winlogon源代码分析之原子表的创建xxxCreateWindowStation函数中会调用CreateGlobalAtomTable函数创建工作站原子表

winlogon源代码分析之原子表的创建xxxCreateWindowStation函数中会调用CreateGlobalAtomTable函数创建工作站原子表

第一部分：

ds\security\gina\winlogon\winlogon.c

int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance,
                    LPSTR lpCmdLine, int nCmdShow)
{
......
    //
    // Create the primary terminal.
    //

    if (!CreatePrimaryTerminal())
    {

第2部分：
BOOL CreatePrimaryTerminal (void)
{
 
......
    //
    // Create the window station
    //
    pWS->hwinsta = CreateWindowStationW (WINDOW_STATION_NAME, 0, MAXIMUM_ALLOWED, NULL);
    if (!pWS->hwinsta) {
        DebugLog((DEB_ERROR, "Could not create the interactive windowstation\n"));
        goto failCreateTerminal;
    }

第3部分：
HWINSTA xxxCreateWindowStation(
    POBJECT_ATTRIBUTES  ObjectAttributes,
    KPROCESSOR_MODE     OwnershipMode,
    DWORD               dwDesiredAccess,
    HANDLE              hKbdLayoutFile,
    DWORD               offTable,
    PKBDTABLE_MULTI_INTERNAL pKbdTableMulti,
    PCWSTR              pwszKLID,
    UINT                uKbdInputLocale)
{
 
    }

    /*
     * Create the global atom table and populate it with the default OLE atoms
     * Pin each atom so they can't be deleted by bogus applications like Winword
     */
    Status = CreateGlobalAtomTable(&pwinsta->pGlobalAtomTable);
    if (!NT_SUCCESS(Status)) {
        UserAssert(pwinsta->pGlobalAtomTable == NULL);
        RIPNTERR0(Status, RIP_WARNING, "CreateGlobalAtomTable failed");
        goto create_error;
    }

第4部分：
static CONST LPCWSTR lpszStdFormats[] = {
    L"StdExit",                    第一个                    
    L"StdNewDocument",
    L"StdOpenDocument",
    L"StdEditDocument",
    L"StdNewfromTemplate",                第五个
    L"StdCloseDocument",
    L"StdShowItem",
    L"StdDoVerbItem",
    L"System",
    L"OLEsystem",
    L"StdDocumentName",
    L"Protocols",
    L"Topics",
    L"Formats",
    L"Status",
    L"EditEnvItems",
    L"True",
    L"False",
    L"Change",
    L"Save",
    L"Close",
    L"MSDraw"
};

第5部分：

第一个：
1: kd> dt nt!_RTL_ATOM_TABLE_ENTRY e14914b0    
   +0x000 HashLink         : 0xe15d7440 _RTL_ATOM_TABLE_ENTRY
   +0x004 HandleIndex      : 1
   +0x006 Atom             : 0xc001
   +0x008 ReferenceCount   : 1
   +0x00a Flags            : 0x1 ''
   +0x00b NameLength       : 0x7 ''
   +0x00c Name             : [1] 0x53
1: kd> dx -id 0,0,896d1020 -r1 (*((ntkrnlmp!unsigned short (*)[1])0xe14914bc))
(*((ntkrnlmp!unsigned short (*)[1])0xe14914bc))                 [Type: unsigned short [1]]
    [0]              : 0x53 [Type: unsigned short]
1: kd> db 0xe14914bc
e14914bc  53 00 74 00 64 00 45 00-78 00 69 00 74 00 00 00  S.t.d.E.x.i.t...

第5个：
1: kd>  dt nt!_RTL_ATOM_TABLE_ENTRY e15abcc8
   +0x000 HashLink         : (null)
   +0x004 HandleIndex      : 5
   +0x006 Atom             : 0xc005
   +0x008 ReferenceCount   : 1
   +0x00a Flags            : 0x1 ''
   +0x00b NameLength       : 0x12 ''
   +0x00c Name             : [1] 0x53
1: kd> dx -id 0,0,896d1020 -r1 (*((ntkrnlmp!unsigned short (*)[1])0xe15abcd4))
(*((ntkrnlmp!unsigned short (*)[1])0xe15abcd4))                 [Type: unsigned short [1]]
    [0]              : 0x53 [Type: unsigned short]
1: kd> db 0xe15abcd4
e15abcd4  53 00 74 00 64 00 4e 00-65 00 77 00 66 00 72 00  S.t.d.N.e.w.f.r.
e15abce4  6f 00 6d 00 54 00 65 00-6d 00 70 00 6c 00 61 00  o.m.T.e.m.p.l.a.
e15abcf4  74 00 65 00 00 00 00 00-78 00 00 00 09 04 09 0c  t.e.....x.......