPE | ||
+ | |- | ||
+ | |[[Kernel/ExfInterlockedInsertHeadList]] | ||
+ | |32 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExfInterlockedInsertTailList]] | ||
+ | |33 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ExfInterlockedRemoveHeadList]] | ||
+ | |34 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/FscGetCacheSize]] | ||
+ | |35 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/FscInvalidateIdleBlocks]] | ||
+ | |36 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/FscSetCacheSize]] | ||
+ | |37 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalClearSoftwareInterrupt]] | ||
+ | |38 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalDisableSystemInterrupt]] | ||
+ | |39 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalDiskCachePartitionCount]] | ||
+ | |40 | ||
+ | | | ||
+ | |Variable: ULONG | ||
+ | |- | ||
+ | |[[Kernel/HalDiskModelNumber]] | ||
+ | |41 | ||
+ | | | ||
+ | |Variable: STRING | ||
+ | |- | ||
+ | |[[Kernel/HalDiskSerialNumber]] | ||
+ | |42 | ||
+ | | | ||
+ | |Variable: STRING | ||
+ | |- | ||
+ | |[[Kernel/HalEnableSystemInterrupt]] | ||
+ | |43 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalGetInterruptVector]] | ||
+ | |44 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalReadSMBusValue]] | ||
+ | |45 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalReadWritePCISpace]] | ||
+ | |46 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalRegisterShutdownNotification]] | ||
+ | |47 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalRequestSoftwareInterrupt]] | ||
+ | |48 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalReturnToFirmware]] | ||
+ | |49 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalWriteSMBusValue]] | ||
+ | |50 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/InterlockedCompareExchange]] | ||
+ | |51 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/InterlockedDecrement]] | ||
+ | |52 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/InterlockedIncrement]] | ||
+ | |53 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/InterlockedExchange]] | ||
+ | |54 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/InterlockedExchangeAdd]] | ||
+ | |55 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/InterlockedFlushSList]] | ||
+ | |56 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/InterlockedPopEntrySList]] | ||
+ | |57 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/InterlockedPushEntrySList]] | ||
+ | |58 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoAllocateIrp]] | ||
+ | |59 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoBuildAsynchronousFsdRequest]] | ||
+ | |60 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoBuildDeviceIoControlRequest]] | ||
+ | |61 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoBuildSynchronousFsdRequest]] | ||
+ | |62 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoCheckShareAccess]] | ||
+ | |63 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoCompletionObjectType]] | ||
+ | |64 | ||
+ | | | ||
+ | |Variable: OBJECT_TYPE | ||
+ | |- | ||
+ | |[[Kernel/IoCreateDevice]] | ||
+ | |65 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoCreateFile]] | ||
+ | |66 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoCreateSymbolicLink]] | ||
+ | |67 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoDeleteDevice]] | ||
+ | |68 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoDeleteSymbolicLink]] | ||
+ | |69 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoDeviceObjectType]] | ||
+ | |70 | ||
+ | | | ||
+ | |Variable: OBJECT_TYPE | ||
+ | |- | ||
+ | |[[Kernel/IoFileObjectType]] | ||
+ | |71 | ||
+ | | | ||
+ | |Variable: OBJECT_TYPE | ||
+ | |- | ||
+ | |[[Kernel/IoFreeIrp]] | ||
+ | |72 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoInitializeIrp]] | ||
+ | |73 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoInvalidDeviceRequest]] | ||
+ | |74 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoQueryFileInformation]] | ||
+ | |75 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoQueryVolumeInformation]] | ||
+ | |76 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoQueueThreadIrp]] | ||
+ | |77 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoRemoveShareAccess]] | ||
+ | |78 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoSetIoCompletion]] | ||
+ | |79 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoSetShareAccess]] | ||
+ | |80 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoStartNextPacket]] | ||
+ | |81 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoStartNextPacketByKey]] | ||
+ | |82 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoStartPacket]] | ||
