第一部分：
1: kd> t
RPCRT4!OSF_CCALL::ActivateCall:
001b:77bf5789 55 push ebp
1: kd> kc
#
00 RPCRT4!OSF_CCALL::ActivateCall
01 RPCRT4!OSF_CASSOCIATION::AllocateCCall
02 RPCRT4!OSF_BINDING_HANDLE::AllocateCCall
03 RPCRT4!OSF_BINDING_HANDLE::NegotiateTransferSyntax
04 RPCRT4!I_RpcGetBufferWithObject
05 RPCRT4!I_RpcGetBuffer
06 RPCRT4!NdrGetBuffer
07 RPCRT4!NdrClientCall2
08 ADVAPI32!LsarGetUserName
09 ADVAPI32!LsaGetUserName
0a ntdll!RtlpWaitOrTimerCallout
1: kd> dv
this = 00ce1b98
BindingHandle = 0x00ce1730
Binding = 0x00ce1fa8
AvailableBindingsList = 0x00000000
CallIdToUse = 1
InitialCallState = NeedOpenAndBind (0n0)
DispatchTable = 0x00000000
CConnection = 0x00ce1958
Status = 0n1
1: kd> dx -id 0,0,898d2250 -r1 ((RPCRT4!OSF_CCALL *)0xce1b98)
((RPCRT4!OSF_CCALL *)0xce1b98) : 0xce1b98 [Type: OSF_CCALL *]
[+0x004] MagicLong : 0x89abcdef [Type: unsigned long]
[+0x008] ObjectType : 32 [Type: int]
[+0x00c] RefCount [Type: INTERLOCKED_INTEGER]
[+0x010] NestingCall : 0xbaadf00d [Type: CALL *]
[+0x014] pAsync : 0xbaadf00d [Type: _RPC_ASYNC_STATE *]
[+0x018] NotificationIssued : -1163005939 [Type: long]
[+0x01c] AsyncStatus : -1163005939 [Type: long]
[+0x020] CachedAPCInfo [Type: RPC_APC_INFO]
[+0x030] CachedAPCInfoAvailable : 1 [Type: int]
[+0x034] CallingThread : 0xbaadf00d [Type: THREAD *]
[+0x038] UuidSpecified : -1163005939 [Type: int]
[+0x03c] ObjectUuid : {BAADF00D-F00D-BAAD-0DF0-ADBA0DF0ADBA} [Type: _GUID]
[+0x04c] EEInfo : 0x0 [Type: tagExtendedErrorInfo *]
[+0x050] CurrentState : -1163005939 [Type: OSF_CCALL_STATE]
[+0x054] Connection : 0xbaadf00d [Type: OSF_CCONNECTION *]
[+0x058] BindingHandle : 0xbaadf00d [Type: OSF_BINDING_HANDLE *]
[+0x05c] CallbackLevel : 0 [Type: int]
[+0x060] Bindings [Type: OSF_CCALL::__unnamed]
[+0x068] CurrentBuffer : 0xbaadf00d [Type: void *]
[+0x06c] fDataLengthNegotiated : -1163005939 [Type: int]
[+0x070] CurrentOffset : -1163005939 [Type: int]
[+0x074] CurrentBufferLength : 0xbaadf00d [Type: unsigned long]
[+0x078] CallId : 0xbaadf00d [Type: unsigned long]
[+0x07c] RcvBufferLength : 0xbaadf00d [Type: unsigned int]
[+0x080] FirstSend : -1163005939 [Type: int]
[+0x084] DispatchTableCallback : 0xbaadf00d [Type: RPC_DISPATCH_TABLE *]
[+0x088] MaximumFragmentLength : 0xbaadf00d [Type: unsigned int]
[+0x08c] MaxSecuritySize : 0xbaadf00d [Type: unsigned int]
[+0x090] MaxDataLength : 0xbaadf00d [Type: unsigned int]
[+0x094] ProcNum : -1163005939 [Type: int]
