锘??xml version="1.0" encoding="utf-8" standalone="yes"?> TEB at 7fffe000 ExceptionList: 0012ff88 StackBase: 00130000 StackLimit: 00126000 ………. 2. 鎵撳紑鏁翠釜綰跨▼鏍? 3. 瀵熺湅鍐呭瓨涓墍鏈夊彲鑳芥槸鍑芥暟榪斿洖鍊?/span>.
{
int ithread = 0;
_asm{
xor esi , esi
mov eax, fs:[esi+18h]
mov ecx, [eax+ 20h]
mov eax, [eax+ 24h]
mov dword ptr[ithread], eax
}
return ithread;
}
浠嶧S瀵勫瓨鍣ㄨ幏鍙栧綋鍓嶈繘紼婭D
int GetProcessId()
{
int iProcess = 0;
_asm{
xor esi , esi
mov eax, fs:[esi+18h]
mov ecx, [eax+ 20h]
mov eax, [eax+ 24h]
mov dword ptr[iProcess ], ecx
}
return iProcess ;
}
鍘熺悊錛?br>1.fs:18h 鍦板潃鎸囧悜綰跨▼鐜鍧梍TEB
鎵撳紑windbg鍙互璇佹槑錛?br>0:028> dd fs:18h L1
0053:00000018 7eeb8000
0:028> !teb
TEB at 7eeb8000
ExceptionList: 1f8ff15c
StackBase: 1f900000
StackLimit: 1f8fc000
SubSystemTib: 00000000
FiberData: 00001e00
ArbitraryUserPointer: 00000000
Self: 7eeb8000
EnvironmentPointer: 00000000
ClientId: 00001a30 . 00001408
RpcHandle: 00000000
Tls Storage: 133d2718
PEB Address: 7efde000
LastErrorValue: 0
LastStatusValue: c0000302
Count Owned Locks: 0
HardErrorMode: 0
2. 鍦╛TEB涓壘鍒扮嚎紼婭D鍜岃繘紼婭D
0:028> dt ntdll!_TEB
+0x000 NtTib : _NT_TIB
+0x01c EnvironmentPointer : Ptr32 Void
+0x020 ClientId : _CLIENT_ID
0:028> dt ntdll!_CLIENT_ID
+0x000 UniqueProcess : Ptr32 Void >榪涚▼ID
+0x004 UniqueThread : Ptr32 Void >綰跨▼ID
褰撶劧浠嶵EB鍙堝彲浠ユ壘鍒癬PEB鐨勫湴鍧錛屼粠_PEB閲岄潰鍙互鑾峰彇鍒版洿澶氱殑淇℃伅銆傛殏涓旀悂絎攡~
]]>
NT鎻愪緵濡備笅渚嬬▼鏉ュ垎閰嶅唴瀛橈細
ExAllocatePool();
ExAllocatePoolWithQuota();
ExAllocatePoolWithTag();
ExAllocatePoolWithQuotaTag
璋冪敤浠ヤ笂渚嬬▼鍒嗛厤鍐呭瓨鏄繀欏誨埗瀹氬唴瀛樼殑綾誨瀷錛?br> NonPagedPool
PagedPool
NonPagedPoolMustSuccessed.
......................
鍏充簬闈炲垎欏靛唴瀛樼鐗囬棶棰橈細
鏈潵鍒濆鍖栫殑鏃跺欏湴鍧閮芥槸鐩擱偦鐨勯潪鍒嗛〉姹犱細鍙樻垚紕庣墖銆傝屼笖VMM鍦ㄦ墭澶х殑鏃跺欎篃涓嶄繚璇佸湴鍧鐩擱偦銆?br> 濡傛灉璇鋒眰鐨勫垎閰嶆垨鑰呴噴鏀懼皬鍧楀唴瀛橈紙灝忎簬涓涓狿AGE_SIZE錛?鍙兘瀵艱嚧鐗╃悊鍐呭瓨紕庣墖鍖栥傝繖鍥炵粰緋葷粺甯︽潵鍚勭鍚勬牱鐨勯棶棰橈紝鍖呮嫭闄嶄綆緋葷粺鎬ц兘鍜屽垎閰嶅唴瀛樺け璐ョ殑鎯呭喌銆?br> 瑙e喅鍔炴硶浣跨敤鏃佽鍒楄〃錛屾梺瑙嗗垪琛ㄦ槸涓涓狽T4.0寮濮嬫彁渚涚殑涓涓唴瀛樺垎閰嶆柟寮忥紱鍏蜂綋璇峰弬鑰僕DK docment.
