2014年9月28日 星期日

Windows windbg -- lm (List module)

For Windows 8.1 x64 OS, windbg lm command can list Windows module.  It help us to understand Windows driver image location.  There are 3 groups for the drivers.  kdcom.dll, ntoskrnl.exe, hal.dll is one group(FFFFF800xxxxxxxx).  win32k.sys, TSDDD.dll,cdd.dll, and ATMFD.dll is one group(FFFFF960xxxxxxxx).  The others is one group(FFFFF880xxxxxxxx).

0: kd> lm
start             end                 module name
fffff800`00bc3000 fffff800`00bcd000   kdcom      (deferred)
fffff800`02e03000 fffff800`033d4000   nt         (pdb symbols)         
fffff800`033d4000 fffff800`0341d000   hal        (deferred)
fffff880`00c00000 fffff880`00cc0000   CI         (deferred)
fffff880`00cd4000 fffff880`00ce1000   mcupdate_AuthenticAMD   (deferred)
fffff880`00ce1000 fffff880`00cf5000   PSHED      (deferred)
fffff880`00cf5000 fffff880`00d53000   CLFS       (deferred)
fffff880`00d53000 fffff880`00daf000   volmgrx    (deferred)
fffff880`00daf000 fffff880`00dd9000   ataport    (deferred)
fffff880`00dd9000 fffff880`00de4000   msahci     (deferred)
fffff880`00de4000 fffff880`00dfb000   amd_sata   (deferred)
fffff880`00e00000 fffff880`00e0a000   msisadrv   (deferred)
fffff880`00e0a000 fffff880`00e3d000   pci        (deferred)
fffff880`00e3d000 fffff880`00e4a000   vdrvroot   (deferred)
fffff880`00e4a000 fffff880`00e5f000   partmgr    (deferred)
fffff880`00e5f000 fffff880`00e68000   compbatt   (deferred)
fffff880`00e68000 fffff880`00e74000   BATTC      (deferred)
fffff880`00e74000 fffff880`00e89000   volmgr     (deferred)
fffff880`00e89000 fffff880`00e90000   pciide     (deferred)
fffff880`00e90000 fffff880`00ea0000   PCIIDEX    (deferred)
fffff880`00ea0000 fffff880`00eba000   mountmgr   (deferred)
fffff880`00eba000 fffff880`00ec3000   atapi      (deferred)
fffff880`00ec8000 fffff880`00f8a000   Wdf01000   (deferred)
fffff880`00f8a000 fffff880`00f9a000   WDFLDR     (deferred)
fffff880`00f9a000 fffff880`00ff1000   ACPI       (deferred)
fffff880`00ff1000 fffff880`00ffa000   WMILIB     (deferred)
fffff880`01025000 fffff880`01087000   storport   (deferred)
fffff880`01087000 fffff880`01094000   amd_xata   (deferred)
fffff880`01094000 fffff880`0109f000   amdxata    (deferred)
fffff880`0109f000 fffff880`010eb000   fltmgr     (deferred)
fffff880`010eb000 fffff880`0115c000   SYMDS64    (deferred)
fffff880`0115c000 fffff880`01170000   fileinfo   (deferred)
fffff880`01170000 fffff880`011bc000   volsnap    (deferred)
fffff880`011bc000 fffff880`011f6000   rdyboost   (deferred)
fffff880`01200000 fffff880`0125e000   msrpc      (deferred)
fffff880`0125e000 fffff880`012d0000   cng        (deferred)
fffff880`012f0000 fffff880`013d4000   SYMEFA64   (deferred)
fffff880`013d4000 fffff880`013e0040   PxHlpa64   (deferred)
fffff880`01400000 fffff880`0141a000   ksecdd     (deferred)
fffff880`0141a000 fffff880`0142b000   pcw        (deferred)
fffff880`0142b000 fffff880`01435000   Fs_Rec     (deferred)
fffff880`01453000 fffff880`015f4000   Ntfs       (deferred)
fffff880`01600000 fffff880`01649000   fwpkclnt   (deferred)
fffff880`0164b000 fffff880`0173d000   ndis       (deferred)
fffff880`0173d000 fffff880`0179d000   NETIO      (deferred)
fffff880`0179d000 fffff880`017c8000   ksecpkg    (deferred)
fffff880`017c8000 fffff880`017d0000   spldr      (deferred)
fffff880`017d0000 fffff880`017e2000   mup        (deferred)
fffff880`017e2000 fffff880`017eb000   hwpolicy   (deferred)
fffff880`01802000 fffff880`019ff000   tcpip      (deferred)
fffff880`01a27000 fffff880`01a61000   fvevol     (deferred)
fffff880`01a61000 fffff880`01a77000   disk       (deferred)
fffff880`01a77000 fffff880`01aa7000   CLASSPNP   (deferred)
fffff880`01ae9000 fffff880`01b13000   cdrom      (deferred)
fffff880`01b13000 fffff880`01b1c000   Null       (deferred)
fffff880`01b1c000 fffff880`01b23000   Beep       (deferred)
