示例dump分析：未捕获异常
代码
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
#include "client/windows/handler/exception_handler.h" #include <stdexcept> void Crash() { throw std::runtime_error("Intentional Crash!"); } int main() { init_breakpad(); Crash(); return 0; } |
分析步骤
- 使用
!analyze -v
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
CONTEXT: (.ecxr) rax=00007fff1cf515b7 rbx=0000000000000000 rcx=0000000000000000 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=00007fff1aa5b699 rsp=000000000014fa70 rbp=000000000014fc00 r8=0000000000400000 r9=0000000000000012 r10=00007fff1cf5185a r11=000000000044a000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206 KERNELBASE!RaiseException+0x69: 00007fff`1aa5b699 0f1f440000 nop dword ptr [rax+rax] Resetting default scope EXCEPTION_RECORD: (.exr -1) ExceptionAddress: 00007fff1aa5b699 (KERNELBASE!RaiseException+0x0000000000000069) ExceptionCode: e06d7363 (C++ EH exception) ExceptionFlags: 00000001 NumberParameters: 4 Parameter[0]: 0000000019930520 Parameter[1]: 000000000014fcc8 Parameter[2]: 00007ff7549abe78 Parameter[3]: 00007ff7547f0000 |
- 看到异常代码是
e06d7363- 对应着
CPP_EH_EXCEPTION - 触发场景一般为，
C++托管扩展（/clr）中的异常
- 对应着
- 使用
.exr -1查看异常记录
|
1 2 3 4 5 6 7 8 9 |
0:000> .exr -1 ExceptionAddress: 00007fff1aa5b699 (KERNELBASE!RaiseException+0x0000000000000069) ExceptionCode: e06d7363 (C++ EH exception) ExceptionFlags: 00000001 NumberParameters: 4 Parameter[0]: 0000000019930520 Parameter[1]: 000000000014fcc8 Parameter[2]: 00007ff7549abe78 Parameter[3]: 00007ff7547f0000 |
- 使用
kn查看栈
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
0:000> kn # Child-SP RetAddr Call Site 00 00000000`0014e818 00007fff`1aa4920e ntdll!NtWaitForSingleObject+0x14 01 00000000`0014e820 00007ff7`548802fb KERNELBASE!WaitForSingleObjectEx+0x8e 02 00000000`0014e8c0 00007ff7`5487e3e1 aet_breakpad_test!google_breakpad::ExceptionHandler::WriteMinidumpOnHandlerThread+0x10b [Q:\google_code\breakpad\src\src\client\windows\handler\exception_handler.cc @ 726] 03 00000000`0014e900 00007fff`1ab54677 aet_breakpad_test!google_breakpad::ExceptionHandler::HandleException+0x121 [Q:\google_code\breakpad\src\src\client\windows\handler\exception_handler.cc @ 509] 04 00000000`0014e970 00007fff`1cef5818 KERNELBASE!UnhandledExceptionFilter+0x1e7 05 00000000`0014ea90 00007fff`1cedce46 ntdll!RtlUserThreadStart$filt$0+0xa2 06 00000000`0014ead0 00007fff`1cef28bf ntdll!_C_specific_handler+0x96 07 00000000`0014eb40 00007fff`1cea2554 ntdll!RtlpExecuteHandlerForException+0xf 08 00000000`0014eb70 00007fff`1cea22a7 ntdll!RtlDispatchException+0x244 09 00000000`0014f280 00007fff`1aa5b699 ntdll!RtlRaiseException+0x1d7 0a 00000000`0014fa70 00007ff7`5488a4c2 KERNELBASE!RaiseException+0x69 0b 00000000`0014fb50 00007ff7`54878182 aet_breakpad_test!_CxxThrowException+0x132 [D:\a\_work\1\s\src\vctools\crt\vcruntime\src\eh\throw.cpp @ 81] 0c 00000000`0014fbe0 00007ff7`548791d7 aet_breakpad_test!Crash+0x42 [Q:\google_code\breakpad\src\src\client\windows\aet_test\aet_breakpad_test\aet_breakpad_test.cpp @ 28] 0d 00000000`0014fd10 00007ff7`548867e9 aet_breakpad_test!main+0x27 [Q:\google_code\breakpad\src\src\client\windows\aet_test\aet_breakpad_test\aet_breakpad_test.cpp @ 34] 0e 00000000`0014fe10 00007ff7`54886692 aet_breakpad_test!invoke_main+0x39 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 79] 0f 00000000`0014fe60 00007ff7`5488654e aet_breakpad_test!