Microsoft PowerPoint - 03_ADVDBG_RAYMOND_OS.ppt

Size: px

Start display at page:

Download "Microsoft PowerPoint - 03_ADVDBG_RAYMOND_OS.ppt"

焙郊龚
4 years ago
Views:

1 Windows 高级调试操作系统的调试支持张银奎 (Raymond Zhang) 概览对调试器的支持用户态调试, 内核态调试, 脚本调试异常和错误处理错误通知机制消息框,Hard, Error,BSOD 错误报告机制 WER,CER 错误记录机制 ReportEvent,CLFS (Vista) 事件追踪机制 ETW 2 Copyright (C) 2007 ADVDBG.ORG All rights reserved. 1

异常的来源 CPU 产生执行指令时检测到的错误, 除 0,GP,, 无效指令 Machine Check Exceptions,, 总线错误,ECC, 错误, Cache 错误预先埋伏的,Int, 3, 调试异常程序产生 RaiseException,Win32 API C++,throw E, 编译器会翻译为对 RaiseException 的调用 C#,throw throw,,

2 异常的来源 CPU 产生执行指令时检测到的错误, 除 0,GP,, 无效指令 Machine Check Exceptions,, 总线错误,ECC, 错误, Cache 错误预先埋伏的,Int, 3, 调试异常程序产生 RaiseException,Win32 API C++,throw E, 编译器会翻译为对 RaiseException 的调用 C#,throw throw,, 最终仍是调用 RaiseException 3 Windows 中的异常 4 Win32 异常 - 包括 CPU 异常及 Windows 操作系统所定义的异常 CLR 异常 - CLR 及.Net 程序定义的异常 - 异常代码为 e0434f4d, 即.COM C++ 异常 - 代码为 0xe06d7363, 即.msc Copyright (C) 2007 ADVDBG.ORG All rights reserved. 2

3 异常处理五阶段 1. 发生 2. 表征 3. 捕捉分发处理 EXCEPTION_CONTINUE_SEARCH (0) EXCEPTION_EXECUTE_HANDLER (1) EXCEPTION_CONTINUE_EXECUTION (-1)( 4. 处理善后恢复 (resuming( exception) 5. 善后终止 (terminating( exception) 5 C++ 异常的历程 int main(void) { try { if (some_error( some_error) ) /* Stage 1 */ thow E(); /* Stage 2 */ carch(e&) /* Stage 3 */ { /* Stage 4 */ /* Stage 5 */ return 0; 6 Copyright (C) 2007 ADVDBG.ORG All rights reserved. 3

4 异常的编译 throw E(); E e = E(); _CxxThrowException(&e,E_E XCPT_INFO_ADDR); 7 CxxThrowException #define CXX_FRAME_MAGIC 0x #define CXX_EXCEPTION 0xe06d7363 VOID NTAPI _CxxThrowException ( IN PVOID Object, IN PVOID CxxExceptionType ) { ULONG_PTR ExceptionInformation[3]; ExceptionInformation[0] = CXX_FRAME_MAGIC; ExceptionInformation[1] = (ULONG_PTR) Object; ExceptionInformation[2] = (ULONG_PTR) CxxExceptionType; RaiseException( CXX_EXCEPTION, EXCEPTION_NONCONTINUABLE, 3, ExceptionInformation ); 8 Copyright (C) 2007 ADVDBG.ORG All rights reserved. 4

5 RaiseException VOID NTAPI RaiseException ( IN ULONG ExceptionCode, IN ULONG ExceptionFlags, IN ULONG NumberParameters, IN CONST ULONG_PTR *ExceptionInformation* ) { EXCEPTION_RECORD ExceptionRecord = { ExceptionCode, ExceptionFlags & EXCEPTION_NONCONTINUABLE, NULL, RaiseException,, // 指向本函数的指针 NumberParameters > EXCEPTION_MAXIMUM_PARAMETERS? EXCEPTION_MAXIMUM_PARAMETERS : NumberParameters ; RtlCopyMemory( ExceptionRecord.ExceptionInformation, ExceptionInformation, ExceptionRecord.NumberParameters * sizeof(ulong_ptr) ); RtlRaiseException(&ExceptionRecord); 9 ExceptionFlags 0 可恢复继续执行的异常 EXCEPTION_NONCONTINUABLE (1) 不可恢复继续执行的异常, 如果企图恢复继续执行, 则会导致 EXCEPTION_NONCONTINUABLE_EXCEPT ION 异常 10 Copyright (C) 2007 ADVDBG.ORG All rights reserved. 5

6 ZwRaiseException NTSYSAPI NTSTATUS NTAPI ZwRaiseException( IN PEXCEPTION_RECORD ExceptionRecord, IN PCONTEXT Context, IN BOOLEAN SearchFrames ); 11 RaiseException 的执行过程 RaiseException RtlRaiseException NtRaiseException NtRaiseException KiRaiseException KiDispatchException 12 Copyright (C) 2007 ADVDBG.ORG All rights reserved. 6

7 KiDispatchException if (SearchFrames){ if (PsGetCurrentProcess()->DebugPort == 0 KdIsThisAKdTrap(Tf, &Context)) { if (KiDebugRoutine && KiDebugRoutine(Tf, Reserved, Er, &Context, PreviousMode, FirstChance)!= 0) break; if (DbgkForwardException(Tf, DebugEvent,FirstChance)!= 0) return; if (valid_user_mode_stack_with_enough_space) { Tf->Eip = KeUserExceptionDispatcher; return; if (DbgkForwardException(Tf, DebugEvent, LastChance)!= 0) return; if (DbgkForwardException(Tf, ExceptionEvent, LastChance)!= 0) return; ZwTerminateThread(NtCurrentThread(), Er->ExceptionCode); 13 KiExceptionDispatch Windows 世界中异常处理的枢纽每个异常会最多有两轮处理机会, 每一轮机会都向尝试发给调试器调试器的异常过滤对话框 14 Copyright (C) 2007 ADVDBG.ORG All rights reserved. 7

执行异常处理器 ntdll!rtlpunlinkhandler+0xd vcexp!_unwindnestedframes+0x2c vcexp! FrameUnwindToState+0x16d vcexp! InternalCxxFrameHandler+0x319 vcexp! InternalCxxFrameHandler+0xe3 vcexp!