+ | |83 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoSynchronousDeviceIoControlRequest]] | ||
+ | |84 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoSynchronousFsdRequest]] | ||
+ | |85 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IofCallDriver]] | ||
+ | |86 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IofCompleteRequest]] | ||
+ | |87 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KdDebuggerEnabled]] | ||
+ | |88 | ||
+ | | | ||
+ | |Variable: BOOLEAN | ||
+ | |- | ||
+ | |[[Kernel/KdDebuggerNotPresent]] | ||
+ | |89 | ||
+ | | | ||
+ | |Variable: BOOLEAN | ||
+ | |- | ||
+ | |[[Kernel/IoDismountVolume]] | ||
+ | |90 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoDismountVolumeByName]] | ||
+ | |91 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeAlertResumeThread]] | ||
+ | |92 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeAlertThread]] | ||
+ | |93 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeBoostPriorityThread]] | ||
+ | |94 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeBugCheck]] | ||
+ | |95 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeBugCheckEx]] | ||
+ | |96 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeCancelTimer]] | ||
+ | |97 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeConnectInterrupt]] | ||
+ | |98 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeDelayExecutionThread]] | ||
+ | |99 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeDisconnectInterrupt]] | ||
+ | |100 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeEnterCriticalRegion]] | ||
+ | |101 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmGlobalData]] | ||
+ | |102 | ||
+ | | | ||
+ | |Variable: MMGLOBALDATA | ||
+ | |- | ||
+ | |[[Kernel/KeGetCurrentIrql]] | ||
+ | |103 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeGetCurrentThread]] | ||
+ | |104 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInitializeApc]] | ||
+ | |105 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInitializeDeviceQueue]] | ||
+ | |106 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInitializeDpc]] | ||
+ | |107 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInitializeEvent]] | ||
+ | |108 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInitializeInterrupt]] | ||
+ | |109 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInitializeMutant]] | ||
+ | |110 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInitializeQueue]] | ||
+ | |111 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInitializeSemaphore]] | ||
+ | |112 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInitializeTimerEx]] | ||
+ | |113 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInsertByKeyDeviceQueue]] | ||
+ | |114 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInsertDeviceQueue]] | ||
+ | |115 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInsertHeadQueue]] | ||
+ | |116 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInsertQueue]] | ||
+ | |117 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInsertQueueApc]] | ||
+ | |118 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInsertQueueDpc]] | ||
+ | |119 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeInterruptTime]] | ||
+ | |120 | ||
+ | | | ||
+ | |Variable: KSYSTEM_TIME | ||
+ | |- | ||
+ | |[[Kernel/KeIsExecutingDpc]] | ||
+ | |121 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeLeaveCriticalRegion]] | ||
+ | |122 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KePulseEvent]] | ||
+ | |123 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeQueryBasePriorityThread]] | ||
+ | |124 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeQueryInterruptTime]] | ||
+ | |125 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeQueryPerformanceCounter]] | ||
+ | |126 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeQueryPerformanceFrequency]] | ||
+ | |127 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeQuerySystemTime]] | ||
+ | |128 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeRaiseIrqlToDpcLevel]] | ||
+ | |129 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeRaiseIrqlToSynchLevel]] | ||
+ | |130 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeReleaseMutant]] | ||
+ | |131 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeReleaseSemaphore]] | ||
+ | |132 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeRemoveByKeyDeviceQueue]] | ||
+ | |133 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeRemoveDeviceQueue]] | ||
+ | |134 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeRemoveEntryDeviceQueue]] | ||
+ | |135 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeRemoveQueue]] | ||
+ | |136 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeRemoveQueueDpc]] | ||
