I know we can use "SGDT" instruction to get GDT base and size, and WINDBG show the GDT structure:
I use WINDBG to view memory, I found that the value of member "MustBeZero" always is not zero. :cry:
I don't know the meaning of "MustBeZero". I guess the real structure is:
Code: Select all
But how to get each item's BASE address and LIMIT?nt!_KGDTENTRY64
+0x000 LimitLow : Uint2B
+0x002 BaseLow : Uint2B
+0x004 Bytes : <unnamed-tag>
+0x004 Bits : <unnamed-tag>
+0x008 BaseUpper : Uint4B
+0x00c MustBeZero : Uint4B
+0x000 Alignment : Uint8B
I use WINDBG to view memory, I found that the value of member "MustBeZero" always is not zero. :cry:
I don't know the meaning of "MustBeZero". I guess the real structure is:
Code: Select all
correct?typedef struct _GDT
{
WORD LimitLow;
WORD BaseLow;
DWORD BytesBits;
DWORD BaseUpper;
WORD LimitUpper; //or BaseMiddle?
WORD BaseMiddle; //or LimitUpper?
}GDT, *PGDT;