[+0x098] ReservedForSecurity : 0x0 [Type: unsigned char *]
[+0x09c] SecBufferLength : 0x0 [Type: unsigned int]
[+0x0a0] HeaderSize : 0xbaadf00d [Type: unsigned int]
[+0x0a4] AdditionalSpaceForSecurity : 0xbaadf00d [Type: unsigned int]
[+0x0a8] SavedHeaderSize : 0x0 [Type: unsigned long]
[+0x0ac] SavedHeader : 0x0 [Type: void *]
[+0x0b0] LastBuffer : 0xbaadf00d [Type: void *]
[+0x0b4] SyncEvent [Type: EVENT]
[+0x0b8] ActualBufferLength : 0xbaadf00d [Type: unsigned int]
[+0x0bc] NeededLength : 0xbaadf00d [Type: unsigned int]
[+0x0c0] CallSendContext : 0xce1cd0 [Type: void *]
[+0x0c4] fAdvanceCallCount [Type: INTERLOCKED_INTEGER]
[+0x0c8] fPeerChoked : -1163005939 [Type: int]
[+0x0cc] Flags [Type: CompositeFlags]
[+0x0d0] fLastSendComplete : -1163005939 [Type: int]
[+0x0d4] CallMutex [Type: MUTEX]
[+0x0ec] RecursiveCallsKey : -1163005939 [Type: int]
[+0x0f0] AllocHint : 0xbaadf00d [Type: unsigned long]
[+0x0f4] CallStack : -1163005939 [Type: int]
[+0x0f8] fCallCancelled : -1163005939 [Type: int]
[+0x0fc] CancelState : -1163005939 [Type: CANCEL_STATE]
[+0x100] BufferQueue [Type: QUEUE]
[+0x12c] InReply : 0 [Type: int]
[+0x130] fChoked : -1163005939 [Type: int]
第二部分：
1: kd> dv
this = 00ce1b98
BindingHandle = 0x00ce1730
Connection = CConnection;
this->BindingHandle = BindingHandle;
第三部分：
1: kd> dv
this = 0x00ce18b4
BindingHandle = 0x00ce1730
Binding = 0x00ce1fa8
AvailableBindingsList = 0x00000000
CallIdToUse = 1
CallId = CallIdToUse;
1: kd> dx -id 0,0,898d2250 -r1 ((RPCRT4!OSF_CASSOCIATION *)0xce1840)
((RPCRT4!OSF_CASSOCIATION *)0xce1840) : 0xce1840 [Type: OSF_CASSOCIATION *]
[+0x004] MagicLong : 0x89abcdef [Type: unsigned long]
[+0x008] ObjectType : 512 [Type: int]
[+0x070] CallIdCounter : 0x2 [Type: unsigned long]
第四部分：CallIdCounter是RPCRT4!OSF_CASSOCIATION结构成员
RPC_STATUS
OSF_CASSOCIATION::AllocateCCall (
IN OSF_BINDING_HANDLE *BindingHandle,
IN PRPC_MESSAGE Message,
IN CLIENT_AUTH_INFO * ClientAuthInfo,
OUT OSF_CCALL ** pCCall,
OUT BOOL *fBindingHandleReferenceRemoved
)
{
CallIdToUse = CallIdCounter++;
CurrentState = InitialCallState;
Status = Connection->AddActiveCall(
CallIdToUse,
this);
第五部分：RPCRT4!OSF_CCONNECTION结构中的ActiveCalls
1: kd> dx -id 0,0,898d2250 -r1 ((RPCRT4!OSF_CCONNECTION *)0xce1958)
((RPCRT4!OSF_CCONNECTION *)0xce1958) : 0xce1958 [Type: OSF_CCONNECTION *]
[+0x004] MagicLong : 0x89abcdef [Type: unsigned long]
[+0x008] ObjectType : 128 [Type: int]
[+0x0b0] ActiveCalls [Type: OSF_CCALL_DICT2]