8 执行异常处理器 ntdll!rtlpunlinkhandler+0xd vcexp!_unwindnestedframes+0x2c vcexp! FrameUnwindToState+0x16d vcexp! InternalCxxFrameHandler+0x319 vcexp! InternalCxxFrameHandler+0xe3 vcexp! CxxFrameHandler+0x2c ntdll!executehandler2+0x26 ntdll!executehandler+0x24 内核之旅被遗忘 ntdll!kiuserexceptiondispatcher+0xe kernel32!raiseexception+0x51 vcexp!_cxxthrowexception+0x39 vcexp!vc_throw(void)+0x4c [C:\DIG DIG\DBG\EXCEPTION\advexp 27] vcexp!main(void)+0x1d [C:\DIG DIG\DBG\EXCEPTION\advexp 44] vcexp!maincrtstartup(void)+0xe9 206] kernel32!baseprocessstart+0x23 15 寻找处理者 VEH 处理器, 从 Windows XP 开始 SEH 处理器, 栈 A Crash Course on the Depths of Win32 Structured Exception Handling Matt Pietrek 16 Copyright (C) 2007 ADVDBG.ORG All rights reserved. 8

9 结构化异常处理 SEH try { // 被保护体 (guarded( body), 也就是要保护的代码块 except( 过滤表达式 ) { // 异常处理块 (exception( exception-handling block) 17 异常过滤器的返回值 EXCEPTION_CONTINUE_SEARCH (0) 我不管这个问题继续寻找其它异常处理器 EXCEPTION_EXECUTE_HANDLER (1) 受理!! 局部展开和全局展开 (UnWind( UnWind), 继续执行 EXCEPTION_CONTINUE_EXECUTION (-1) 障碍已经排除, 回原来位置继续运行 ZwContinue() 18 Copyright (C) 2007 ADVDBG.ORG All rights reserved. 9

UnhandledExceptionFilter() Win2K 使用 Hard Error

10 无人处理用户态, 使用缺省的异常处理器 BaseProcessStart 函数中的异常处理器编译器插入的启动函数中的异常处理器基于信号的异常处理内核态,BSOD, 19 未处理的异常用户态 UnhandledExceptionFilter() Win2K 使用 Hard Error 机制报告应用程序错误对话框 20 Copyright (C) 2007 ADVDBG.ORG All rights reserved. 10

未处理的异常内核态 Blue Screen of Death 内核模式下操作系统强制 STOP KebugCheckE x() 23 UnhandledExceptionFilter

$观察缺省的异常处理器 25 JIT 调试器的设置 Hive: HKEY_LOCAL_MACHINE Key: SOFTWARE\Microsoft Microsoft\Windows NT\CurrentVersion$

13 观察缺省的异常处理器 25 JIT 调试器的设置 Hive: HKEY_LOCAL_MACHINE Key: SOFTWARE\Microsoft Microsoft\Windows NT\CurrentVersion CurrentVersion\AeDebug To set alternative JIT debuggers, just change the debuggers key 26 Copyright (C) 2007 ADVDBG.ORG All rights reserved. 13

!!) eax=7c80180e ebx=7ffda000 ecx=7c80180e edx=7c97c0d8 esi=0012ff2c edi=0012ff80 eip=00401076 esp=0012ff2c ebp=0012ff80 iopl=0 nv up ei pl nz

14 Dr. Watson Windows 内建的 JIT 调试器, 用于收集错误信息从 16 位 Windows 开始 drwtsn32 I Windows XP, Faultrep.exe Vista, wer.exe Windows Error Reporting 27 应用程序崩溃和 JIT 调试 (cdc.1250): Access violation - code c (!!! second chance!!!) eax=7c80180e ebx=7ffda000 ecx=7c80180e edx=7c97c0d8 esi=0012ff2c edi=0012ff80 eip= esp=0012ff2c ebp=0012ff80 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl= AcsVio!main+0x66: c mov dword ptr [ecx],0 ds:0023:7c80180e=c868206a 28 Copyright (C) 2007 ADVDBG.ORG All rights reserved. 14

ws2003r2 和 Windows Vista 开始支持来自内核的支持 CLFS.SYS 使用 System.IO.

15 WER Windows Error Reporting (WER) Introduced by Windows XP Corporate Error Reporting (CER) 29 CLFS Common Logging File System 通用的日志支持, 安全高效不丢失一条宝贵的日志信息从 ws2003r2 和 Windows Vista 开始支持来自内核的支持 CLFS.SYS 使用 System.IO.Log Vista 新引入了几十个 API,CreateLogFile CreateLogFile, 30 Copyright (C) 2007 ADVDBG.ORG All rights reserved. 15

ebook66-24

ebook66-24 2 4 0 C P U 0 C P U hardware exception software exception -- e x c e p t t r y f i n a l l e x c e p t try f i n a l l y e x c e p t t r y - e x c e p t t r y - f i n a l l y 24.1 exception filter t r