Re: 大家帮我看看这种汇编的写法究竟是什么问题？
C/C++本地代码调试
大家帮我看看这种汇编的写法究竟是什么问题？
skyNirvana
2010-05-19, 14:35 下午
我在尝试全局挂钩，但有时会在explorer里面出这个错误，而且是错一个call语句上，用windbg输出一些内容，搞不懂为何这个语句会出现内存访问错误
0:000> g
(cb0.d94): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000005 ebx=0007fcd8 ecx=00000000 edx=00000000 esi=00050005 edi=00000005
eip=01c71050 esp=0007fc24 ebp=0007fc54 iopl=0 nv up ei ng nz na pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010287
ProxyDll!GetEndAddr:
01c71050 e800000000 call ProxyDll!GetEndAddr+0x5 (01c71055)
0:000> u
ProxyDll!GetEndAddr:
01c71050 e800000000 call ProxyDll!GetEndAddr+0x5 (01c71055)
01c71055 58 pop eax
01c71056 83e805 sub eax,5
01c71059 c3 ret
01c7105a 0000 add byte ptr [eax],al
01c7105c 0000 add byte ptr [eax],al
01c7105e 0000 add byte ptr [eax],al
01c71060 0000 add byte ptr [eax],al
0:000> !address 01c71050
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\USER32.dll -
01c70000 : 01c71000 - 00001000
Type 01000000 MEM_IMAGE
Protect 00000004 PAGE_READWRITE
State 00001000 MEM_COMMIT
Usage RegionUsageImage
FullPath D:\temp\release\ProxyDll.dll
0:000> k
ChildEBP RetAddr
0007fc54 01c7285d ProxyDll!GetEndAddr
0007fc68 77d31923 ProxyDll!HookCBTProc+0x5d [d:\temp\proxydll\proxydll.cpp @ 389]
WARNING: Stack unwind information not available. Following frames may be wrong.
0007fc9c 77d4f94c USER32!UnhookWinEvent+0x77
0007fcc0 7c92e473 USER32!InsertMenuItemA+0x23c
0007fce4 77d299ff ntdll!KiUserCallbackDispatcher+0x13
0007fd2c 7d72ec17 USER32!SetWindowPos+0xc
0007fd4c 7d6294a2 SHELL32!SHCreateLocalServerRunDll+0x432
0007fd98 7d5b7aca SHELL32!SHCreateQueryCancelAutoPlayMoniker+0x17494
0007fdc0 77d18734 SHELL32!Ordinal517+0x27aca
0007fdec 77d18816 USER32!GetDC+0x6d
0007fe54 77d189cd USER32!GetDC+0x14f
0007feb4 77d18a10 USER32!GetWindowLongW+0x127
0007fec4 7d5b7b7d USER32!DispatchMessageW+0xf
0007fef0 7d5b7a12 SHELL32!Ordinal517+0x27b7d
0007ff08 7d5e3ab4 SHELL32!Ordinal517+0x27a12
0007ff14 01013256 SHELL32!Ordinal201+0x28
0007ff5c 0101a5c7 explorer+0x13256
Re: 大家帮我看看这种汇编的写法究竟是什么问题？
格蠹老雷
2010-05-19, 20:37 下午
因为目标地址所在的内存页缺少可执行属性(PAGE_EXECUTE_READ)，估计是编辑代码时改内存页属性忘记改回去了...
Re: 大家帮我看看这种汇编的写法究竟是什么问题？
skyNirvana
2010-05-20, 11:35 上午
谢谢raymond，己解决
Re: 大家帮我看看这种汇编的写法究竟是什么问题？
Forward
2010-12-22, 16:32 下午
张老师，总是一语中的，能说下，您的分析过程么？