1: kd> dx -id 0,0,898d2250 -r1 (*((RPCRT4!OSF_CCALL_DICT2 *)0xce1a08))
(*((RPCRT4!OSF_CCALL_DICT2 *)0xce1a08)) [Type: OSF_CCALL_DICT2]
[+0x000] DictKeys : 0xce1a14 [Type: void * *]
[+0x004] DictItems : 0xce1a24 [Type: void * *]
[+0x008] cDictSlots : 0x4 [Type: unsigned int]
[+0x00c] InitialDictKeys [Type: void * [4]]
[+0x01c] InitialDictItems [Type: void * [4]]
1: kd> dx -id 0,0,898d2250 -r1 (*((RPCRT4!void * (*)[4])0xce1a14))
(*((RPCRT4!void * (*)[4])0xce1a14)) [Type: void * [4]]
[0] : 0x0 [Type: void *]
[1] : 0x0 [Type: void *]
[2] : 0x0 [Type: void *]
[3] : 0x0 [Type: void *]
1: kd> dx -id 0,0,898d2250 -r1 (*((RPCRT4!void * (*)[4])0xce1a24))
(*((RPCRT4!void * (*)[4])0xce1a24)) [Type: void * [4]]
[0] : 0x0 [Type: void *]
[1] : 0x0 [Type: void *]
[2] : 0x0 [Type: void *]
[3] : 0x0 [Type: void *]
第六部分：
Bindings.SelectedBinding = Binding;
Bindings.AvailableBindingsList = AvailableBindingsList;
1: kd> dv
this = 0x00ce18b4
BindingHandle = 0x00ce1730
Binding = 0x00ce1fa8 这里有Binding
AvailableBindingsList = 0x00000000
1: kd> dx -id 0,0,898d2250 -r1 ((RPCRT4!OSF_BINDING *)0xce1fa8)
((RPCRT4!OSF_BINDING *)0xce1fa8) : 0xce1fa8 [Type: OSF_BINDING *]
[+0x000] InterfaceId [Type: _RPC_SYNTAX_IDENTIFIER]
[+0x014] TransferSyntaxInfo [Type: TRANSFER_SYNTAX_INFO_ATOM]
[+0x030] NextBinding : 0x0 [Type: MTSyntaxBinding *]
[+0x034] PresentationContext : 0 [Type: int]
[+0x038] CapabilitiesBitmap : 1 [Type: int]
[+0x03c] RefCount [Type: INTERLOCKED_INTEGER]
[+0x040] Flags [Type: CompositeFlags]
第七部分：参考
inline OSF_BINDING *
GetListOfAvaialbleBindings (
OUT BOOL *fMultipleBindingsAvailable
)
{
if (Bindings.AvailableBindingsList)
{
*fMultipleBindingsAvailable = TRUE;
return Bindings.AvailableBindingsList;
}
else
{
*fMultipleBindingsAvailable = FALSE;
return Bindings.SelectedBinding;
}
}
第八部分：
1: kd> dt osf_ccall 00ce1b98
RPCRT4!OSF_CCALL
+0x000 __VFN_table : 0x77bd3278
+0x004 MagicLong : 0x89abcdef
+0x008 ObjectType : 0n32
+0x060 Bindings : OSF_CCALL::__unnamed
1: kd> dx -id 0,0,898d2250 -r1 (*((RPCRT4!OSF_CCALL::__unnamed *)0xce1bf8))
(*((RPCRT4!OSF_CCALL::__unnamed *)0xce1bf8)) [Type: OSF_CCALL::__unnamed]
[+0x000] SelectedBinding : 0xce1fa8 [Type: OSF_BINDING *]
[+0x004] AvailableBindingsList : 0x0 [Type: OSF_BINDING *]
1: kd> dx -id 0,0,898d2250 -r1 ((RPCRT4!OSF_BINDING *)0xce1fa8)
((RPCRT4!OSF_BINDING *)0xce1fa8) : 0xce1fa8 [Type: OSF_BINDING *]
[+0x000] InterfaceId [Type: _RPC_SYNTAX_IDENTIFIER]
