Posted on 2009-03-27 12:40
S.l.e!ep.￠% 閱讀(1914)
評論(2) 編輯 收藏 引用 所屬分類:
WinDbg
終于抓到了 dump file
Windows XP Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: SingleUserTS
Debug session time: Fri Mar 27 09:07:55 2009
System Uptime: 0 days 17:10:39.285
Process Uptime: 0 days 0:01:25.000
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.?????????? *
* Use .symfix to have the debugger choose a symbol path.?????????????????? *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
................................
(148.178): Access violation - code c0000005 (!!! second chance !!!)
eax=034c0fd8 ebx=00000000 ecx=0012e444 edx=7c92eb94 esi=00000000 edi=00000000
eip=719c594a esp=0012e474 ebp=0012e4d0 iopl=0???????? nv up ei pl zr na po nc
cs=001b? ss=0023? ds=0023? es=0023? fs=003b? gs=0000???????????? efl=00000246
*** ERROR: Symbol file could not be found.? Defaulted to export symbols for mswsock.dll -
mswsock+0x594a:
719c594a 8b4004?????????? mov???? eax,[eax+0x4]???? ds:0023:034c0fdc=????????
0x148 - 0x178 是主線程
用 kb 查看,結(jié)果是
0:000> kb
ChildEBP RetAddr? Args to Child?????????????
WARNING: Stack unwind information not available. Following frames may be wrong.
0012e4d0 71a26294 00000400 034c0fec 00000001 mswsock+0x594a
*** WARNING: Unable to verify checksum for xxx.exe
0012e50c 0042ffc3 00000400 034c0fec 00000001 ws2_32!WSASend+0x61
0012f580 0040e577 0012f5bc 00000014 0012f58c xxx.exe+xxx-function
0012f5b4 00403d5e 00000000 02200005 00004ae1 xxx.exe+xxx-function
0012f608 0040a2de 0012f624 02c28690 018f0fe8 xxx.exe+xxx-function
0012f654 00405ad9 02c28690 004447c0 00000001 xxx.exe+xxx-function
0:000> d eax
034c0fd8? ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??? ????????????????
034c0fe8? ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??? ????????????????
034c0ff8? ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??? ????????????????
034c1008? ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??? ????????????????
034c1018? ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??? ????????????????
034c1028? ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??? ????????????????
034c1038? ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??? ????????????????
034c1048? ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??? ????????????????
0:000> lmvm mswsock
start??? end??????? module name
719c0000 719fe000?? mswsock????? (export symbols)?????? mswsock.dll
??? Loaded symbol image file: mswsock.dll
??? Image path: C:\WINDOWS\system32\mswsock.dll
??? Timestamp: Tue Aug 17 07:40:52 2004 (41214604)? Checksum: 00045854
??? File version:???? 5.1.2600.2180
??? Product version:? 5.1.2600.2180
??? File flags:?????? 0 (Mask 3F)
??? File OS:????????? 40004 NT Win32
??? File type:??????? 2.0 Dll
??? File date:??????? 00000000.00000000
?
至此,得到的結(jié)論是,
主線程在調(diào)用 WSASend 時(shí),? 系統(tǒng)調(diào)用了? mswsock 模塊中的一個(gè)函數(shù), 在訪問? ds:0023:034c0fdc 內(nèi)存時(shí)出錯(cuò)了,
錯(cuò)誤是? Access violation - code c0000005 , 拒絕訪問
至于,為何調(diào)用 WSASend 會(huì)何會(huì)出現(xiàn), 正在檢查代碼 ing......