Windows源码分析 - 1.初始化内核与执行体子系统

VOID KiInitializeKernel (IN PKPROCESS Process,IN PKTHREAD Thread,IN PVOID IdleStack,      // IDLE线程的内核堆栈基地址IN PKPRCB Prcb,      // 指向处理器控制块结构IN CCHAR Number,      // 指定当前正在初始化的处理器索引号PLOADER_PARAMETER_BLOCK LoaderBlock)
{// 初始化Prcb的部分成员// ……// 在系统初始化过程(KiSystemStartup)会枚举所有CPU，// 然后循环调用KiInitializeKernel依次初始化每个CPU// 在初始化号CPU时，会初始化一部分内核数据结构if (Number == 0) {// 初始化处理器相关的全局信息// 例如KeI386NpxPresent，KeI386CpuType，KeI386CpuStep，KeI386FxsrPresent等// ……// 初始化体系无关的内核数据结构KiInitSystem();// 初始化idle线程的进程对象KeInitializeProcess(Process,…… );} else{// ……}// ……// 初始化线程对象KeInitializeThread(Thread, (PVOID)((ULONG)IdleStack),(PKSYSTEM_ROUTINE)NULL, (PKSTART_ROUTINE)NULL,(PVOID)NULL, (PCONTEXT)NULL, (PVOID)NULL, Process);// ……// 调用内核执行体的初始化例程try {ExpInitializeExecutive(Number, LoaderBlock);} except (EXCEPTION_EXECUTE_HANDLER) {KeBugCheck (PHASE0_EXCEPTION);}// ……// 如果是启动CPU（0号），动态分配内核堆栈空间和K的IOPM存储区域if (Number == 0) {PVOID DpcStack = MmCreateKernelStack(FALSE);if (DpcStack == NULL) {KeBugCheckEx(NO_PAGES_AVAILABLE, 1, 0, 0, 0);}Prcb->DpcStack = DpcStack;// 分配K的IOPM存储区域，用于BiosCall交换Ki386IopmSaveArea = ExAllocatePoolWithTag(PagedPool,PAGE_SIZE * 2,'  eK');if (Ki386IopmSaveArea == NULL) {KeBugCheckEx(NO_PAGES_AVAILABLE, 2, PAGE_SIZE * 2, 0, 0);}}// 设置IRQL为DISPATCH_LEVEL级别，允许线程派发KeRaiseIrql(DISPATCH_LEVEL, &OldIrql);// 设置当前线程优先级为0，这样才能调度Phase1Initialization线程KeSetPriorityThread(Thread, (KPRIORITY)0);// 检测是否存在就绪线程，如果不存在则把当前CPU添加到KiIdleSummaryKiAcquireQueuedSpinLock(KiQueuedSpinLockContext(LockQueueDispatcherLock));if (Prcb->NextThread == (PKTHREAD)NULL) {SetMember(Number, KiIdleSummary);}KiReleaseQueuedSpinLock(KiQueuedSpinLockContext(LockQueueDispatcherLock));// 提升IRQL到HIGH_LEVEL，屏蔽中断
KeRaiseIrql(HIGH_LEVEL, &OldIrql);return;
}

VOID KiInitSystem (VOID)
{ULONG Index;// 初始化调度队列链表头，每一个优先级都有一个独立的进程链表for (Index = 0; Index < MAXIMUM_PRIORITY; Index += 1) {InitializeListHead(&KiDispatcherReadyListHead[Index]);}// 初始化BugCheck回调函数链表，及其旋转锁InitializeListHead(&KeBugCheckCallbackListHead);KeInitializeSpinLock(&KeBugCheckCallbackLock);// 初始化定时器过期的DPC对象KeInitializeDpc(&KiTimerExpireDpc,(PKDEFERRED_ROUTINE)KiTimerExpiration, NIL);// 初始化profile链表，及其旋转锁KeInitializeSpinLock(&KiProfileLock);InitializeListHead(&KiProfileListHead);// 初始化当前活动的profile链表InitializeListHead(&KiProfileSourceListHead);// 初始化定时器链表for (Index = 0; Index < TIMER_TABLE_SIZE; Index += 1) {InitializeListHead(&KiTimerTableListHead[Index]);}// 初始化swap通知事件KeInitializeEvent(&KiSwapEvent,SynchronizationEvent,FALSE);InitializeListHead(&KiProcessInSwapListHead);InitializeListHead(&KiProcessOutSwapListHead);InitializeListHead(&KiStackInSwapListHead);InitializeListHead(&KiWaitInListHead);InitializeListHead(&KiWaitOutListHead);// 初始化SSDTKeServiceDescriptorTable[0].Base = &KiServiceTable[0];KeServiceDescriptorTable[0].Count = NULL;KeServiceDescriptorTable[0].Limit = KiServiceLimit;
