[windbg] User mode heap corruption

設定

Host: windbg 接進guest OS

Guest: app ver on, 設定要檢查的 process

當有heap corruption 發生, 就會有

=======================================
VERIFIER STOP 00000013: pid 0xBF0: First chance access violation for current stack trace.

    0A1D1000 : Invalid address causing the exception.
    6687545A : Code address executing the invalid access.
    0867FA14 : Exception record.
    0867FA30 : Context record.

先切到0xdf0 底下 (就是你設的app ver target)

.process /r /p /P <EProcess>

(1)拿發生的address 去ln 可以找到離這個位置最近的symbol

ln 6687545A

但以這個例子 只看到是在做memory copy

(2)如果夠準確, 直接 kvn 就可以看到stack 然後看到誰call 剛剛那個memcpy

兇手出現!!!

Try for blogger by iPhone

Why I call this blog as "30, and be independent"? That's is odd? Isn't that? Anyway. I m doing a test here and exiting about post a blog by iPhone. Don't know why, just exiting..

to check

g_pNtDllInst->m_pfnRtlNtStatusToDosError = reinterpret_cast<PFN_RtlNtStatusToDosError >
                ( ::GetProcAddress(g_pNtDllInst->m_hDLLModule, "RtlNtStatusToDosError" ) );

perl resource

http://affy.blogspot.com/p5be/ch10.htm
http://affy.blogspot.com/p5be/ch12.htm
http://www.catonmat.net/download/perl.predefined.variables.pdf

To Check C++ howto

DWORD &JobResultStatus

function pointer 的用法

//local 宣告function pointer
int (*netcmd)(uint16,int(*)(cbuf_t*,uint16,void*,uint16),void*,uint16,void*,uint16*,uint32,int*);

//指定成不同的function pointer 根據傳入的參數
netcmd = (block) ? netcmdBlockSend : netcmdNonblockSend;

//可以直接call不需dereference 但是(*netcmd)才是比較一般的作法 參考這個網址
err_code=netcmd( 
    EVT_ARP_ADD, netexeArpAdd, &add, sizeof(cmdArpAdd_t),
    NULL, NULL, 5000, &result);

 

一些介紹function pointer的link:

• Pointers to functions : 簡單有介紹state machine 用function pointer array的作法
• The function pointer tutorial : 還沒看過全部

pointer的加減

每次都忘記, 人真的老了

char * p ; p++時, p=p+1
int * p ; p++時, p=p+4
memh_t * p ; p++時, p = p + sizeof(memh_t)  

所以當

void* blk;
mp = (memh_t *)blk-1;
則mp 會指向 blk 往前推 memh_t 的位置