volatilityの作法

#概要

volatilityの作法、調べてみた。
winxpsp3のスナップショット、取ってみた。

#imageinfo


```
          Suggested Profile(s) : Win2008SP1x86, Win7SP1x64, Win7SP0x64, Win10x86_15063, Win2008R2SP1x64, Win10x64_14393, Win10x64, Win2008R2SP1x64_24000, Win10x86_10586, Win7SP1x86_23418, Win10x86_10240_17770, VistaSP0x64, Win2012x64, Win10x86_14393, Win8SP1x64_18340, Win7SP1x64_23418, Win10x86, Win8SP0x64, Win10x86_17763, Win2003SP1x86, Win10x64_17134, WinXPSP3x86, Win2008SP2x64, WinXPSP1x64, Win81U1x86, Win2008R2SP0x64, Win7SP1x86, VistaSP1x86, VistaSP2x64, Win2003SP0x86, Win8SP1x86, Win10x86_17134, VistaSP2x86, Win2003SP2x64, Win2008SP2x86, Win7SP1x86_24000, Win81U1x64, Win2012R2x64_18340, Win10x64_16299, Win2016x64_14393, Win8SP0x86, Win2008R2SP1x64_23418, Win2003SP2x86, Win10x64_17763, Win7SP1x64_24000, VistaSP1x64, VistaSP0x86, Win10x64_10240_17770, Win10x86_16299, Win2003SP1x64, Win2012R2x64, WinXPSP2x64, Win2008SP1x64, WinXPSP2x86, Win7SP0x86, Win10x64_10586, Win8SP1x64, Win10x64_15063 (Instantiated with WinXPSP3x86)
                     AS Layer1 : IA32PagedMemory (Kernel AS)
                     AS Layer2 : PMemAddressSpace (Unnamed AS)
                      PAE type : No PAE
                           DTB : 0x39000L
                          KDBG : 0x8054ede0L
          Number of Processors : 1
     Image Type (Service Pack) : 3
                KPCR for CPU 0 : 0xffdff000L
             KUSER_SHARED_DATA : 0xffdf0000L
           Image date and time : 2020-02-11 12:57:33 UTC+0000
     Image local date and time : 2020-02-11 21:57:33 +0900
```



#kdbgscan


```
**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2008SP1x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win7SP1x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2008R2SP1x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x64_14393
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2008R2SP1x64_24000
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x86_10586
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win7SP1x86_23418
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x86_10240_17770
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2012x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x86_14393
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win8SP1x64_18340
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win7SP1x64_23418
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win8SP0x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x86_17763
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win7SP1x86_24000
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x64_17134
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): WinXPSP3x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2008SP2x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): WinXPSP1x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): VistaSP1x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win81U1x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2008R2SP0x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win7SP1x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): VistaSP1x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): VistaSP2x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win81U1x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2003SP2x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): WinXPSP2x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x86_17134
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2008SP1x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): VistaSP2x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2003SP2x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2008SP2x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2003SP1x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x86_15063
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2012R2x64_18340
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x64_16299
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2016x64_14393
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win8SP0x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2008R2SP1x64_23418
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): VistaSP0x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x64_17763
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win7SP1x64_24000
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win7SP0x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): VistaSP0x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x64_10240_17770
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x86_16299
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2003SP1x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2012R2x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win8SP1x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win2003SP0x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): WinXPSP2x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win7SP0x86
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x64_10586
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win8SP1x64
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

**************************************************
Instantiating KDBG using: Kernel AS WinXPSP3x86 (5.1.0 32bit)
Offset (V)                    : 0x8054ede0
Offset (P)                    : 0x54ede0
KDBG owner tag check          : True
Profile suggestion (KDBGHeader): Win10x64_15063
Version64                     : 0x8054edb8 (Major: 15, Minor: 2600)
Service Pack (CmNtCSDVersion) : 3
Build string (NtBuildLab)     : 2600.xpsp.080413-2111
PsActiveProcessHead           : 0x80563358 (15 processes)
PsLoadedModuleList            : 0x8055d1c0 (89 modules)
KernelBase                    : 0x804d9000 (Matches MZ: True)
Major (OptionalHeader)        : 5
Minor (OptionalHeader)        : 1
KPCR                          : 0xffdff000 (CPU 0)

```

以上。