+ | |137 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeResetEvent]] | ||
+ | |138 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeRestoreFloatingPointState]] | ||
+ | |139 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeResumeThread]] | ||
+ | |140 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeRundownQueue]] | ||
+ | |141 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeSaveFloatingPointState]] | ||
+ | |142 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeSetBasePriorityThread]] | ||
+ | |143 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeSetDisableBoostThread]] | ||
+ | |144 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeSetEvent]] | ||
+ | |145 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeSetEventBoostPriority]] | ||
+ | |146 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeSetPriorityProcess]] | ||
+ | |147 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeSetPriorityThread]] | ||
+ | |148 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeSetTimer]] | ||
+ | |149 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeSetTimerEx]] | ||
+ | |150 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeStallExecutionProcessor]] | ||
+ | |151 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeSuspendThread]] | ||
+ | |152 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeSynchronizeExecution]] | ||
+ | |153 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeSystemTime]] | ||
+ | |154 | ||
+ | | | ||
+ | |Variable: KSYSTEM_TIME | ||
+ | |- | ||
+ | |[[Kernel/KeTestAlertThread]] | ||
+ | |155 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeTickCount]] | ||
+ | |156 | ||
+ | | | ||
+ | |Variable: ULONG | ||
+ | |- | ||
+ | |[[Kernel/KeTimeIncrement]] | ||
+ | |157 | ||
+ | | | ||
+ | |Variable: ULONG | ||
+ | |- | ||
+ | |[[Kernel/KeWaitForMultipleObjects]] | ||
+ | |158 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KeWaitForSingleObject]] | ||
+ | |159 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KfRaiseIrql]] | ||
+ | |160 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KfLowerIrql]] | ||
+ | |161 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/KiBugCheckData]] | ||
+ | |162 | ||
+ | | | ||
+ | |Variable: ULONG_PTR[5] | ||
+ | |- | ||
+ | |[[Kernel/KiUnlockDispatcherDatabase]] | ||
+ | |163 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/LaunchDataPage]] | ||
+ | |164 | ||
+ | | | ||
+ | |Variable: PLAUNCH_DATA_PAGE | ||
+ | |- | ||
+ | |[[Kernel/MmAllocateContiguousMemory]] | ||
+ | |165 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmAllocateContiguousMemoryEx]] | ||
+ | |166 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmAllocateSystemMemory]] | ||
+ | |167 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmClaimGpuInstanceMemory]] | ||
+ | |168 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmCreateKernelStack]] | ||
+ | |169 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmDeleteKernelStack]] | ||
+ | |170 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmFreeContiguousMemory]] | ||
+ | |171 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmFreeSystemMemory]] | ||
+ | |172 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmGetPhysicalAddress]] | ||
+ | |173 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmIsAddressValid]] | ||
+ | |174 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmLockUnlockBufferPages]] | ||
+ | |175 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmLockUnlockPhysicalPage]] | ||
+ | |176 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmMapIoSpace]] | ||
+ | |177 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmPersistContiguousMemory]] | ||
+ | |178 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmQueryAddressProtect]] | ||
+ | |179 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmQueryAllocationSize]] | ||
+ | |180 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmQueryStatistics]] | ||
+ | |181 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmSetAddressProtect]] | ||
+ | |182 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/MmUnmapIoSpace]] | ||
+ | |183 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtAllocateVirtualMemory]] | ||
+ | |184 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtCancelTimer]] | ||
+ | |185 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtClearEvent]] | ||
+ | |186 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtClose]] | ||
+ | |187 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtCreateDirectoryObject]] | ||
+ | |188 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtCreateEvent]] | ||
+ | |189 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtCreateFile]] | ||
+ | |190 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtCreateIoCompletion]] | ||