[+0x014] TransferSyntaxInfo [Type: TRANSFER_SYNTAX_INFO_ATOM]
[+0x030] NextBinding : 0x0 [Type: MTSyntaxBinding *]
[+0x034] PresentationContext : 0 [Type: int]
[+0x038] CapabilitiesBitmap : 1 [Type: int]
[+0x03c] RefCount [Type: INTERLOCKED_INTEGER]
[+0x040] Flags [Type: CompositeFlags]
第九部分：
1: kd> dx -id 0,0,898d2250 -r1 ((RPCRT4!OSF_CCONNECTION *)0xce1958)
((RPCRT4!OSF_CCONNECTION *)0xce1958) : 0xce1958 [Type: OSF_CCONNECTION *]
[+0x004] MagicLong : 0x89abcdef [Type: unsigned long]
[+0x008] ObjectType : 128 [Type: int]
[+0x054] fExclusive : 1 [Type: int]
if (Connection->fExclusive == 0) //不成立
{
//
第十部分：最终结果
1: kd> dt osf_ccall 00ce1b98
RPCRT4!OSF_CCALL
+0x000 __VFN_table : 0x77bd3278
+0x004 MagicLong : 0x89abcdef
+0x008 ObjectType : 0n32
+0x00c RefCount : INTERLOCKED_INTEGER
+0x010 NestingCall : 0xbaadf00d CALL
+0x014 pAsync : (null)
+0x018 NotificationIssued : 0n-1163005939
+0x01c AsyncStatus : 0n-1163005939
+0x020 CachedAPCInfo : RPC_APC_INFO
+0x030 CachedAPCInfoAvailable : 0n1
+0x034 CallingThread : (null)
+0x038 UuidSpecified : 0n-1163005939
+0x03c ObjectUuid : _GUID {baadf00d-f00d-baad-0df0-adba0df0adba}
+0x04c EEInfo : (null)
+0x050 CurrentState : 0 ( NeedOpenAndBind )
+0x054 Connection : 0x00ce1958 OSF_CCONNECTION
+0x058 BindingHandle : 0x00ce1730 OSF_BINDING_HANDLE
+0x05c CallbackLevel : 0n0
+0x060 Bindings : OSF_CCALL::__unnamed
+0x068 CurrentBuffer : (null)
+0x06c fDataLengthNegotiated : 0n0
+0x070 CurrentOffset : 0n0
+0x074 CurrentBufferLength : 0xbaadf00d
+0x078 CallId : 1
+0x07c RcvBufferLength : 0
+0x080 FirstSend : 0n-1163005939
+0x084 DispatchTableCallback : (null)
+0x088 MaximumFragmentLength : 0
+0x08c MaxSecuritySize : 0
+0x090 MaxDataLength : 0
+0x094 ProcNum : 0n-1163005939
+0x098 ReservedForSecurity : (null)
+0x09c SecBufferLength : 0
+0x0a0 HeaderSize : 0
+0x0a4 AdditionalSpaceForSecurity : 0
+0x0a8 SavedHeaderSize : 0
+0x0ac SavedHeader : (null)
+0x0b0 LastBuffer : (null)
+0x0b4 SyncEvent : EVENT
+0x0b8 ActualBufferLength : 0xbaadf00d
+0x0bc NeededLength : 0
+0x0c0 CallSendContext : 0x00ce1cd0 Void
+0x0c4 fAdvanceCallCount : INTERLOCKED_INTEGER
+0x0c8 fPeerChoked : 0n0
+0x0cc Flags : CompositeFlags
+0x0d0 fLastSendComplete : 0n-1163005939
+0x0d4 CallMutex : MUTEX
+0x0ec RecursiveCallsKey : 0n-1
+0x0f0 AllocHint : 0
+0x0f4 CallStack : 0n0
+0x0f8 fCallCancelled : 0n0
+0x0fc CancelState : 0 ( CANCEL_NOTREGISTERED )
+0x100 BufferQueue : QUEUE
+0x12c InReply : 0n0
+0x130 fChoked : 0n-1163005939