fffff880`01b23000 fffff880`01b33000   RegHiveRecovery   (deferred)
fffff880`01b33000 fffff880`01b41000   vga        (deferred)
fffff880`01b41000 fffff880`01b66000   VIDEOPRT   (deferred)
fffff880`01b66000 fffff880`01b76000   watchdog   (deferred)
fffff880`01b76000 fffff880`01b7f000   RDPCDD     (deferred)
fffff880`01b7f000 fffff880`01b88000   rdpencdd   (deferred)
fffff880`01b88000 fffff880`01b91000   rdprefmp   (deferred)
fffff880`01b91000 fffff880`01b9c000   Msfs       (deferred)
fffff880`01b9c000 fffff880`01bad000   Npfs       (deferred)
fffff880`01bad000 fffff880`01bcb000   tdx        (deferred)
fffff880`01bcb000 fffff880`01bd8000   TDI        (deferred)
fffff880`01bd8000 fffff880`01bf0000   BTHUSB     (deferred)
fffff880`03a00000 fffff880`03a20000   bthpan     (deferred)
fffff880`03a20000 fffff880`03a44e00   btath_rcp   (deferred)
fffff880`03a45000 fffff880`03aac000   btath_a2dp   (deferred)
fffff880`03ac8000 fffff880`03b54000   bthport    (deferred)
fffff880`03b54000 fffff880`03b65000   WinUSB     (deferred)
fffff880`03b65000 fffff880`03ba5000   RtsUStor   (deferred)
fffff880`03ba5000 fffff880`03bd1000   rfcomm     (deferred)
fffff880`03bd1000 fffff880`03be1000   BthEnum    (deferred)
fffff880`03c14000 fffff880`03c9d000   afd        (deferred)
fffff880`03c9d000 fffff880`03ce2000   netbt      (deferred)
fffff880`03ce2000 fffff880`03ceb000   wfplwf     (deferred)
fffff880`03ceb000 fffff880`03d11000   pacer      (deferred)
fffff880`03d11000 fffff880`03d27000   vwififlt   (deferred)
fffff880`03d27000 fffff880`03d36000   netbios    (deferred)
fffff880`03d36000 fffff880`03d51000   wanarp     (deferred)
fffff880`03d51000 fffff880`03d65000   termdd     (deferred)
fffff880`03d65000 fffff880`03dcc000   SYMNETS    (deferred)
fffff880`03dcc000 fffff880`03df9200   usbvideo   (deferred)
fffff880`03e00000 fffff880`03e76000   IDSVia64   (deferred)
fffff880`03e76000 fffff880`03e85000   discache   (deferred)
fffff880`03e85000 fffff880`03ea3000   dfsc       (deferred)
fffff880`03ea3000 fffff880`03eb4000   blbdrive   (deferred)
fffff880`03eb4000 fffff880`03ec7000   dump_dumpfve   (deferred)
fffff880`03ed5000 fffff880`03f0b000   SYMEVENT64x86   (deferred)
fffff880`03f0b000 fffff880`03f38000   Ironx64    (deferred)
fffff880`03f38000 fffff880`03f4e000   SRTSPX64   (deferred)
fffff880`03f4e000 fffff880`03f9f000   rdbss      (deferred)
fffff880`03f9f000 fffff880`03fab000   nsiproxy   (deferred)
fffff880`03fab000 fffff880`03fb6000   mssmbios   (deferred)
fffff880`03fb6000 fffff880`03fd3000   usbccgp    (deferred)
fffff880`03fd3000 fffff880`03ffdc40   CtClsFlt   (deferred)
fffff880`04000000 fffff880`0404f000   atikmpag   (deferred)
fffff880`0404f000 fffff880`04070000   raspptp    (deferred)
fffff880`04070000 fffff880`040b3000   ks         (deferred)
fffff880`040b3000 fffff880`040c5000   umbus      (deferred)
fffff880`040c5000 fffff880`041b0000   BHDrvx64   (deferred)
fffff880`041b0000 fffff880`041d6000   tunnel     (deferred)
fffff880`041d6000 fffff880`041ee000   amdhub30   (deferred)
fffff880`041ee000 fffff880`041fc000   monitor    (deferred)
fffff880`04200000 fffff880`0426a000   Rt64win7   (deferred)
fffff880`0426a000 fffff880`0428e000   rasl2tp    (deferred)
fffff880`0428e000 fffff880`04299000   btath_bus   (deferred)
fffff880`042a0000 fffff880`04394000   dxgkrnl    (deferred)
fffff880`04394000 fffff880`043da000   dxgmms1    (deferred)
fffff880`043da000 fffff880`043fe000   HDAudBus   (deferred)
fffff880`04a00000 fffff880`04a2f000   ndiswan    (deferred)
fffff880`04a2f000 fffff880`04a4a000   raspppoe   (deferred)
fffff880`04a4a000 fffff880`04a64000   rassstp    (deferred)
fffff880`04a65000 fffff880`0538c000   atikmdag   (deferred)
fffff880`0538c000 fffff880`053e6000   Apfiltr    (deferred)
fffff880`053e6000 fffff880`053fa000   amdiox64   (deferred)
fffff880`05600000 fffff880`056a6000   peauth     (deferred)
