|
事情是这样的,我今天一不小心点开了QQ空间,很自然的IE6启动了,没想到一打开就挂了,WINDBG自动挂上去后看了一下栈回朔和EIP,初步感觉是栈缓冲区溢出了,EIP被指向了一个无效的地址,但我看了一下出事的地点ESP中的返回值是很正常的也就是没被破坏,因为这个情况不是经常出现,可能一个月出现一次吧,所以重新下断点观察是不可能了,我又想到了观察一下参数,于是跟进了shlwapi!_imp__RegQueryValueExW这个函数,可是这个函数好象是混淆了,论坛的哥哥姐姐谁帮看看啊! ! 好像传不了附件@.@ 这是栈信息 0:000> kb ChildEBP RetAddr Args to Child WARNING: Frame IP not in any known module. Following frames may be wrong. 0012e1c0 77f442c7 000000f8 7d595484 00000000 0x6465c603 0012e638 77f44499 000000f8 7d595484 00000000 shlwapi!RegQueryValueExWrapW+0x17d 0012e780 77f4457f 000000f8 7d595484 0000ffff shlwapi!SHRegQueryValueW+0x88 0012e8c8 77f445b8 80000002 0012e91c 7d595484 shlwapi!SHRegGetValueW+0x10c 0012e8ec 77f4c150 80000002 0012e91c 7d595484 shlwapi!SHGetValueW+0x21 0012eb28 77f46cfe 00000000 7d596ec8 7d595484 shlwapi!SHGetRestriction+0x67 0012eb48 7d5bc50d 00800000 00000000 7d5954d0 shlwapi!SHRestrictionLookup+0x4e 0012eb60 7d5d8282 00800000 0014d478 0012ee10 shell32!SHRestricted+0x32 0012ed88 7d5d7e91 0012ee10 7c937c58 ffffffff shell32!_RefreshSettingsFromReg+0x293 0012edd8 7d5d7e63 0014d478 0000000c 00000000 shell32!_RefreshSettings+0x21 0012edf4 7d604712 0012ee10 00000400 00000000 shell32!SHGetSetSettings+0x5e 0012ee54 75f1a5c2 75f78148 0000000c 0014d478 shell32!ReadCabinetState+0x21 0012ee6c 75f154bf 0012ee84 0014d478 00000000 browseui!GetCabState+0x42 0012fef0 7e5d9b00 0014d478 00000000 00000000 browseui!SHOpenFolderWindow+0x36 0012ff10 00402372 001423ba 00020dc8 0776ede4 shdocvw!IEWinMain+0x133 0012ff60 00402444 00400000 00000000 001423ba IEXPLORE!WinMainT+0x2de 0012ffc0 7c817077 0776ede4 00000018 7ffd9000 IEXPLORE!_ModuleEntry+0x99 0012fff0 00000000 00402451 00000000 00000000 kernel32!BaseProcessStart+0x23
跟进shlwapi!_imp__RegQueryValueExW函数的部分代码,这部分感觉不正常0.0 0:000> uf 77f4101c Flow analysis was incomplete, some code may be missing shlwapi!_imp__RegQueryValueExW: 77f4101c 7aa7 jp shlwapi!_imp__RegCloseKey <PERF> (shlwapi+0xfc5) (77f40fc5)
shlwapi!_imp__RegQueryValueExW+0x2: 77f4101e 06 push es 77f4101f 008ea70600a0 add byte ptr [esi-5FFFF959h],cl 77f41025 a7 cmps dword ptr [esi],dword ptr es:[edi] 77f41026 06 push es 77f41027 00b2a70600c6 add byte ptr [edx-39FFF959h],dh 77f4102d a7 cmps dword ptr [esi],dword ptr es:[edi] 77f4102e 06 push es 77f4102f 00d6 add dh,dl 77f41031 a7 cmps dword ptr [esi],dword ptr es:[edi] 77f41032 06 push es 77f41033 00e4 add ah,ah 77f41035 a7 cmps dword ptr [esi],dword ptr es:[edi] 77f41036 06 push es 77f41037 00f2 add dl,dh 77f41039 a7 cmps dword ptr [esi],dword ptr es:[edi] 77f4103a 06 push es 77f4103b 0002 add byte ptr [edx],al 77f4103d a806 test al,6 77f4103f 0016 add byte ptr [esi],dl 77f41041 a806 test al,6 77f41043 0028 add byte ptr [eax],ch 77f41045 a806 test al,6 77f41047 0038 add byte ptr [eax],bh 77f41049 a806 test al,6 77f4104b 0046a8 add byte ptr [esi-58h],al 77f4104e 06 push es 77f4104f 0058a8 add byte ptr [eax-58h],bl 77f41052 06 push es 77f41053 006aa8 add byte ptr [edx-58h],ch 77f41056 06 push es 77f41057 007aa8 add byte ptr [edx-58h],bh 77f4105a 06 push es 77f4105b 008ea80600a4 add byte ptr [esi-5BFFF958h],cl 77f41061 a806 test al,6 77f41063 00b8a80600c2 add byte ptr [eax-3DFFF958h],bh 77f41069 a806 test al,6 77f4106b 00cc add ah,cl 77f4106d a806 test al,6 环境:windows xp sp3 32位
|