#if defined(_IA64_)KeServiceDescriptorTable[0].TableBaseGpOffset =(LONG)(*(KiServiceTable-1) - (ULONG_PTR)KiServiceTable);
#endifKeServiceDescriptorTable[0].Number = &KiArgumentTable[0];for (Index = 1; Index < NUMBER_SERVICE_TABLES; Index += 1) {KeServiceDescriptorTable[Index].Limit = 0;}// 拷贝SSDT到Shadow服务表RtlCopyMemory(KeServiceDescriptorTableShadow,KeServiceDescriptorTable,sizeof(KeServiceDescriptorTable));// ……return;
}

BOOLEAN SeInitSystem( VOID )
{switch ( InitializationPhase ) {case 0 :        return SepInitializationPhase0();case 1 :        return SepInitializationPhase1();default:        KeBugCheck(UNEXPECTED_INITIALIZATION_CALL);}return 0;
}
BOOLEAN PsInitSystem ( IN ULONG Phase, IN PLOADER_PARAMETER_BLOCK LoaderBlock )
{switch ( InitializationPhase ) {case 0 :        return PspInitPhase0(LoaderBlock);case 1 :        return PspInitPhase1(LoaderBlock);default:        KeBugCheck(UNEXPECTED_INITIALIZATION_CALL);}return 0;
}
BOOLEAN PpInitSystem ( VOID )
{switch ( InitializationPhase ) {case 0 :        return PiInitPhase0();case 1 :        return PiInitPhase1();default:        KeBugCheck(UNEXPECTED_INITIALIZATION_CALL);}
}

VOID ExpInitializeExecutive(IN ULONG Number,            // CPU索引号IN PLOADER_PARAMETER_BLOCK LoaderBlock  // loader parameter block
)
{NTSTATUS Status;PLDR_DATA_TABLE_ENTRY DataTableEntry;PMESSAGE_RESOURCE_ENTRY MessageEntry;PLIST_ENTRY NextEntry;ANSI_STRING AnsiString;STRING NameString;CHAR Buffer[ 256 ];CHAR VersionBuffer[ 64 ];PCHAR s, sMajor, sMinor;ULONG ImageCount, i;BOOLEAN IncludeType[LoaderMaximum];  // 标识特定类型的内存是否存在ULONG MemoryAlloc[(sizeof(PHYSICAL_MEMORY_DESCRIPTOR) +sizeof(PHYSICAL_MEMORY_RUN)*MAX_PHYSICAL_MEMORY_FRAGMENTS) /sizeof(ULONG)];PPHYSICAL_MEMORY_DESCRIPTOR Memory;// 物理内存描述符ULONG   ResourceIdPath[3];  PIMAGE_RESOURCE_DATA_ENTRY ResourceDataEntry;PIMAGE_NT_HEADERS NtHeaders;PMESSAGE_RESOURCE_DATA  MessageData;if (Number == 0) {InitializationPhase = 0L;    // 设置为phase 0// 计算物理内存块Memory = (PPHYSICAL_MEMORY_DESCRIPTOR)&MemoryAlloc;Memory->NumberOfRuns = MAX_PHYSICAL_MEMORY_FRAGMENTS;// 包含除LoaderBad等3种外的所有内存类型for (i=0; i < LoaderMaximum; i++) {IncludeType[i] = TRUE;}IncludeType[LoaderBad] = FALSE;IncludeType[LoaderFirmwarePermanent] = FALSE;IncludeType[LoaderSpecialMemory] = FALSE;MmInitializeMemoryLimits(LoaderBlock, IncludeType, Memory);InitNlsTableBase = LoaderBlock->NlsData->AnsiCodePageData;InitAnsiCodePageDataOffset = 0;InitOemCodePageDataOffset = ((PUCHAR)LoaderBlock->NlsData->OemCodePageData 
