核心内容摘要
PLDM FRU数据格式详解：从TLV结构到实战解析（附OEM自定义字段指南）
nt!PpSaveDeviceCapabilities函数分析保存设备Capabilities到注册表win7注册表相应地方//// Open the device instance key//status PpIrpQueryCapabilities(DeviceNode-PhysicalDeviceObject, capabilities); 返回到这里if (!NT_SUCCESS(status)) {return status;}return PpSaveDeviceCapabilities(DeviceNode,capabilities);}0: kd kc#00 nt!PpSaveDeviceCapabilities01 nt!IopQueryAndSaveDeviceNodeCapabilities02 nt!PipProcessStartPhase303 nt!PipProcessDevNodeTree04 nt!PipDeviceActionWorker05 nt!PipRequestDeviceAction06 nt!IopInitializeBootDrivers07 nt!IoInitSystem08 nt!Phase1Initialization09 nt!PspSystemThreadStartup0a nt!KiThreadStartup0: kd dvDeviceNode 0x899c1008Capabilities 0xf789a2f4unicodeName struct _UNICODE_STRING handle 0x00000008status 0n-1986260984value 0x80c8924a0: kd dx -r1 ((ntkrnlmp!_DEVICE_CAPABILITIES *)0xf789a2f
((ntkrnlmp!_DEVICE_CAPABILITIES *)0xf789a2f
: 0xf789a2f4 [Type: _DEVICE_CAPABILITIES *][0x000] Size : 0x40 [Type: unsigned short][0x002] Version : 0x1 [Type: unsigned short][0x004 ( 0:
] DeviceD1 : 0x0 [Type: unsigned long][0x004 ( 1:
] DeviceD2 : 0x0 [Type: unsigned long][0x004 ( 2:
] LockSupported : 0x0 [Type: unsigned long][0x004 ( 3:
] EjectSupported : 0x0 [Type: unsigned long][0x004 ( 4:
] Removable : 0x0 [Type: unsigned long][0x004 ( 5:
] DockDevice : 0x0 [Type: unsigned long][0x004 ( 6:
] UniqueID : 0x1 [Type: unsigned long][0x004 ( 7:
] SilentInstall : 0x1 [Type: unsigned long][0x004 ( 8:
] RawDeviceOK : 0x0 [Type: unsigned long][0x004 ( 9:
] SurpriseRemovalOK : 0x0 [Type: unsigned long][0x004 (10:
] WakeFromD0 : 0x0 [Type: unsigned long][0x004 (11:
] WakeFromD1 : 0x0 [Type: unsigned long][0x004 (12:
] WakeFromD2 : 0x0 [Type: unsigned long][0x004 (13:
] WakeFromD3 : 0x0 [Type: unsigned long][0x004 (14:
] HardwareDisabled : 0x0 [Type: unsigned long][0x004 (15:
] NonDynamic : 0x0 [Type: unsigned long][0x004 (16:
] WarmEjectSupported : 0x0 [Type: unsigned long][0x004 (17:
] NoDisplayInUI : 0x0 [Type: unsigned long][0x004 (31:
] Reserved : 0x0 [Type: unsigned long][0x008] Address : 0xffffffff [Type: unsigned long][0x00c] UINumber : 0xffffffff [Type: unsigned long][0x010] DeviceState [Type: _DEVICE_POWER_STATE [7]][0x02c] SystemWake : PowerSystemUnspecified (
[Type: _SYSTEM_POWER_STATE][0x030] DeviceWake : PowerDeviceUnspecified (
[Type: _DEVICE_POWER_STATE][0x034] D1Latency : 0x0 [Type: unsigned long][0x038] D2Latency : 0x0 [Type: unsigned long][0x03c] D3Latency : 0x0 [Type: unsigned long]0: kd dx -r1 (*((ntkrnlmp!_DEVICE_POWER_STATE (*)[7])0xf789a
)(*((ntkrnlmp!_DEVICE_POWER_STATE (*)[7])0xf789a
) [Type: _DEVICE_POWER_STATE [7]][0] : PowerDeviceUnspecified (
[Type: _DEVICE_POWER_STATE][1] : PowerDeviceD0 (
[Type: _DEVICE_POWER_STATE][2] : PowerDeviceD1 (
[Type: _DEVICE_POWER_STATE][3] : PowerDeviceUnspecified (
[Type: _DEVICE_POWER_STATE][4] : PowerDeviceUnspecified (
[Type: _DEVICE_POWER_STATE][5] : PowerDeviceD3 (
[Type: _DEVICE_POWER_STATE][6] : PowerDeviceD3 (
[Type: _DEVICE_POWER_STATE]//// Open the device instance key//status IopDeviceObjectToDeviceInstance(DeviceNode-PhysicalDeviceObject, handle, KEY_ALL_ACCESS);if (NT_SUCCESS(status)) {0: kd dvDeviceNode 0x899c1008Capabilities 0xf789a2f4unicodeName handle 0x8000027cstatus 0n-1986260984value 80: kd !handle 27cPROCESS 899a2278 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000DirBase: 0a200000 ObjectTable: e1000e38 HandleCount:
