pdceFirst

Author: tinysec

win32k/pdceFirst.md

@@ -0,0 +1,21 @@
+kd> !js dclist
+===========================
+  
+*** WARNING: Unable to verify timestamp for win32kbase.sys  
+gpDispInfo = 0xffffe595cc71c360    
+real_gpDispInfo = 0xffffe5d8c07829c0    
+pdceFirst = 0xffffe5d8c0782a00    
+
+|hdc|DCX_flags|pwndOrg|pwndClip|pwndRedirect|DCX_flags_text
+|----|----|----|----|----|----
+|0x0000000000000000|0x0000077C|0x0000000000000001|0xffffe5d8c0783040|0xffffe5d8c0783040|DCX_NORESETATTRS+DCX_CLIPCHILDREN+DCX_CLIPSIBLINGS+DCX_PARENTCLIP+DCX_EXCLUDERGN+DCX_EXCLUDEUPDATE+DCX_INTERSECTUPDATE+DCX_LOCKWINDOWUPDATE
+|0xffffffffa5010b78|0x00004012|0xffffe5d8c3409460|0xffffe5d8c3409460|0xffffe5d8c3405480|DCX_CACHE+DCX_CLIPSIBLINGS+0x00004000
+|0xffffffffac010ce6|0x0000401A|0xffffe5d8c3461320|0xffffe5d8c3461320|0xffffe5d8c34515c0|DCX_CACHE+DCX_CLIPCHILDREN+DCX_CLIPSIBLINGS+0x00004000
+|0xffffffffa5010c92|0x00004003|0xffffe5d8c3400820|0xffffe5d8c3400820|0xffffe5d8c3400820|DCX_WINDOW+DCX_CACHE+0x00004000
+|0x000000005f010b3f|0x1000701A|0xffffe5d8c3450fd0|0xffffe5d8c3450fd0|0xffffe5d8c3429520|DCX_CACHE+DCX_CLIPCHILDREN+DCX_CLIPSIBLINGS+0x10007000
+|0x000000003f010b15|0x1000701A|0xffffe5d8c3456fe0|0xffffe5d8c3456fe0|0xffffe5d8c34515c0|DCX_CACHE+DCX_CLIPCHILDREN+DCX_CLIPSIBLINGS+0x10007000
+|0x0000000025010b0d|0x80007003|0xffffe5d8c3400820|0xffffe5d8c3400820|0xffffe5d8c3400820|DCX_WINDOW+DCX_CACHE+0x80007000
+|0x000000004001092c|0x0000701B|0xffffe5d8c3400820|0xffffe5d8c3400820|0xffffe5d8c3400820|DCX_WINDOW+DCX_CACHE+DCX_CLIPCHILDREN+DCX_CLIPSIBLINGS+0x00007000
+|0x000000000401094d|0x80007003|0xffffe5d8c3400820|0xffffe5d8c3400820|0xffffe5d8c3400820|DCX_WINDOW+DCX_CACHE+0x80007000
+|0x0000000070010528|0x80007003|0xffffe5d8c3400820|0xffffe5d8c3400820|0xffffe5d8c3400820|DCX_WINDOW+DCX_CACHE+0x80007000
+|0x00000000060100d1|0x1000301B|0xffffe5d8c01d0820|0xffffe5d8c01d0820|0x0000000000000000|DCX_WINDOW+DCX_CACHE+DCX_CLIPCHILDREN+DCX_CLIPSIBLINGS+0x10003000