從Platform Builder來看
Windows CE支持相當多CPU
但現在市場上實際銷售的PDA幾乎全部采用ARM芯片
arm是一個RISC構架的
位微處理器
它一次有
個可見的寄存器
r
r
其中r
r
是通用寄存器並可以做任何目的
r
r
也是通用寄存器
但是在切換到FIQ模式的時候
使用它們的影子(shadow)寄存器
最後這三個是特殊寄存器
r
(sp)
堆棧指針
r
(lr)
鏈接寄存器
r
(pc/psr)
程序計數器/狀態寄存器
IDAPro和調試器裡都是用別名表示
和其它RISC指令類似
arm指令主要有分支（branch）指令
載入和存儲指令和其它指令等
除了載入和存儲指令
其它指令都是不能直接操作內存的
而且載入和存儲指令操作的是
字節類型
那麼內存地址必須要求
字節對齊
這也是RISC指令和CISC指令差異比較大的地方
在操作字符串的時候相對就比較麻煩
arm指令一個很有趣的地方就是可以直接修改訪問pc寄存器
這樣如果寫shellcode的話就不必象SPARC或PowerPC一樣需要多條指令來定位自身
另外Windows CE默認使用的字節序是little
endian
[
Windows CE核心結構
Windows CE是一個
位的操作系統
所以其虛擬內存的大小是
GB（
的
次方）
Windows CE把這
GB虛擬內存空間分為低地址
GB和高地址
GB
應用程序使用的地址空間是低地址
GB
高地址
GB專供Windows CE內核使用
在Windows CE
源碼的PRIVATE/WINCEOS/COREOS/NK/INC/nkarm
h頭文件裡有一些有趣的信息
/* High memory layout
*
* This structure is mapped in at the end of the
GB virtual
* address space
*
*
xFFFD
first level page table (uncached) (
nd half is r/o)
*
xFFFD
disabled for protection
*
xFFFE
second level page tables (uncached)
*
xFFFE
disabled for protection
*
xFFFF
exception vectors
*
xFFFF
not used (r/o)
*
xFFFF
disabled for protection
*
xFFFF
r/o (physical overlaps with vectors)
*
xFFFF
Interrupt stack (
k)
*
xFFFF
r/o (physical overlaps with Abort stack & FIQ stack)
*
xFFFF
disabled for protection
*
xFFFF
r/o (physical memory overlaps with vectors & intr
stack & FIQ stack)
*
xFFFF
Abort stack (
k
bytes)
*&n
bsp;
xFFFF
disabled for protection
*
xFFFF
r/o (physical memory overlaps with vectors & intr
stack)
*
xFFFF
FIQ stack (
bytes)
*
xFFFF
r/o (physical memory overlaps with Abort stack)
*
xFFFF
disabled
*
xFFFFC
kernel stack
*
xFFFFC
KDataStruct
*
xFFFFCC
disabled for protection (
nd level page table for
xFFF
)
*/
typedef struct arm_HIGH {
ulong firstPT[
]; //
xFFFD
:
st level page table
PAGETBL aPT[
]; //
xFFFD
:
nd level page tables
char reserved
[
x
x
*sizeof(PAGETBL)];
char exVectors[
x
]; //
xFFFF
: exception vectors
char reserved
[
x
x
];
char intrStack[
x
]; //
xFFFF
: interrupt stack
char reserved
[
x
x
];
char abortStack[
x
]; //
xFFFF
: abort stack
char reserved
[
x
x
];
char fiqStack[
x
]; //
xFFFF
: FIQ stack
char reserved
[
xC
x
];
char kStack[
x
]; //
xFFFFC
: kernel stack
struct KDataStruct kdata; &
nbsp; //
xFFFFC
: kernel data page
} arm_HIGH;
其中KDataStruct的結構非常重要而且有意思
有些類似Win
下的PEB結構
定義了系統各種重要的信息
struct KDataStruct {
LPDWORD lpvTls; /*
x
Current thread local storage pointer */
HANDLE ahSys[NUM_SYS_HANDLES]; /*
x
If this moves
change kapi
h */
// NUM_SYS_HANDLES ==
: PUBLIC/COMMON/SDK/INC/kfuncs
h
x
SH_WIN
x
SH_CURTHREAD
x
c SH_CURPROC
x
SH_KWIN
x
SH_GDI
x
SH_WMGR
x
c SH_WNET
x
SH_COMM
x
SH_FILESYS_APIS
x
SH_SHELL
x
c SH_DEVMGR_APIS
x
SH_TAPI
x
SH_PATCHER
x
c SH_SERVICES
char bResched; /*
x
reschedule flag */
char cNest; /*
x
kernel exception nesting */