- (PUCHAR)LoaderBlock->NlsData->AnsiCodePageData);InitUnicodeCaseTableDataOffset = ((PUCHAR)LoaderBlock->NlsData->
UnicodeCaseTableData - (PUCHAR)LoaderBlock->NlsData->AnsiCodePageData);RtlInitNlsTables((PVOID)((PUCHAR)InitNlsTableBase+InitAnsiCodePageDataOffset),(PVOID)((PUCHAR)InitNlsTableBase+InitOemCodePageDataOffset),(PVOID)((PUCHAR)InitNlsTableBase+InitUnicodeCaseTableDataOffset),&InitTableInfo);RtlResetRtlTranslations(&InitTableInfo);// 初始化HAL(Hardware Architecture Layer)if (HalInitSystem(InitializationPhase, LoaderBlock) == FALSE) {KeBugCheck(HAL_INITIALIZATION_FAILED);}#if i386// 允许中断KiRestoreInterrupts (TRUE);
#endif// ……// LoadOrderListHead的第一结点必定是内核模块(例如ntoskrnl.exe)DataTableEntry = CONTAINING_RECORD(LoaderBlock->LoadOrderListHead.Flink,LDR_DATA_TABLE_ENTRY,InLoadOrderLinks);ResourceIdPath[0] = 11;ResourceIdPath[1] = 1;ResourceIdPath[2] = 0;// 寻找BugCheck消息资源，并设置到KiBugCodeMessages// LdrFindResource_U在指定DLL中定位指定ID的资源Status = LdrFindResource_U(DataTableEntry->DllBase,    // DLL模块基地址ResourceIdPath,        // 资源ID数组3,              // 资源ID数组长度(VOID *) &ResourceDataEntry);  // 指向IMAGE_RESOURCE_DATA_ENTRY结构if (NT_SUCCESS(Status)) {Status = LdrAccessResource(DataTableEntry->DllBase,ResourceDataEntry,&MessageData,NULL);if (NT_SUCCESS(Status)) {KiBugCodeMessages = MessageData;}}// 遍历已加载的模块列表，并加载符号文件ImageCount = 0;NextEntry = LoaderBlock->LoadOrderListHead.Flink;while (NextEntry != &LoaderBlock->LoadOrderListHead) {// 获取LDR_DATA_TABLE_ENTRY结构指针DataTableEntry = CONTAINING_RECORD(NextEntry,LDR_DATA_TABLE_ENTRY,InLoadOrderLinks);// 通过内核调试器加载模块符号sprintf( Buffer, "%ws\\System32\\%s%wZ",&SharedUserData->NtSystemRoot[2],ImageCount++ < 2 ? "" : "Drivers\\",&DataTableEntry->BaseDllName);RtlInitString( &NameString, Buffer );DbgLoadImageSymbols(&NameString, DataTableEntry->DllBase, (ULONG)-1);NextEntry = NextEntry->Flink;    // 下一个结点}} else {// 初始化HALif (HalInitSystem(InitializationPhase, LoaderBlock) == FALSE) {KeBugCheck(HAL_INITIALIZATION_FAILED);}}if (Number == 0) {// ……// 初始化执行体(phase 0)if (!ExInitSystem()) {KeBugCheck(PHASE0_INITIALIZATION_FAILED);}ExBurnMemory(LoaderBlock);// 初始化内存管理器(phase 0)MmInitSystem(0, LoaderBlock, Memory);{PLIST_ENTRY NextMd;PMEMORY_ALLOCATION_DESCRIPTOR MemoryDescriptor;// 遍历内存描述符，统计LoaderNlsData类型内存区域总大小NextMd = LoaderBlock->MemoryDescriptorListHead.Flink;while (NextMd != &LoaderBlock->MemoryDescriptorListHead) {MemoryDescriptor = CONTAINING_RECORD(NextMd,MEMORY_ALLOCATION_DESCRIPTOR,ListEntry);switch (MemoryDescriptor->MemoryType) {case LoaderNlsData:InitNlsTableSize += MemoryDescriptor->PageCount*PAGE_SIZE;break;default:break;}NextMd = MemoryDescriptor->ListEntry.Flink;}// 分配非分页的NLS区域InitNlsTableBase = ExAllocatePoolWithTag(NonPagedPool,InitNlsTableSize,' 
