Monday, March 29, 2010
Exception Handing
Where are variables stored?
Tuesday, March 23, 2010
Argument of KiUserExceptionDispatcher() function
0021e9fc 77db5f79 fffffffe 0021f878 0021eb04 ntdll!_except_handler4+0x8e
0021ea20 77db5f4b 0021eae8 0021f878 0021eb04 ntdll!ExecuteHandler2+0x26
0021ead0 77db5dd7 0121eae8 0021eb04 0021eae8 ntdll!ExecuteHandler+0x24
0021ead0 77d8e13d 0121eae8 0021eb04 0021eae8 ntdll!KiUserExceptionDispatcher+0xf
0021ee20 77d8e04d 00000000 00000000 00000001 ntdll!RtlpWaitOnCriticalSection+0xc50:000> .exr 0x21eae8
ExceptionAddress: 77d8e13d (ntdll!RtlpWaitOnCriticalSection+0x000000c5)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00000014
Attempt to write to address 00000014
0:000> .cxr 0x21eb04
eax=00000000 ebx=fffffffc ecx=00000000 edx=00000004 esi=737b19a0 edi=737b19a4
eip=77d8e13d esp=0021edd0 ebp=0021ee20 iopl=0 nv up ei pl nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010213
ntdll!RtlpWaitOnCriticalSection+0xc5:
77d8e13d 83401401 add dword ptr [eax+14h],1 ds:0023:00000014=????????You can see the exception code is 0xc0000005 which is Access Violation
So whenever you find the KiUserExceptionDispatcher() function in call stack you can check for CONTEXT structure and EXCEPTION_RECORD structure, to find the exception code.
References:
Debugger tricks: Find all probable CONTEXT records in a crash dump
Wednesday, March 17, 2010
ETW
- Core OS Events in Windows 7 Click here!!!
- Core Instrumentation Events in Windows 7 Click here!!!
Solving 11 Likely Problems In Your Multithreaded Code
Debugging Information
- Create Dump File Click Here!!!
- Debugging Windows Services Click here!!!
- Debugging Winlogon.exe Click here!!!
- Debugging CSRSS Click here!!!
- Analyze Crashes to find Security Vulnerabilities in your App Click here!!!
Good Links
You will never get the code perfect but you can add defenses.
- Protecting Your Code with Visual C++ Defenses Click here!!!
- FAQ about HeapSetInformation Click here!!!
- HeapSetInformation in VC++ 2010 Click here!!!