char bPowerOff; /*
x
TRUE during
power off
processing */
char bProfileOn;&nb
sp; /*
x
TRUE if profiling enabled */
ulong unused; /*
x
unused */
ulong rsvd
; /*
x
c was DiffMSec */
PPROCESS pCurPrc; /*
x
ptr to current PROCESS struct */
PTHREAD pCurThd; /*
x
ptr to current THREAD struct */
DWORD dwKCRes; /*
x
*/
ulong handleBase; /*
x
c handle table base address */
PSECTION aSections[
]; /*
x
a
section table for virutal memory */
LPEVENT alpeIntrEvents[SYSINTR_MAX_DEVICES];/*
x
a
*/
LPVOID alpvIntrData[SYSINTR_MAX_DEVICES]; /*
x
*/
ulong pAPIReturn; /*
x
a
direct API return address for kernel mode */
uchar *pMap; /*
x
a
ptr to MemoryMap array */
DWORD dwInDebugger; /*
x
a
!
when in debugger */
PTHREAD pCurFPUOwner; /*
x
ac current FPU owner */
PPROCESS pCpuASIDPrc; /*
x
b
current ASID proc */
long nMemForPT; /*
x
b
Memory used for PageTables */
long alPad[
]; /*
x
b
padding */
DWORD aInfo[
]; /*
x
misc
kernel info */
// PUBLIC/COMMON/OAK/INC/pkfuncs
h
x
KINX_PROCARRAY address of process array
x
KINX_PAGESIZE system page size
x
KINX_PFN_SHIFT shift for page # in PTE
x
c KINX_PFN_MASK mask for page # in PTE
x
KINX_PAGEFREE # of free physical pages
x
KINX_SYSPAGES # of pages used by kernel
x
KINX_KHEAP ptr to kernel heap array
x
c KINX_SECTIONS ptr to SectionTable array
x
KINX_MEMINFO ptr to system MemoryInfo struct
x
KINX_MODULES ptr to module list
x
KINX_DLL_LOW lower bound of DLL shared space
x
c KINX_NUMPAGES total # of RAM pages
x
KINX_PTOC &nb
sp; ptr to ROM table of contents
x
KINX_KDATA_ADDR kernel mode version of KData
x
KINX_GWESHEAPINFO Current amount of gwes heap in use
x
c KINX_TIMEZONEBIAS Fast timezone bias info
x
KINX_PENDEVENTS bit mask for pending interrupt events
x
KINX_KERNRESERVE number of kernel reserved pages
x
KINX_API_MASK bit mask for registered api sets
x
c KINX_NLS_CP hiword OEM code page
loword ANSI code page
x
KINX_NLS_SYSLOC Default System locale
x
KINX_NLS_USERLOC Default User locale
x
KINX_HEAP_WASTE Kernel heap wasted space
x
c KINX_DEBUGGER For use by debugger for protocol communication
x
KINX_APISETS APIset pointers
x
KINX_MINPAGEFREE water mark of the minimum number of free pages
x
KINX_CELOGSTATUS CeLog status flags
x
c KINX_NKSECTION Address of NKSection
x
KINX_PWR_EVTS Events to be set after power on
x
c KINX_NKSIG last entry of KINFO
signature when NK is ready
/*
x
interlocked api code */
/*
x
end */
}
Win
下可以通過PEB結構定位kernel
dll的基址
然後通過PE文件結構查找Windows API
在Windows CE下
coredll
dll的作用相當於Win
的kernel
dll
由於KDataStruct結構開始於
xFFFFC
偏移
x
的aInfo[KINX_MODULES]是一個指向模塊鏈表的指針
通過這個鏈表能否找到coredll
dll模塊呢？讓我們來看一下模塊的結構
// PRIVATE/WINCEOS/COREOS/NK/INC/kernel
h
typedef struct Module {
From:http://tw.wingwit.com/Article/os/xtgl/201311/9250.html