+ | |191 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtCreateMutant]] | ||
+ | |192 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtCreateSemaphore]] | ||
+ | |193 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtCreateTimer]] | ||
+ | |194 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtDeleteFile]] | ||
+ | |195 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtDeviceIoControlFile]] | ||
+ | |196 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtDuplicateObject]] | ||
+ | |197 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtFlushBuffersFile]] | ||
+ | |198 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtFreeVirtualMemory]] | ||
+ | |199 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtFsControlFile]] | ||
+ | |200 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtOpenDirectoryObject]] | ||
+ | |201 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtOpenFile]] | ||
+ | |202 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtOpenSymbolicLinkObject]] | ||
+ | |203 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtProtectVirtualMemory]] | ||
+ | |204 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtPulseEvent]] | ||
+ | |205 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQueueApcThread]] | ||
+ | |206 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQueryDirectoryFile]] | ||
+ | |207 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQueryDirectoryObject]] | ||
+ | |208 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQueryEvent]] | ||
+ | |209 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQueryFullAttributesFile]] | ||
+ | |210 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQueryInformationFile]] | ||
+ | |211 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQueryIoCompletion]] | ||
+ | |212 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQueryMutant]] | ||
+ | |213 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQuerySemaphore]] | ||
+ | |214 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQuerySymbolicLinkObject]] | ||
+ | |215 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQueryTimer]] | ||
+ | |216 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQueryVirtualMemory]] | ||
+ | |217 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtQueryVolumeInformationFile]] | ||
+ | |218 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtReadFile]] | ||
+ | |219 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtReadFileScatter]] | ||
+ | |220 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtReleaseMutant]] | ||
+ | |221 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtReleaseSemaphore]] | ||
+ | |222 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtRemoveIoCompletion]] | ||
+ | |223 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtResumeThread]] | ||
+ | |224 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtSetEvent]] | ||
+ | |225 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtSetInformationFile]] | ||
+ | |226 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtSetIoCompletion]] | ||
+ | |227 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtSetSystemTime]] | ||
+ | |228 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtSetTimerEx]] | ||
+ | |229 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtSignalAndWaitForSingleObjectEx]] | ||
+ | |230 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtSuspendThread]] | ||
+ | |231 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtUserIoApcDispatcher]] | ||
+ | |232 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtWaitForSingleObject]] | ||
+ | |233 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtWaitForSingleObjectEx]] | ||
+ | |234 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtWaitForMultipleObjectsEx]] | ||
+ | |235 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtWriteFile]] | ||
+ | |236 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtWriteFileGather]] | ||
+ | |237 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/NtYieldExecution]] | ||
+ | |238 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ObCreateObject]] | ||
+ | |239 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ObDirectoryObjectType]] | ||
+ | |240 | ||
+ | | | ||
+ | |Variable: OBJECT_TYPE | ||
+ | |- | ||
+ | |[[Kernel/ObInsertObject]] | ||
+ | |241 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ObMakeTemporaryObject]] | ||
+ | |242 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ObOpenObjectByName]] | ||
+ | |243 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ObOpenObjectByPointer]] | ||
+ | |244 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ObpObjectHandleTable]] | ||
+ | |245 | ||
+ | | | ||