欏轟究鎻愪竴涓嬪唴鏍告爤錛?br> 姣忎釜鍦∟T騫沖彴鐨勭嚎紼嬫湁涓涓敤鎴鋒爤鍦ㄧ敤鎴鋒ā寮忔墽琛岀殑鏃跺欎嬌鐢紝涓涓唴鏍告爤鍦ㄥ唴鏍告ā寮忔墽琛岀殑鏃跺欎嬌鐢ㄣ傚綋綰跨▼璇鋒眰緋葷粺鏈嶅姟鑰屽垏鎹㈠埌鍐呮牳妯″紡鐨勬椂鍊欙紝闄烽槺鏈哄埗浼氬垏鎹㈡爤銆傜敤鍒嗛厤鍜岀嚎紼嬬殑鍐呮牳絀洪棿鏍堟潵瑕嗙洊鐢ㄦ埛絀洪棿鏍堛?br>鍦∟T3.51涔嬪墠錛屽唴鏍告爤闄愬埗鍦ㄤ袱欏電殑鍐呭瓨涓侼T4.0寮濮嬪鍔犲埌12KB.蹇呴』瑕佽皚鎱庣殑鍦ㄦ爤涓婁嬌鐢ㄥ彉閲忎互鑺傜渷鍗犵┖闂達紝闃叉瓚呰繃闄愬埗鑰屾槸緋葷粺鍋滄銆?br>
]]>
鐞嗚Вwindow API鍙婂嚱鏁板師鍨嬪鎴戜滑鐨勮皟璇曞皢鏄潪甯擱噸瑕佺殑: 鍥犱負浣犳椂甯擱渶瑕佸幓瀵熺湅涓浜涘嚱鏁扮殑鍙傛暟,鎴栬呮牴鎹弬鏁版壘鍒版煇浜涜緭鍏ユ寚閽?
渚嬪:
17 Id: a84.cc4 Suspend: 1 Teb: 7ff3a000 Unfrozen
ChildEBP RetAddr Args to Child
187ffdb8 77845e6c 7782fc72 00001938 00000000 ntdll!KiFastSystemCallRet
187ffdbc 7782fc72 00001938 00000000 00000000 ntdll!NtWaitForSingleObject+0xc
187ffe20 7782fb56 00000000 00000000 00000000 ntdll!RtlpWaitOnCriticalSection+0x13e
187ffe48 01b05d13 0x77c8ba60 81fa55ed 028766c8 ntdll!RtlEnterCriticalSection+0x150
浠庡爢鏍堝彲浠ョ湅鍑虹嚎紼?7 姝e湪榪涘叆鏌愪竴涓復鐣屽尯. 0x77c8ba60 灝辨槸浼犲叆鐨勪復鐣屽?鍙傛暟.
17> !cs 0x77c8ba60 --> !cs 鏄敤鏉ユ煡鐪嬩復鐣屽尯淇℃伅鐨勫懡浠?br>DebugInfo = 0x77fbde20
Critical section = 0x77c8ba60 (GDI32!semColorSpaceCache+0x0)
LOCKED
LockCount = 0x0
OwningThread = 0x00000dd8
RecursionCount = 0x1
LockSemaphore = 0x0
SpinCount = 0x00000000
鍙互鐪嬪埌 LOCKED 浠h〃涓寸晫鍖烘槸閿佸畾鐘舵? 鍗寵鍗犵敤.
OwningThread 鍗蟲槸鍗犵敤綰跨▼.
涓寸晫鍖轟俊鎭粨鏋勫畾涔夊湪ntdll, 鍙互浣跨敤濡備笅鎸囦護榪涜瀵熺湅.