__scrt_common_main_seh+0x132 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 288] 10 00000000`0014fed0 00007ff7`5488687e aet_breakpad_test!__scrt_common_main+0xe [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 331] 11 00000000`0014ff00 00007fff`1bc07374 aet_breakpad_test!mainCRTStartup+0xe [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_main.cpp @ 17] 12 00000000`0014ff30 00007fff`1ce9cc91 kernel32!BaseThreadInitThunk+0x14 13 00000000`0014ff60 00000000`00000000 ntdll!RtlUserThreadStart+0x21 |
- 可以看到是
28行Crash函数里面
|
1 |
0c 00000000`0014fbe0 00007ff7`548791d7 aet_breakpad_test!Crash+0x42 [Q:\google_code\breakpad\src\src\client\windows\aet_test\aet_breakpad_test\aet_breakpad_test.cpp @ 28] |
验证观察
总结
内存观察相关
db
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
0:000> dv sttt = struct MyStruct a = 0n0 0:000> db 0014fcf4 00000000`0014fcf4 00 00 00 00 cc cc cc cc-cc cc cc cc cc cc cc cc ................ 00000000`0014fd04 cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc ................ 00000000`0014fd14 cc cc cc cc 01 00 00 00-02 00 00 00 cc cc cc cc ................ 00000000`0014fd24 cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc ................ 00000000`0014fd34 cc cc cc cc 40 ca e2 be-f7 7f 00 00 e0 6f 0d 02 ....@........o.. 00000000`0014fd44 00 00 00 00 28 fd 14 00-00 00 00 00 28 fd 14 00 ....(.......(... 00000000`0014fd54 00 00 00 00 67 32 d2 be-f7 7f 00 00 40 ca e2 be ....g2......@... 00000000`0014fd64 f7 7f 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ |
dw
|
1 2 3 4 5 6 7 8 9 |
0:000> dw 0014fcf4 00000000`0014fcf4 0000 0000 cccc cccc cccc cccc cccc cccc 00000000`0014fd04 cccc cccc cccc cccc cccc cccc cccc cccc 00000000`0014fd14 cccc cccc 0001 0000 0002 0000 cccc cccc 00000000`0014fd24 cccc cccc cccc cccc cccc cccc cccc cccc 00000000`0014fd34 cccc cccc ca40 bee2 7ff7 0000 6fe0 020d 00000000`0014fd44 0000 0000 fd28 0014 0000 0000 fd28 0014 00000000`0014fd54 0000 0000 3267 bed2 7ff7 0000 ca40 bee2 00000000`0014fd64 7ff7 0000 0000 0000 0000 0000 0000 0000 |
dd
|
1 2 3 4 5 6 7 8 9 |
0:000> dd 0014fcf4 00000000`0014fcf4 00000000 cccccccc cccccccc cccccccc 00000000`0014fd04 cccccccc cccccccc cccccccc cccccccc 00000000`0014fd14 cccccccc 00000001 00000002 cccccccc 00000000`0014fd24 cccccccc cccccccc cccccccc cccccccc 00000000`0014fd34 cccccccc bee2ca40 00007ff7 020d6fe0 00000000`0014fd44 00000000 0014fd28 00000000 0014fd28 00000000`0014fd54 00000000 bed23267 00007ff7 bee2ca40 00000000`0014fd64 00007ff7 00000000 00000000 00000000 |
dq
- 以四字（
8字节）为单位显示- 显示从当前堆栈指针（
ESP寄存器指向的地址）开始的内存内容 x64架构下，堆栈指针是RSP（64位寄存器），其存储的地址是8字节- 因此用
dq（以8字节为单位显示）来查看堆栈内存
- 显示从当前堆栈指针（
|
1 2 3 4 5 6 7 8 9 |
0:000> dq @esp 00000000`0014fa10 00000000`0014fc08 00000000`00000000 00000000`0014fa20 00000000`00000000 00000000`00000000 00000000`0014fa30 00000001`e06d7363 00000000`00000000 00000000`0014fa40 00007ffa`10c2b699 cccccccc`00000004 00000000`0014fa50 00000000`19930520 00000000`0014fc88 00000000`0014fa60 00007ff7`bee81698 00007ff7`bebb0000 00000000`0014fa70 00000000`00000000 00000000`00000000 00000000`0014fa80 00000000`00000000 00000000`0014fba0 |
dc
|
1 2 3 4 5 6 7 8 9 |