+ | |Variable: OBJECT_HANDLE_TABLE | ||
+ | |- | ||
+ | |[[Kernel/ObReferenceObjectByHandle]] | ||
+ | |246 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ObReferenceObjectByName]] | ||
+ | |247 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ObReferenceObjectByPointer]] | ||
+ | |248 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ObSymbolicLinkObjectType]] | ||
+ | |249 | ||
+ | | | ||
+ | |Variable: OBJECT_TYPE | ||
+ | |- | ||
+ | |[[Kernel/ObfDereferenceObject]] | ||
+ | |250 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/ObfReferenceObject]] | ||
+ | |251 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/PhyGetLinkState]] | ||
+ | |252 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/PhyInitialize]] | ||
+ | |253 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/PsCreateSystemThread]] | ||
+ | |254 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/PsCreateSystemThreadEx]] | ||
+ | |255 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/PsQueryStatistics]] | ||
+ | |256 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/PsSetCreateThreadNotifyRoutine]] | ||
+ | |257 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/PsTerminateSystemThread]] | ||
+ | |258 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/PsThreadObjectType]] | ||
+ | |259 | ||
+ | | | ||
+ | |Variable: OBJECT_TYPE | ||
+ | |- | ||
+ | |[[Kernel/RtlAnsiStringToUnicodeString]] | ||
+ | |260 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlAppendStringToString]] | ||
+ | |261 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlAppendUnicodeStringToString]] | ||
+ | |262 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlAppendUnicodeToString]] | ||
+ | |263 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlAssert]] | ||
+ | |264 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlCaptureContext]] | ||
+ | |265 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlCaptureStackBackTrace]] | ||
+ | |266 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlCharToInteger]] | ||
+ | |267 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlCompareMemory]] | ||
+ | |268 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlCompareMemoryUlong]] | ||
+ | |269 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlCompareString]] | ||
+ | |270 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlCompareUnicodeString]] | ||
+ | |271 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlCopyString]] | ||
+ | |272 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlCopyUnicodeString]] | ||
+ | |273 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlCreateUnicodeString]] | ||
+ | |274 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlDowncaseUnicodeChar]] | ||
+ | |275 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlDowncaseUnicodeString]] | ||
+ | |276 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlEnterCriticalSection]] | ||
+ | |277 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlEnterCriticalSectionAndRegion]] | ||
+ | |278 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlEqualString]] | ||
+ | |279 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlEqualUnicodeString]] | ||
+ | |280 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlExtendedIntegerMultiply]] | ||
+ | |281 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlExtendedLargeIntegerDivide]] | ||
+ | |282 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlExtendedMagicDivide]] | ||
+ | |283 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlFillMemory]] | ||
+ | |284 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlFillMemoryUlong]] | ||
+ | |285 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlFreeAnsiString]] | ||
+ | |286 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlFreeUnicodeString]] | ||
+ | |287 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlGetCallersAddress]] | ||
+ | |288 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlInitAnsiString]] | ||
+ | |289 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlInitUnicodeString]] | ||
+ | |290 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlInitializeCriticalSection]] | ||
+ | |291 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlIntegerToChar]] | ||
+ | |292 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlIntegerToUnicodeString]] | ||
+ | |293 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlLeaveCriticalSection]] | ||
+ | |294 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlLeaveCriticalSectionAndRegion]] | ||
+ | |295 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlLowerChar]] | ||
+ | |296 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlMapGenericMask]] | ||
+ | |297 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlMoveMemory]] | ||