slN');if ( !InitNlsTableBase ) {KeBugCheck(PHASE0_INITIALIZATION_FAILED);}// 拷贝NLS数据到刚才分配的区域RtlMoveMemory(InitNlsTableBase,LoaderBlock->NlsData->AnsiCodePageData,InitNlsTableSize);// 初始化NLS表信息结构RtlInitNlsTables((PVOID)((PUCHAR)InitNlsTableBase+InitAnsiCodePageDataOffset),(PVOID)((PUCHAR)InitNlsTableBase+InitOemCodePageDataOffset),(PVOID)((PUCHAR)InitNlsTableBase+InitUnicodeCaseTableDataOffset),&InitTableInfo);RtlResetRtlTranslations(&InitTableInfo);}// ……// 初始化静态句柄表ExInitializeHandleTablePackage();// 初始化对象管理器(phase 0)if (!ObInitSystem()) {KeBugCheck(OBJECT_INITIALIZATION_FAILED);}// 初始化安全引用监视器(phase 0)if (!SeInitSystem()) {KeBugCheck(SECURITY_INITIALIZATION_FAILED);}// 初始化进程管理器(phase 0)if (PsInitSystem(0, LoaderBlock) == FALSE) {KeBugCheck(PROCESS_INITIALIZATION_FAILED);}// 初始化即插即用管理器(phase 0)if (!PpInitSystem()) {KeBugCheck(PP0_INITIALIZATION_FAILED);}// 设置SharedUserData成员// ……}
}

BOOLEAN PspInitPhase0 ( IN PLOADER_PARAMETER_BLOCK LoaderBlock   )
{UNICODE_STRING NameString;OBJECT_ATTRIBUTES ObjectAttributes;OBJECT_TYPE_INITIALIZER ObjectTypeInitializer;HANDLE ThreadHandle;PETHREAD Thread;MM_SYSTEMSIZE SystemSize;SystemSize = MmQuerySystemSize();
PspDefaultPagefileLimit = (ULONG)-1;
// ……// 初始化进程相关的锁ExInitializeFastMutex( &PspProcessLockMutex );ExInitializeFastMutex( &PsProcessSecurityLock );// 当前进程即是Idle进程PsIdleProcess = PsGetCurrentProcess();PsIdleProcess->Pcb.KernelTime = 0;PsIdleProcess->Pcb.KernelTime = 0;// 初始化OBJECT_TYPE_INITIALIZER结构RtlZeroMemory( &ObjectTypeInitializer, sizeof( ObjectTypeInitializer ) );ObjectTypeInitializer.Length = sizeof( ObjectTypeInitializer );ObjectTypeInitializer.InvalidAttributes = OBJ_OPENLINK;ObjectTypeInitializer.SecurityRequired = TRUE;ObjectTypeInitializer.PoolType = NonPagedPool;ObjectTypeInitializer.InvalidAttributes = OBJ_PERMANENT | OBJ_EXCLUSIVE | 
OBJ_OPENIF;// 创建进程对象RtlInitUnicodeString(&NameString, L"Process");ObjectTypeInitializer.DefaultPagedPoolCharge = PSP_PROCESS_PAGED_CHARGE;ObjectTypeInitializer.DefaultNonPagedPoolCharge = 
PSP_PROCESS_NONPAGED_CHARGE;ObjectTypeInitializer.DeleteProcedure = PspProcessDelete; // 
删除进程对象回调函数ObjectTypeInitializer.ValidAccessMask = PROCESS_ALL_ACCESS;ObjectTypeInitializer.GenericMapping = PspProcessMapping;if ( !NT_SUCCESS(ObCreateObjectType(&NameString,&ObjectTypeInitializer,(PSECURITY_DESCRIPTOR) NULL,&PsProcessType)) ){return FALSE;}// 创建线程对象RtlInitUnicodeString(&NameString, L"Thread");ObjectTypeInitializer.DefaultPagedPoolCharge = PSP_THREAD_PAGED_CHARGE;ObjectTypeInitializer.DefaultNonPagedPoolCharge = 
PSP_THREAD_NONPAGED_CHARGE;ObjectTypeInitializer.DeleteProcedure = PspThreadDelete; // 