Image: SystemKernel handle table at e1000e38 with 33 entries in use027c: Object: e127f5e0 GrantedAccess: 000f003f Entry: e10044f8Object: e127f5e0 Type: (
KeyObjectHeader: e127f5c8 (old version)HandleCount: 1 PointerCount: 1Directory Object: 00000000 Name: \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\ENUM\ACPI_HAL\PNP0C08\0value (Capabilities-LockSupported) |(Capabilities-EjectSupported
|(Capabilities-WarmEjectSupported
|(Capabilities-Removable
|(Capabilities-DockDevice
|(Capabilities-UniqueID
|(Capabilities-SilentInstall
|(Capabilities-RawDeviceOK
|(Capabilities-SurpriseRemovalOK
|(Capabilities-HardwareDisabled
|(Capabilities-NonDynamic
;PiWstrToUnicodeString(unicodeName, REGSTR_VALUE_CAPABILITIES);ZwSetValueKey(handle,unicodeName,TITLE_INDEX_VALUE,REG_DWORD,value,sizeof(value));0: kd teaxf789a2d0 ebx00000000 ecx00000030 edx80a3d105 esif789a2f4 edi00000004eip80a3e2d8 espf789a2a8 ebpf789a2e0 iopl0 nv up ei pl nz na pe nccs0008 ss0010 ds0023 es0023 fs0030 gs0000 efl00000206nt!ZwSetValueKey:80a3e2d8 b800010000 mov eax,100h0: kd dv0: kd kc#00 nt!ZwSetValueKey01 nt!PpSaveDeviceCapabilities02 nt!IopQueryAndSaveDeviceNodeCapabilities03 nt!PipProcessStartPhase304 nt!PipProcessDevNodeTree05 nt!PipDeviceActionWorker06 nt!PipRequestDeviceAction07 nt!IopInitializeBootDrivers08 nt!IoInitSystem09 nt!Phase1Initialization0a nt!PspSystemThreadStartup0b nt!KiThreadStartup0: kd dv0: kd reaxf789a2d0 ebx00000000 ecx00000030 edx80a3d105 esif789a2f4 edi00000004eip80a3e2d8 espf789a2a8 ebpf789a2e0 iopl0 nv up ei pl nz na pe nccs0008 ss0010 ds0023 es0023 fs0030 gs0000 efl00000206nt!ZwSetValueKey:80a3e2d8 b800010000 mov eax,100h0: kd dd f789a2a8f789a2a8 80c8933e 8000027c f789a2d0 00000000f789a2b8 00000004 f789a2d8 00000004 899c1008f789a2c8 899c1008 00000000 001a0018 80c891daf789a2d8 00000030 8000027c f789a334 80c8bea4f789a2e8 00000000 f789a2f4 804edc6c 00010040f789a2f8 000000c0 ffffffff ffffffff 00000000f789a308 00000001 00000002 00000000 00000000f789a318 00000004 00000004 00000000 000000000: kd dd f789a2d0f789a2d0 001a0018 80c891da 00000030 8000027c0: kd dvDeviceNode 0x00000000Capabilities 0xf789a2f4unicodeName Capabilitieshandle 0x8000027cstatus 0n0value 0x300011 00000: kd dx -r1 ((ntkrnlmp!_DEVICE_CAPABILITIES *)0xf789a2f
((ntkrnlmp!_DEVICE_CAPABILITIES *)0xf789a2f
: 0xf789a2f4 [Type: _DEVICE_CAPABILITIES *][0x000] Size : 0x40 [Type: unsigned short][0x002] Version : 0x1 [Type: unsigned short][0x004 ( 0:
] DeviceD1 : 0x0 [Type: unsigned long][0x004 ( 1:
] DeviceD2 : 0x0 [Type: unsigned long][0x004 ( 2:
] LockSupported : 0x0 [Type: unsigned long][0x004 ( 3:
] EjectSupported : 0x0 [Type: unsigned long][0x004 ( 4:
] Removable : 0x0 [Type: unsigned long][0x004 ( 5:
] DockDevice : 0x0 [Type: unsigned long][0x004 ( 6:
] UniqueID : 0x1 [Type: unsigned long][0x004 ( 7:
] SilentInstall : 0x1 [Type: unsigned long][0x004 ( 8:
] RawDeviceOK : 0x0 [Type: unsigned long][0x004 ( 9:
] SurpriseRemovalOK : 0x0 [Type: unsigned long][0x004 ( 6:
] UniqueID : 0x1 [Type: unsigned long][0x004 ( 7:
] SilentInstall : 0x1 [Type: unsigned long](Capabilities-UniqueID
|(Capabilities-SilentInstall
|第四位和第五位为1。
0: kd dv valuevalue 0x30