explorer.exe句柄表的结构和前三个句柄对应的对象
第二部分：
0: kd> !handle
PROCESS 89589d88 SessionId: 0 Cid: 00e4 Peb: 7ffdf000 ParentCid: 0464
DirBase: 784cf000 ObjectTable: e19ce678 HandleCount: 275.
Image: explorer.exe
Handle table at e19ce678 with 275 entries in use
例子1：
0004: Object: e10037a8 GrantedAccess: 00000003 (Protected) Entry: e1037008
Object: e10037a8 Type: (8999b8e8) KeyedEvent
ObjectHeader: e1003790 (old version)
HandleCount: 18 PointerCount: 19
Directory Object: e1000640 Name: CritSecOutOfMemoryEvent
例子2：
0008: Object: 894cebe0 GrantedAccess: 001f0003 Entry: e1037010
Object: 894cebe0 Type: (8999c6f0) Event
ObjectHeader: 894cebc8 (old version)
HandleCount: 1 PointerCount: 1
例子3：
000c: Object: e14e7778 GrantedAccess: 00000003 Entry: e1037018
Object: e14e7778 Type: (899a2e70) Directory
ObjectHeader: e14e7760 (old version)
HandleCount: 17 PointerCount: 49
Directory Object: e10007c0 Name: KnownDlls
第三部分：
0: kd> dt nt!HANDLE_TABLE 0xe19ce694-1c
+0x000 TableCode : 0xe1037000
+0x004 QuotaProcess : 0x89589d88 _EPROCESS
+0x008 UniqueProcessId : 0x000000e4 Void
+0x00c HandleTableLock : [4] _EX_PUSH_LOCK
+0x01c HandleTableList : _LIST_ENTRY [ 0x80bf6000 - 0xe17ae13c ]
+0x024 HandleContentionEvent : _EX_PUSH_LOCK
+0x028 DebugInfo : (null)
+0x02c ExtraInfoPages : 0n0
+0x030 FirstFree : 0x498
+0x034 LastFree : 0x520
+0x038 NextHandleNeedingPool : 0x800
+0x03c HandleCount : 0n275
+0x040 Flags : 1
+0x040 StrictFIFO : 0y1
例子1：
0: kd> dt HANDLE_TABLE_ENTRY 0xe1037000+8*1
ntdll!HANDLE_TABLE_ENTRY
+0x000 Object : 0xe1003791 Void
+0x000 ObAttributes : 0xe1003791
+0x000 InfoTable : 0xe1003791 _HANDLE_TABLE_ENTRY_INFO
+0x000 Value : 0xe1003791
+0x004 GrantedAccess : 0x2000003
+0x004 GrantedAccessIndex : 3
+0x006 CreatorBackTraceIndex : 0x200
+0x004 NextFreeTableEntry : 0n33554435
0: kd> dt nt!_OBJECT_HEADER 0xe1003790
+0x000 PointerCount : 0n19
+0x004 HandleCount : 0n18
+0x004 NextToFree : 0x00000012 Void
+0x008 Type : 0x8999b8e8 _OBJECT_TYPE
+0x00c NameInfoOffset : 0x18 ''
+0x00d HandleInfoOffset : 0 ''
+0x00e QuotaInfoOffset : 0 ''
+0x00f Flags : 0x32 '2'
+0x010 ObjectCreateInfo : 0x00000001 _OBJECT_CREATE_INFORMATION
+0x010 QuotaBlockCharged : 0x00000001 Void
+0x014 SecurityDescriptor : 0xe10015d7 Void
+0x018 Body : _QUAD
0: kd> !object 0xe10037a8
Object: e10037a8 Type: (8999b8e8) KeyedEvent
ObjectHeader: e1003790 (old version)
HandleCount: 18 PointerCount: 19
Directory Object: e1000640 Name: CritSecOutOfMemoryEvent
例子2：
0: kd> dt HANDLE_TABLE_ENTRY 0xe1037000+8*2
ntdll!HANDLE_TABLE_ENTRY
+0x000 Object : 0x894cebc9 Void
+0x000 ObAttributes : 0x894cebc9
+0x000 InfoTable : 0x894cebc9 _HANDLE_TABLE_ENTRY_INFO
+0x000 Value : 0x894cebc9
+0x004 GrantedAccess : 0x1f0003
+0x004 GrantedAccessIndex : 3
+0x006 CreatorBackTraceIndex : 0x1f
+0x004 NextFreeTableEntry : 0n2031619
0: kd> !object 0x894cebe0
Object: 894cebe0 Type: (8999c6f0) Event
ObjectHeader: 894cebc8 (old version)
HandleCount: 1 PointerCount: 1
例子3：
0: kd> dt HANDLE_TABLE_ENTRY 0xe1037000+8*3
ntdll!HANDLE_TABLE_ENTRY
+0x000 Object : 0xe14e7761 Void
+0x000 ObAttributes : 0xe14e7761
+0x000 InfoTable : 0xe14e7761 _HANDLE_TABLE_ENTRY_INFO
+0x000 Value : 0xe14e7761
+0x004 GrantedAccess : 3
+0x004 GrantedAccessIndex : 3
+0x006 CreatorBackTraceIndex : 0
+0x004 NextFreeTableEntry : 0n3
0: kd> dt nt!_OBJECT_HEADER 0xe14e7760
+0x000 PointerCount : 0n49
+0x004 HandleCount : 0n17
+0x004 NextToFree : 0x00000011 Void
+0x008 Type : 0x899a2e70 _OBJECT_TYPE
+0x00c NameInfoOffset : 0x18 ''
+0x00d HandleInfoOffset : 0 ''
+0x00e QuotaInfoOffset : 0 ''
+0x00f Flags : 0x30 '0'
+0x010 ObjectCreateInfo : 0x80bf4440 _OBJECT_CREATE_INFORMATION
+0x010 QuotaBlockCharged : 0x80bf4440 Void
+0x014 SecurityDescriptor : 0xe1505773 Void
+0x018 Body : _QUAD
0: kd> !object 0xe14e7778
Object: e14e7778 Type: (899a2e70) Directory
ObjectHeader: e14e7760 (old version)
HandleCount: 17 PointerCount: 49
Directory Object: e10007c0 Name: KnownDlls
Hash Address Type Name
---- ------- ---- ----
00 e1558278 Section gdi32.dll
e14e7640 Section imagehlp.dll
e155cf90 Section url.dll
01 e1454048 Section appHelp.dll
02 e15540c8 Section MPR.dll
03 e155a140 Section ole32.dll
e155cf20 Section urlmon.dll
04 e1501858 Section olesvr32.dll
e1555bb8 Section lz32.dll
06 e1556ef0 Section shell32.dll
e1554048 Section wldap32.dll
09 e1551140 Section user32.dll
e14f90d0 Section version.dll
10 e150aa68 Section olecli32.dll
14 e154c0c8 Section MSASN1.dll
16 e150b790 SymbolicLink KnownDllPath
e14e8140 Section COMCTL32.dll
17 e150a158 Section CRYPT32.dll
18 e155a0d0 Section oleaut32.dll
e150bb70 Section advapi32.dll
19 e1550048 Section SHLWAPI.dll
e14e80d0 Section wow32.dll
e15018c8 Section olecnv32.dll
21 e15570c8 Section USERENV.dll
23 e150b730 Section comdlg32.dll
26 e154a6b0 Section wininet.dll
27 e150b048 Section olethk32.dll
28 e154e140 Section msvcrt.dll
31 e1551048 Section rpcrt4.dll
e154c048 Section SHDOCVW.dll
32 e1554308 Section kernel32.dll