删除线程对象回调函数ObjectTypeInitializer.ValidAccessMask = THREAD_ALL_ACCESS;ObjectTypeInitializer.GenericMapping = PspThreadMapping;if ( !NT_SUCCESS(ObCreateObjectType(&NameString,&ObjectTypeInitializer,(PSECURITY_DESCRIPTOR) NULL,&PsThreadType)) ){return FALSE;}// 创建Job对象RtlInitUnicodeString(&NameString, L"Job");ObjectTypeInitializer.DefaultPagedPoolCharge = 0;ObjectTypeInitializer.DefaultNonPagedPoolCharge = sizeof(EJOB);ObjectTypeInitializer.DeleteProcedure = PspJobDelete;  // 删除Job
对象回调函数ObjectTypeInitializer.CloseProcedure = PspJobClose;    // 关闭Job对象回调函数ObjectTypeInitializer.ValidAccessMask = JOB_OBJECT_ALL_ACCESS;ObjectTypeInitializer.GenericMapping = PspJobMapping;ObjectTypeInitializer.InvalidAttributes = 0;if ( !NT_SUCCESS(ObCreateObjectType(&NameString,&ObjectTypeInitializer,(PSECURITY_DESCRIPTOR) NULL,&PsJobType)) ){return FALSE;}// 初始化进程链表，及保护该链表的互斥对象InitializeListHead(&PsActiveProcessHead);ExInitializeFastMutex(&PspActiveProcessMutex);// 初始化Job链表，及保护该链表的互斥对象InitializeListHead(&PspJobList);ExInitializeFastMutex(&PspJobListLock);// 初始化工作集链表，及保护该链表的互斥对象InitializeListHead(&PspWorkingSetChangeHead.Links);ExInitializeFastMutex(&PspWorkingSetChangeHead.Lock);// 创建CID句柄表PspCidTable = ExCreateHandleTable(NULL);if ( ! PspCidTable ) {return FALSE;}// ?? 从链表中移除CID表，避免被ExSnapShotHandleTables或调试器扩展命令!
handle枚举到ExRemoveHandleTable(PspCidTable);#if defined(i386)// ?? LDT初始化if ( !NT_SUCCESS(PspLdtInitialize()) ) {return FALSE;}// ?? VDM初始化if ( !NT_SUCCESS(PspVdmInitialize()) ) {return FALSE;}
#endif// 初始化Reaper链表及数据结构InitializeListHead(&PsReaperListHead);ExInitializeWorkItem(&PsReaperWorkItem, PspReaper, NULL);// 保存系统启动进程令牌到全局变量PspBootAccessTokenPspBootAccessToken = PsGetCurrentProcess()->Token;// 初始化对象安全属性结构InitializeObjectAttributes( &ObjectAttributes,NULL,0,NULL,NULL); // 创建系统进程if ( !NT_SUCCESS(PspCreateProcess(&PspInitialSystemProcessHandle,PROCESS_ALL_ACCESS,&ObjectAttributes,0L,FALSE,0L,0L,0L)) ) {return FALSE;}// 增加引用计数，并获取EPROCESS结构，保存到全局变量PsInitialSystemProcessif ( !NT_SUCCESS(ObReferenceObjectByHandle(PspInitialSystemProcessHandle,0L,PsProcessType,KernelMode,(PVOID *)&PsInitialSystemProcess,NULL)) ) {return FALSE;}// 设置当前进程映像名称为"Idle"strcpy(&PsGetCurrentProcess()->ImageFileName[0],"Idle");// 设置新创建的进程映像名称为"System"strcpy(&PsInitialSystemProcess->ImageFileName[0],"System");// 创建系统线程用于实现phase1的初始化过程，线程函数为Phase1Initializationif ( !NT_SUCCESS(PsCreateSystemThread(&ThreadHandle,THREAD_ALL_ACCESS,&ObjectAttributes,0L,NULL,Phase1Initialization,(PVOID)LoaderBlock)) ) {return FALSE;}// 增加引用计数if ( !NT_SUCCESS(ObReferenceObjectByHandle(ThreadHandle,0L,PsThreadType,KernelMode,(PVOID *)&Thread,NULL)) ) {return FALSE;}// 关闭线程句柄ZwClose( ThreadHandle );return TRUE;