> dt ntdll!_RTL_CRITICAL_SECTION
+0x000 DebugInfo : Ptr32 _RTL_CRITICAL_SECTION_DEBUG
+0x004 LockCount : Int4B
+0x008 RecursionCount : Int4B
+0x00c OwningThread : Ptr32 Void
+0x010 LockSemaphore : Ptr32 Void
+0x014 SpinCount : Uint4B
瀵熺湅鏌愪釜鍔ㄦ佸簱鍑芥暟琛ㄧ殑鎸囦護:
x ntdll!*
x kernal!*
瀵熺湅緇撴瀯浣撳畾涔?
dt ntdll!*
浠諱綍鍔ㄦ佸簱鍖呮嫭window 32鐨勭敤鎴鋒乨ll 鍜岀敤鎴瘋嚜瀹氫箟鍔ㄦ佸簱閮芥槸鐢熼暱鍦ㄨ繘紼嬪唴瀛樼┖闂翠笂鐨?
DLL 娌℃湁鑷繁鐨?縐佹湁"鍦板潃絀洪棿. 瀹冧滑鎬繪槸琚獎灝勫埌搴旂敤紼嬪簭鐨勮櫄鎷熷湴鍧絀洪棿,鍦ㄩ渶瑕佹椂鎵嶄細琚鍙栧埌鐗╃悊鍐呭瓨涓?
鍦ㄦ湰緋誨垪鐨勫叾瀹冪珷鑺傛垜浼氳皥鍒拌櫄鎷熷湴鍧絀洪棿鐨勫唴瀹?
閫氳繃鎸囦護鍙互鐪嬪埌ntdll 琚槧灝勫埌77800000 ~ 7793c000鐨勫唴瀛樼┖闂翠腑.
> x *!
77800000 7793c000 ntdll (pdb symbols) c:\mylocalsymbols\ntdll.pdb\F0164DA71FAF4765B8F3DB4F2D7650EA2\ntdll.pdb
褰撲綘鐨勪唬鐮?綰跨▼)鏍堜腑鍑虹幇鍦板潃鑼冨洿鍦?77800000 ~7793c000 涔嬮棿鐨勫嚱鏁拌皟鐢ㄩ兘琛ㄧず鍦╟all NTDLL.dll
姣斿:
7 Id: a84.c34 Suspend: 1 Teb: 7ff3f000 Unfrozen
ChildEBP RetAddr Args to Child
089bfe8c 77845e6c 75a0179c 00000d98 00000000 ntdll!KiFastSystemCallRet
089bfe90 75a0179c 00000d98 00000000 00000000 ntdll!NtWaitForSingleObject+0xc
089bfefc 75c9f003 00000d98 ffffffff 00000000 KERNELBASE!WaitForSingleObjectEx+0x98
089bff14 75c9efb2 00000d98 ffffffff 00000000 kernel32!WaitForSingleObjectExImplementation+0x75
089bff28 69434fea 00000d98 ffffffff 0780c178 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be wrong.
姝ょ嚎紼嬩腑WARNING: Stack unwind information not available. Following frames may be wrong.琛ㄧずwindbg鏃犳硶緲昏瘧鎴栬呮壘鍒板搴攕ymbols鏉ユ樉紺篶ode stack. 榪欑閿欒寰寰鏄繚瀛榙ump file鏃跺嚭鐜扮殑鏌愮寮傚父淇℃伅.window涔熸病鏈夌粰鍑哄悎鐞嗙殑瑙i噴.
浠ヤ笅鏄疢SDN鐨勫師璇?
In some cases, the stack trace function will fail in the debugger. This can be caused by a call to an invalid address that caused the debugger to lose the location of the return address; or you may have come across a stack pointer for which you cannot directly get a stack trace; or there could be some other debugger problem. In any case, being able to manually walk a stack is often valuable.
榪欐椂鍊欎綘闇瑕佹墜鍔ㄧ殑榪涜鎭㈠鏍堣皟鐢? 濡傛灉浣犱簡瑙f瘡涓姩鎬佸簱鐨勬槧灝勫湴鍧浣犲氨寰堝鏄撹繘琛屽垎鏋愪簡.
瀵熺湅鍔ㄦ佸簱涓瘡涓嚱鏁版槧灝勭殑鍦板潃鍙互閲囩敤濡備笅鎸囦護 :
x ntdll!
鎵嬪姩鎭㈠鏍堢殑澶ц嚧鍘熺悊濡備笅:
1. 鍒楀嚭綰跨▼鐜淇℃伅
0:000> !teb
0:000> dds 00126000 00130000
>ln address
]]>
]]>