+ | |298 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlMultiByteToUnicodeN]] | ||
+ | |299 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlMultiByteToUnicodeSize]] | ||
+ | |300 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlNtStatusToDosError]] | ||
+ | |301 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlRaiseException]] | ||
+ | |302 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlRaiseStatus]] | ||
+ | |303 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlTimeFieldsToTime]] | ||
+ | |304 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlTimeToTimeFields]] | ||
+ | |305 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlTryEnterCriticalSection]] | ||
+ | |306 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlUlongByteSwap]] | ||
+ | |307 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlUnicodeStringToAnsiString]] | ||
+ | |308 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlUnicodeStringToInteger]] | ||
+ | |309 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlUnicodeToMultiByteN]] | ||
+ | |310 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlUnicodeToMultiByteSize]] | ||
+ | |311 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlUnwind]] | ||
+ | |312 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlUpcaseUnicodeChar]] | ||
+ | |313 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlUpcaseUnicodeString]] | ||
+ | |314 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlUpcaseUnicodeToMultiByteN]] | ||
+ | |315 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlUpperChar]] | ||
+ | |316 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlUpperString]] | ||
+ | |317 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlUshortByteSwap]] | ||
+ | |318 | ||
+ | |fastcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlWalkFrameChain]] | ||
+ | |319 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlZeroMemory]] | ||
+ | |320 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XboxEEPROMKey]] | ||
+ | |321 | ||
+ | | | ||
+ | |Variable: XBOX_KEY_DATA | ||
+ | |- | ||
+ | |[[Kernel/XboxHardwareInfo]] | ||
+ | |322 | ||
+ | | | ||
+ | |Variable: XBOX_HARDWARE_INFO | ||
+ | |- | ||
+ | |[[Kernel/XboxHDKey]] | ||
+ | |323 | ||
+ | | | ||
+ | |Variable: XBOX_KEY_DATA | ||
+ | |- | ||
+ | |[[Kernel/XboxKrnlVersion]] | ||
+ | |324 | ||
+ | | | ||
+ | |Variable: XBOX_KRNL_VERSION | ||
+ | |- | ||
+ | |[[Kernel/XboxSignatureKey]] | ||
+ | |325 | ||
+ | | | ||
+ | |Variable: XBOX_KEY_DATA; modified by active XBE Certificate | ||
+ | |- | ||
+ | |[[Kernel/XeImageFileName]] | ||
+ | |326 | ||
+ | | | ||
+ | |Variable: OBJECT_STRING | ||
+ | |- | ||
+ | |[[Kernel/XeLoadSection]] | ||
+ | |327 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XeUnloadSection]] | ||
+ | |328 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/READ_PORT_BUFFER_UCHAR]] | ||
+ | |329 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/READ_PORT_BUFFER_USHORT]] | ||
+ | |330 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/READ_PORT_BUFFER_ULONG]] | ||
+ | |331 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/WRITE_PORT_BUFFER_UCHAR]] | ||
+ | |332 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/WRITE_PORT_BUFFER_USHORT]] | ||
+ | |333 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/WRITE_PORT_BUFFER_ULONG]] | ||
+ | |334 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcSHAInit]] | ||
+ | |335 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcSHAUpdate]] | ||
+ | |336 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcSHAFinal]] | ||
+ | |337 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcRC4Key]] | ||
+ | |338 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcRC4Crypt]] | ||
+ | |339 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcHMAC]] | ||
+ | |340 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcPKEncPublic]] | ||
+ | |341 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcPKDecPrivate]] | ||
+ | |342 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcPKGetKeyLen]] | ||
+ | |343 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcVerifyPKCS1Signature]] | ||
+ | |344 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcModExp]] | ||
+ | |345 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcDESKeyParity]] | ||
+ | |346 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcKeyTable]] | ||
+ | |347 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcBlockCrypt]] | ||
+ | |348 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcBlockCryptCBC]] | ||
+ | |349 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcCryptService]] | ||
+ | |350 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XcUpdateCrypto]] | ||