}

VOID Phase1Initialization (IN PVOID Context)
{Phase1InitializationDiscard (Context);MmZeroPageThread();return;
}

VOID Phase1InitializationDiscard (IN PVOID Context)
{PLOADER_PARAMETER_BLOCK LoaderBlock;PETHREAD Thread;PKPRCB Prcb;KPRIORITY Priority;NTSTATUS Status;UNICODE_STRING SessionManager;PRTL_USER_PROCESS_PARAMETERS ProcessParameters;PVOID Address;SIZE_T Size;LARGE_INTEGER UniversalTime;LARGE_INTEGER CmosTime;LARGE_INTEGER OldTime;TIME_FIELDS TimeFields;UNICODE_STRING EnvString, NullString, UnicodeSystemDriveString;PWSTR Src, Dst;BOOLEAN ResetActiveTimeBias;HANDLE NlsSection;LARGE_INTEGER SectionSize;LARGE_INTEGER SectionOffset;PVOID SectionBase;PVOID ViewBase;ULONG CacheViewSize;SIZE_T CapturedViewSize;ULONG SavedViewSize;LONG BootTimeZoneBias;PKLDR_DATA_TABLE_ENTRY DataTableEntry;
#ifndef NT_UPPMESSAGE_RESOURCE_ENTRY MessageEntry1;
#endifPCHAR MPKernelString;PCHAR Options;PCHAR YearOverrideOption;LONG  CurrentYear = 0;BOOLEAN NOGUIBOOT;BOOLEAN SOS;PVOID Environment;PRTL_USER_PROCESS_INFORMATION ProcessInformation;// ……/////    进入phase1初始化阶段      ////InitializationPhase = 1;// 提升线程优先级Thread = PsGetCurrentThread();Priority = KeSetPriorityThread( &Thread->Tcb,MAXIMUM_PRIORITY - 1 );// [1] 调用HalInitSystem，让系统做好准备接受来自设置的中断，并允许中断LoaderBlock = (PLOADER_PARAMETER_BLOCK)Context;if (HalInitSystem(InitializationPhase, LoaderBlock) == FALSE) {KeBugCheck(HAL1_INITIALIZATION_FAILED);}// 根据处理器控制块的LoadOptions成员判断是否以GUI方式启动Options = LoaderBlock->LoadOptions ? _strupr(LoaderBlock->LoadOptions) : NULL;if (Options) {NOGUIBOOT = (BOOLEAN)(strstr(Options, "NOGUIBOOT") != NULL);} else {NOGUIBOOT = FALSE;}// [2] 调用引导视频驱动程序(Bootvid.dll)InbvEnableBootDriver((BOOLEAN)!NOGUIBOOT);// 初始化视频驱动程序InbvDriverInitialize(LoaderBlock, 18);// 显示启动界面// ……// [3] 初始化电源管理器(phase0)if (!PoInitSystem(0)) {KeBugCheck(INTERNAL_POWER_ERROR);}// ……// [4] 初始化系统时间和系统启动时间if (ExCmosClockIsSane && HalQueryRealTimeClock(&TimeFields)) {// ……// 设置系统时间KeSetSystemTime(&UniversalTime, &OldTime, FALSE, NULL);// 通知其他组建系统时间被设置PoNotifySystemTimeSet();// 设置系统启动的绝对时间KeBootTime = UniversalTime;KeBootTimeBias = 0;}// ……// [5] 在多处理器系统上，初始化其他处理器KeStartAllProcessors();// ……// [6] 初始化对象管理器(phase1)if (!ObInitSystem()) {KeBugCheck(OBJECT1_INITIALIZATION_FAILED);}// [7] 初始化执行体(phase1)if (!ExInitSystem()) {KeBugCheckEx(PHASE1_INITIALIZATION_FAILED,STATUS_UNSUCCESSFUL,0,1,0);}// [8] 初始化内核(phase1)if (!KeInitSystem()) {KeBugCheckEx(PHASE1_INITIALIZATION_FAILED,STATUS_UNSUCCESSFUL,0,2,0);}// [9] 初始化内核调试器(phase1)if (!KdInitSystem(InitializationPhase, NULL)) {KeBugCheckEx(PHASE1_INITIALIZATION_FAILED,STATUS_UNSUCCESSFUL,0,3,0);}// [10] 初始化安全引用监视器(phase1)if (!SeInitSystem()) {KeBugCheck(SECURITY1_INITIALIZATION_FAILED);}// 设置进度条到%InbvUpdateProgressBar(10);Status = CreateSystemRootLink(LoaderBlock);if ( !NT_SUCCESS(Status) ) {KeBugCheckEx(SYMBOLIC_INITIALIZATION_FAILED,Status,0,0,0);}// [11] 初始化内存管理器(phase1)if (MmInitSystem(1, LoaderBlock) == FALSE) {KeBugCheck(MEMORY1_INITIALIZATION_FAILED);}// [12] 把国家语言支持(NLS)表映射到系统空间// ……// [13] 初始化缓存管理器if (!CcInitializeCacheManager()) {KeBugCheck(CACHE_INITIALIZATION_FAILED);}// [14] 初始化配置管理器if (!CmInitSystem1(LoaderBlock)) {KeBugCheck(CONFIG_INITIALIZATION_FAILED);}// ??CcPfInitializePrefetcher();// 设置进度条到%InbvUpdateProgressBar(15);// 计算时区偏差// ……// [15] 初始化全局的文件系统驱动程序数据结构if (!FsRtlInitSystem()) {KeBugCheck(FILE_INITIALIZATION_FAILED);}// 在PNP初始化时需要使用range list，因而在PNP初始化之前需要初始化range listRtlInitializeRangeListPackage();HalReportResourceUsage();KdDebuggerInitialize1(LoaderBlock);// [16] 初始化即插即用管理器(PNP)(phase1)，必须在初始化I/O管理器之前进行if (!PpInitSystem()) {KeBugCheck(PP1_INITIALIZATION_FAILED);}// 设置进度条到%InbvUpdateProgressBar(20);// [17] 初始化LPC，必须在初始化I/O管理器之前进行if (!LpcInitSystem()) {KeBugCheck(LPC_INITIALIZATION_FAILED);}// 此时系统已经处于运行阶段ExInitSystemPhase2();// [18] 初始化I/O管理器，设置进度条为局部更新模式，逐步更新进度条从%到%InbvSetProgressBarSubset(25, 75);if (!IoInitSystem(LoaderBlock)) {KeBugCheck(IO1_INITIALIZATION_FAILED);}// 撤消局部更新模式InbvSetProgressBarSubset(0, 100);CmpInitSystemVersion(6, NULL);// [19] 初始化内存管理器(phase2)，开启分页机制MmInitSystem(2, LoaderBlock);// 设置进度条到%InbvUpdateProgressBar(80);// [20] 初始化电源管理器(phase1)if (!PoInitSystem(1)) {KeBugCheck(INTERNAL_POWER_ERROR);}// [21] 初始化进程管理器(phase1)// 由于SystemRoot已经被定义，可以定位NTDLL.DLL和SMSS.EXEif (PsInitSystem(1, LoaderBlock) == FALSE) {KeBugCheck(PROCESS1_INITIALIZATION_FAILED);}// 设置进度条到%InbvUpdateProgressBar(85);if (LoaderBlock == KeLoaderBlock) {KeLoaderBlock = NULL;}// 释放加载器Ntldr参数信息块MmFreeLoaderBlock (LoaderBlock);LoaderBlock = NULL;Context = NULL;// [22] 初始化性能引用监视器(phase1)，包括创建命令服务器线程，// 这个线程将会创建一个名为SeRmCommandPort的LPC端口。// 使用这个端口可以接收本地安全认证子系统(LSASS)发送的命令。if (!SeRmInitPhase1()) {KeBugCheck(REFMON_INITIALIZATION_FAILED);}// 设置进度条到%InbvUpdateProgressBar(90);// 设置会话管理器子系统(SMSS)进程信息// ……// [23] 创建会话管理器进程(SMSS)Status = RtlCreateUserProcess(&SessionManager,OBJ_CASE_INSENSITIVE,RtlDeNormalizeProcessParams( ProcessParameters ),NULL,NULL,NULL,FALSE,NULL,NULL,ProcessInformation);// ……// 设置进度条到%InbvUpdateProgressBar(100);InbvEnableDisplayString(TRUE);// [24] 等SMSS.EXE 5秒，如果等待超时表明SMSS进程正常启动OldTime.QuadPart = Int32x32To64(5, -(10 * 1000 * 1000));Status = ZwWaitForSingleObject(ProcessInformation->Process,FALSE,&OldTime);if (Status == STATUS_SUCCESS) {KeBugCheck(SESSION5_INITIALIZATION_FAILED);}// 空间释放与关闭句柄// ……// 系统启动成功后设置InitializationPhase为InitializationPhase += 1;
}