观察NdbGeoUefi

2024.05.01
NDB找到和识别被调试对象，需要地标，UEFI的地标是NdbGeoUefi。

确认符号出现在哪个Module，DxeCore：

lm极其重要的数据结构出现了：
000000003ec55a78 000000003ec555f0 DxeCore!mDebugInfoTableHeader

具体参阅： NDB lm命令实现的猜想

NdbGeoUefi 这个地标结构体存在什么固定地方给NDB搜索呢，答案是 0xff090018：


这个地址是什么地方？SYSTEM_SRAM：

用NDB实际读取验证一下：

另外两个熟悉的地址：

NDB操作记录：

x DxeCore!NdbGeoUefi
00000000`3ec55a70  DxeCore!NdbGeoUefi 
dt NDB_GEO_UEFI 00000000`3ec55a70
   +0x000 NdbMagic         : 0x47454649
   +0x004 Version          : 0x1 ''
   +0x005 Size             : 0x10 ''
   +0x006 MachineType      : 0xaa64
   +0x008 AddrDebugImgTableHeader : 1053119984
?? sizeof(NDB_GEO_UEFI)
unsigned int64 0x10
dqs 00000000`3ec55a70 l10/8
00000000`3ec55a70  aa641001`47454649
00000000`3ec55a78  00000000`3ec555f0 DxeCore!mDebugInfoTableHeader
da 00000000`3ec55a70
00000000`3ec55a70  "IFEG..d..U.>"
dd 0`ff090018 l1
00000000`ff090018  3ec55a70
dd 0`ff090000
00000000`ff090000  bdfaf5fd 7ff59df9 f1f7f3ed e86d5df3
00000000`ff090010  faffeadf 44d1e7fb 3ec55a70 00000000
00000000`ff090020  fbc7fffb f7f7bff8 d4bb6f7c f52ddf4c
00000000`ff090030  de5475dd 7fb6c73b adffdd7f 7fda6eee
00000000`ff090040  fa109800 230c4c61 0d08b441 20054400
00000000`ff090050  4024b60e c3b16086 161cc816 50420e26
00000000`ff090060  c0890f94 409e97e0 69aa29ab 17414942
00000000`ff090070  882884a9 2244253e 3394b000 00829181
dqs 00000000`3ec55a70 l1
00000000`3ec55a70  aa641001`47454649
dd 0`ff090018 l1
00000000`ff090018  3ec55a70
dd 0`ff090000
00000000`ff090000  bdfaf5fd 7ff59df9 f1f7f3ed e86d5df3
00000000`ff090010  faffeadf 44d1e7fb 3ec55a70 00000000
00000000`ff090020  fbc7fffb f7f7bff8 d4bb6f7c f52ddf4c
00000000`ff090030  de5475dd 7fb6c73b adffdd7f 7fda6eee
00000000`ff090040  fa109800 230c4c61 0d08b441 20054400
00000000`ff090050  4024b60e c3b16086 161cc816 50420e26
00000000`ff090060  c0890f94 409e97e0 69aa29ab 17414942
00000000`ff090070  882884a9 2244253e 3394b000 00829181
dqs 0`ff090018 l1
00000000`ff090018  00000000`3ec55a70 DxeCore!NdbGeoUefi
dqs 0`ff090000
00000000`ff090000  7ff59df9`bdfaf5fd
00000000`ff090008  e86d5df3`f1f7f3ed
00000000`ff090010  44d1e7fb`faffeadf
00000000`ff090018  00000000`3ec55a70 DxeCore!NdbGeoUefi
00000000`ff090020  f7f7bff8`fbc7fffb
00000000`ff090028  f52ddf4c`d4bb6f7c
00000000`ff090030  7fb6c73b`de5475dd
00000000`ff090038  7fda6eee`adffdd7f
00000000`ff090040  230c4c61`fa109800
00000000`ff090048  20054400`0d08b441
00000000`ff090050  c3b16086`4024b60e
00000000`ff090058  50420e26`161cc816
00000000`ff090060  409e97e0`c0890f94
00000000`ff090068  17414942`69aa29ab
00000000`ff090070  2244253e`882884a9
00000000`ff090078  00829181`3394b000
Opcode 0x38401401, DSCR.ERR=1, DSCR.EL=2
dd 0`ff098010 l1
00000000`ff098010  f5a9d72d
dd 0`ff098000 l4
00000000`ff098000  b7ff7f3e d74bd739 fccdfdf8 ffe3ded6
dd 0`ff098000 l8
00000000`ff098000  b7ff7f3e d74bd739 fccdfdf8 ffe3ded6
00000000`ff098010  f5a9d72d f1a4afdf 7fef961c 7cef4ab6
dd 0`fd5f8098 l1
00000000`fd5f8098  000055aa
dd 0`fd58c318 l1
00000000`fd58c318  00004740