+ | |351 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlRip]] | ||
+ | |352 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/XboxLANKey]] | ||
+ | |353 | ||
+ | | | ||
+ | |Variable: XBOX_KEY_DATA; modified by active XBE Certificate | ||
+ | |- | ||
+ | |[[Kernel/XboxAlternateSignatureKeys]] | ||
+ | |354 | ||
+ | | | ||
+ | |Variable: XBOX_KEY_DATA[XBEIMAGE_ALTERNATE_TITLE_ID_COUNT]; modified by active XBE Certificate | ||
+ | |- | ||
+ | |[[Kernel/XePublicKeyData]] | ||
+ | |355 | ||
+ | | | ||
+ | |Variable: UCHAR[XC_PUBLIC_KEYDATA_SIZE] | ||
+ | |- | ||
+ | |[[Kernel/HalBootSMCVideoMode]] | ||
+ | |356 | ||
+ | | | ||
+ | |Variable: ULONG | ||
+ | |- | ||
+ | |[[Kernel/IdexChannelObject]] | ||
+ | |357 | ||
+ | | | ||
+ | |Variable: IDE_CHANNEL_OBJECT | ||
+ | |- | ||
+ | |[[Kernel/HalIsResetOrShutdownPending]] | ||
+ | |358 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/IoMarkIrpMustComplete]] | ||
+ | |359 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalInitiateShutdown]] | ||
+ | |360 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/RtlSnprintf]] | ||
+ | |361 | ||
+ | |stdcall | ||
+ | |Unused? | ||
+ | |- | ||
+ | |[[Kernel/RtlSprintf]] | ||
+ | |362 | ||
+ | |stdcall | ||
+ | |Unused? | ||
+ | |- | ||
+ | |[[Kernel/RtlVsnprintf]] | ||
+ | |363 | ||
+ | |stdcall | ||
+ | |Unused? | ||
+ | |- | ||
+ | |[[Kernel/RtlVsprintf]] | ||
+ | |364 | ||
+ | |stdcall | ||
+ | |Unused? | ||
+ | |- | ||
+ | |[[Kernel/HalEnableSecureTrayEject]] | ||
+ | |365 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | |[[Kernel/HalWriteSMCScratchRegister]] | ||
+ | |366 | ||
+ | |stdcall | ||
+ | | | ||
+ | |- | ||
+ | | | ||
+ | |367 | ||
+ | | | ||
+ | |Unused? | ||
+ | |- | ||
+ | | | ||
+ | |368 | ||
+ | | | ||
+ | |Unused? | ||
+ | |- | ||
+ | | | ||
+ | |369 | ||
+ | | | ||
+ | |Unused? | ||
+ | |- | ||
+ | |[[Kernel/XProfpControl]] | ||
+ | |370 | ||
+ | | | ||
+ | |Profiling-enabled builds only! | ||
+ | |- | ||
+ | |[[Kernel/XProfpGetData]] | ||
+ | |371 | ||
+ | | | ||
+ | |Profiling-enabled builds only! | ||
+ | |- | ||
+ | |[[Kernel/IrtClientInitFast]] | ||
+ | |372 | ||
+ | | | ||
+ | |Profiling-enabled builds only! | ||
+ | |- | ||
+ | |[[Kernel/IrtSweep]] | ||
+ | |373 | ||
+ | | | ||
+ | |Profiling-enabled builds only! | ||
+ | |- | ||
+ | |[[Kernel/MmDbgAllocateMemory]] | ||
+ | |374 | ||
+ | |stdcall | ||
+ | |Devkits only! | ||
+ | |- | ||
+ | |[[Kernel/MmDbgFreeMemory]] | ||
+ | |375 | ||
+ | |stdcall | ||
+ | |Devkits only! | ||
+ | |- | ||
+ | |[[Kernel/MmDbgQueryAvailablePages]] | ||
+ | |376 | ||
+ | |stdcall | ||
+ | |Devkits only! | ||
+ | |- | ||
+ | |[[Kernel/MmDbgReleaseAddress]] | ||
+ | |377 | ||
+ | |stdcall | ||
+ | |Devkits only! | ||
+ | |- | ||
+ | |[[Kernel/MmDbgWriteCheck]] | ||
+ | |378 | ||
+ | |stdcall | ||
+ | |Devkits only! | ||
+ | |} |
Latest revision as of 17:23, 21 October 2018
The Xbox kernel is called xboxkrnl.exe. It is closely related to the Windows NT ntoskrnl.exe. Its image base address is always 0x80010000.
Contents
Header modifications
xboxkrnl.exe is a mostly standard exe file. However, the MS-DOS header was patched to contain Xbox specific data in the reserved 20 byte block starting at offset 40:
Offset | Meaning |
---|---|
40 | Size of uninitialized portion of the .data section |
44 | Size of initialized portion of the .data section |
48 | Memory address of initialized portion of the .data section (usually in Flash). Used to re-initialize the data section pointed to by the next field. Note that the pointer might be invalid during normal execution as the Flash might not be mapped at all times. |
52 | Memory address where the .data section is stored (usually the same as in the section header + image base). |
Sections
All sections are identity mapped (meaning file offsets and offsets in RAM match). This is because the kernel is not loaded through a traditional PE / exe loader, but just unpacked into memory.
.text
The .text section contains the kernel exports.
.data
The .data section stores initialized and uninitialized data. A copy of the initialized portion of this section is usually stored in the BIOS.
STICKY
Stores variables which must be preserved across a quick-reboot.
IDEXPRDT
A Physical Region Descriptor Table (PRDT) for the IDE bus. This section serves as a memory allocation only, it does not have to be initialized when loading the kernel[citation needed].
INIT
This section is always the last one. It contains the entrypoint of the kernel. This does all the cold-boot kernel initialization as described here. Later kernels[FIXME] will discard this section after initialization. INIT also contains the Boot Animation, so once the kernel has finished booting it can't do a full hardware re-initialization or play the boot animation anymore.