fffff880`056b9000 fffff880`0571c000   btath_hcrp   (deferred)
fffff880`0571c000 fffff880`0572b000   btath_flt   (deferred)
fffff880`0572b000 fffff880`0573e000   btath_lwflt   (deferred)
fffff880`0573e000 fffff880`05761000   luafv      (deferred)
fffff880`05761000 fffff880`05776000   lltdio     (deferred)
fffff880`05776000 fffff880`057c9000   nwifi      (deferred)
fffff880`057c9000 fffff880`057dc000   ndisuio    (deferred)
fffff880`057dc000 fffff880`057f4000   rspndr     (deferred)
fffff880`05800000 fffff880`05804500   CmBatt     (deferred)
fffff880`05805000 fffff880`0581a000   amdppm     (deferred)
fffff880`0581a000 fffff880`0582a000   CompositeBus   (deferred)
fffff880`0582a000 fffff880`05840000   AgileVpn   (deferred)
fffff880`05840000 fffff880`0584c000   ndistapi   (deferred)
fffff880`0584c000 fffff880`0584d480   swenum     (deferred)
fffff880`05851000 fffff880`05cdb000   bcmwl664   (deferred)
fffff880`05cdb000 fffff880`05ce8000   vwifibus   (deferred)
fffff880`05ce8000 fffff880`05d18000   amdxhc     (deferred)
fffff880`05d18000 fffff880`05d19f00   USBD       (deferred)
fffff880`05d1a000 fffff880`05d29000   usbfilter   (deferred)
fffff880`05d29000 fffff880`05d34000   usbohci    (deferred)
fffff880`05d34000 fffff880`05d8a000   USBPORT    (deferred)
fffff880`05d8a000 fffff880`05d9b000   usbehci    (deferred)
fffff880`05d9b000 fffff880`05db9000   i8042prt   (deferred)
fffff880`05db9000 fffff880`05dc8000   kbdclass   (deferred)
fffff880`05dc8000 fffff880`05dd7000   mouclass   (deferred)
fffff880`05dd7000 fffff880`05df7000   sdbus      (deferred)
fffff880`05df7000 fffff880`05e00000   wmiacpi    (deferred)
fffff880`05e00000 fffff880`05e0e000   hidusb     (deferred)
fffff880`05e0e000 fffff880`05e27000   HIDCLASS   (deferred)
fffff880`05e27000 fffff880`05e2f080   HIDPARSE   (deferred)
fffff880`05e30000 fffff880`05e3d000   mouhid     (deferred)
fffff880`05e3d000 fffff880`05e49000   Dxapi      (deferred)
fffff880`05e49000 fffff880`05e57000   crashdmp   (deferred)
fffff880`05e57000 fffff880`05e61000   dump_diskdump   (deferred)
fffff880`05e61000 fffff880`05e78000   dump_amd_sata   (deferred)
fffff880`05e82000 fffff880`05edc000   usbhub     (deferred)
fffff880`05edc000 fffff880`05ef1000   NDProxy    (deferred)
fffff880`05ef1000 fffff880`05f11000   AtihdW76   (deferred)
fffff880`05f11000 fffff880`05f4e000   portcls    (deferred)
fffff880`05f4e000 fffff880`05f70000   drmk       (deferred)
fffff880`05f70000 fffff880`05f75200   ksthunk    (deferred)
fffff880`05f76000 fffff880`05ff9000   stwrt64    (deferred)
fffff880`07623000 fffff880`076eb000   HTTP       (deferred)
fffff880`076eb000 fffff880`07709000   bowser     (deferred)
fffff880`07709000 fffff880`07721000   mpsdrv     (deferred)
fffff880`07721000 fffff880`0774e000   mrxsmb     (deferred)
fffff880`0774e000 fffff880`0779c000   mrxsmb10   (deferred)
fffff880`0779c000 fffff880`077bf000   mrxsmb20   (deferred)
fffff880`077bf000 fffff880`077d1000   tcpipreg   (deferred)
fffff880`07c00000 fffff880`07c0b000   secdrv     (deferred)
fffff880`07c0b000 fffff880`07c38000   srvnet     (deferred)
fffff880`07c41000 fffff880`07df6000   rikvm_9EC60124   (deferred)
fffff880`08200000 fffff880`08236000   fastfat    (deferred)
fffff880`08236000 fffff880`0825e000   mrxdav     (deferred)
fffff880`0825e000 fffff880`08294000   WUDFRd     (deferred)
fffff880`08294000 fffff880`082af000   USBSTOR    (deferred)
fffff880`082af000 fffff880`082bc000   LiveKdD    (deferred)
fffff880`082cc000 fffff880`08333000   srv2       (deferred)
fffff880`08333000 fffff880`083c8000   srv        (deferred)
fffff880`083c8000 fffff880`083e1000   WudfPf     (deferred)
fffff960`00090000 fffff960`003a6000   win32k     (deferred)
fffff960`00500000 fffff960`0050a000   TSDDD      (deferred)
fffff960`00640000 fffff960`00667000   cdd        (deferred)
fffff960`00810000 fffff960`00871000   ATMFD      (deferred)