 |
|
|
|
|
|
|
|
Windows内核调试
帖子发起人: lxy_xian 发起时间: 2009-07-01 08:41 上午 回复: 2
  
|
|
帖子排序:
|
|
|
|
 2009-07-01, 08:41 上午
|
lxy_xian
注册: 2009-06-01
发 贴: 6
|
|
|
1: kd> r
eax=bad0b0b0 ebx=00000000 ecx=00000810 edx=206b6444 esi=e1339008 edi=e5573690
eip=8058b5bc esp=a936ac10 ebp=a936acc4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!ObQueryNameString+0x9b:
8058b5bc 8b88a4000000 mov ecx,dword ptr [eax+0A4h] ds:0023:bad0b154=????????
///////////////////////////
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: bad0b154, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8058b5bc, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: bad0b154
FAULTING_IP:
nt!ObQueryNameString+9b
8058b5bc 8b88a4000000 mov ecx,dword ptr [eax+0A4h]
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: sesssvr.exe
LAST_CONTROL_TRANSFER: from a936c342 to 8058b5bc
STACK_TEXT:
a936acc4 a936c342 e55736a8 e1339008 00000400 nt!ObQueryNameString+0x9b
a936ad1c a936d50a 000001a0 0182ac00 83860510 HostRegmon!GetFullName+0xb2 [d:\edpregmon\sys\regsys.c @ 3643]
a936ad40 804de99f 0182ac64 000f003f 0182a9cc HostRegmon!HookRegCreateKey+0x32 [d:\edpregmon\sys\regsys.c @ 3895]
a936ad40 7c92e514 0182ac64 000f003f 0182a9cc nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0182abb0 00000000 00000000 00000000 00000000 0x7c92e514
STACK_COMMAND: kb
|
|
|
|
IP 地址: 已记录
|
报告
|
|
|
|
|
2009-07-01, 13:45 下午
|
格蠹老雷
注册: 2005-12-19
发 贴: 1,303
|
|
|
|
看一下ObQueryNameString的代码（当然是汇编:-)），就可以清楚很多：
805b86de 8b5d08 mov ebx,dword ptr [ebp+8]
把参数1（对象指针）放到寄存器EBX
805b86e1 83c3e8 add ebx,0FFFFFFE8h
减去一个对象偏移，以便指向对象的头部结构OBJECT_HEADER，也就是减去0x18
805b86e4 895dc0 mov dword ptr [ebp-40h],ebx
然后把结果赋给局部变量ebp-40h，这个局部变量现在指向了对象的头部，即OBJECT_HEADER结构
lkd> dt _OBJECT_HEADER
nt!_OBJECT_HEADER
+0x000 PointerCount : Int4B
+0x004 HandleCount : Int4B
+0x004 NextToFree : Ptr32 Void
+0x008 Type : Ptr32 _OBJECT_TYPE
+0x00c NameInfoOffset : UChar
+0x00d HandleInfoOffset : UChar
+0x00e QuotaInfoOffset : UChar
+0x00f Flags : UChar
+0x010 ObjectCreateInfo : Ptr32 _OBJECT_CREATE_INFORMATION
+0x010 QuotaBlockCharged : Ptr32 Void
+0x014 SecurityDescriptor : Ptr32 Void
+0x018 Body : _QUAD
接下来：
805b8760 8b45c0 mov eax,dword ptr [ebp-40h]
把局部变量放到寄存器EAX
805b8763 8b4008 mov eax,dword ptr [eax+8]
eax+8即对象头结构的Type字段，是_OBJECT_TYPE结构
805b8766 8b88a4000000 mov ecx,dword ptr [eax+0A4h]
取_OBJECT_TYPE结构的+A4字段，这个字段没有公开，根据下面的代码可以知道就是一个函数指针，调用它来查询对象的名字信息：
805b8793 ff7508 push dword ptr [ebp+8]
805b8796 ffd1 call ecx
上面的崩溃发生在这一句：
mov ecx,dword ptr [eax+0A4h]
看来这个对象头的_OBJECT_TYPE结构出问题了，有可能GetFullName传进来的参数就有问题，没有指向有效的对象，也有可能这个对象的结构被破坏了.......
使用内核调试跟踪一下吧
|
|
|
|
IP 地址: 已记录
|
报告
|
|
|
|
|
2009-07-02, 12:49 下午
|
lxy_xian
注册: 2009-06-01
发 贴: 6
|
|
|
|
|
|
|
IP 地址: 已记录
|
报告
|
|
|
|
|
高端调试 » 软件调试 » Windows内核调试 » Re: 急,有高手对注册表监控熟悉否???救急
|
|
|
|
|
|