0:000> dc 0x14fcb8 00000000`0014fcb8 022f4fe0 00000000 6c6c6568 0000006f .O/.....hello... 00000000`0014fcc8 00000000 00000000 00000005 00000000 ................ 00000000`0014fcd8 0000000f 00000000 cccccccc cccccccc ................ 00000000`0014fce8 cccccccc cccccccc cccccccc cccccccc ................ 00000000`0014fcf8 00000001 00000002 cccccccc cccccccc ................ 00000000`0014fd08 cccccccc cccccccc cccccccc cccccccc ................ 00000000`0014fd18 cccccccc cccccccc cccccccc cccccccc ................ 00000000`0014fd28 cccccccc cccccccc cccccccc cccccccc ................ |
da
|
1 2 |
0:000> da 0x14fcb8 00000000`0014fcb8 ".O/." |
du
|
1 2 |
0:000> du 0x14fcb8 00000000`0014fcb8 "俠ȯ" |
dds
- 在
WinDbg中，dds命令用于以DWORD（4字节）为单位显示内存，并尝试将每个DWORD解释为可能的符号地址- 这类似于
dd，但增加了符号解析的功能
- 这类似于
- 示例：
- 例如，第一行地址是
00000000 0014f9b0，该地址的值是`0014fba8
- 例如，第一行地址是
|
1 2 3 4 5 |
0:000> dds @rsp L4 00000000`0014f9b0 0014fba8 00000000`0014f9b4 00000000 00000000`0014f9b8 00000000 00000000`0014f9bc 00000000 |
32位程序，dds和dps输出相同，dps更通用。64位程序必须使用dps
dps
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
0:000> dps 0014fe00 L10 00000000`0014fe00 00000000`00000000 00000000`0014fe08 00007ff7`a7442569 aet_breakpad_test!invoke_main+0x39 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 79] 00000000`0014fe10 00000000`00000000 00000000`0014fe18 00007ff7`a74e64d8 aet_breakpad_test!_initterm+0x58 [minkernel\crts\ucrt\src\appcrt\startup\initterm.cpp @ 22] 00000000`0014fe20 00000000`00000000 00000000`0014fe28 00007ff7`a74431bd aet_breakpad_test!__scrt_release_startup_lock+0xd [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\utility\utility.cpp @ 161] 00000000`0014fe30 00000000`00000001 00000000`0014fe38 00000000`01dece20 00000000`0014fe40 00000000`01de5f90 00000000`0014fe48 00007ff7`a73a94c0 aet_breakpad_test!`dynamic initializer for 'std::numpunct<char>::id'' [C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.41.34120\include\xlocnum @ 242] 00000000`0014fe50 00000000`00000000 00000000`0014fe58 00007ff7`a7442412 aet_breakpad_test!__scrt_common_main_seh+0x132 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 288] 00000000`0014fe60 00007ff7`a754e000 aet_breakpad_test!__xc_a 00000000`0014fe68 00007ff7`a754e818 aet_breakpad_test!__xc_z 00000000`0014fe70 00000000`00000000 00000000`0014fe78 00000000`00000000 |
!address
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
0:000> !address 0x14fcb8 Mapping file section regions... Mapping module regions... Mapping PEB regions... Mapping TEB and stack regions... Mapping heap regions... Mapping page heap regions... Mapping other regions... Mapping stack trace database regions... Mapping activation context regions... Usage: <unknown> Base Address: 00000000`0014e758 End Address: 00000000`00150000 Region Size: 00000000`000018a8 ( 6.164 kB) State: <info not present at the target> Protect: <info not present at the target> Type: <info not present at the target> Allocation Base: <info not present at the target> Allocation Protect: <info not present at the target> Content source: 3 (unknown), length: 348 |
!vprot
|
1 2 3 4 5 6 7 |
0:000> !vprot 0x14fcb8 BaseAddress: 000000000014e758 AllocationBase: <info not present in the dump file> RegionSize: 00000000000018a8 State: <info not present in the dump file> Protect: <info not present in the dump file> Type: <info not present in the dump file> |
s
|
1 2 3 |
s -d 00100000 L20000 0xdeadbeef // 在00100000~00120000搜索DWORD 0xdeadbeef s -a 00100000 L20000 "Hello" // 搜索ANSI字符串"Hello" s -u 00100000 L20000 "W"o"r"l"d" // 搜索Unicode字符串"World" |
|
1 2 |
0:000> s -a 0x14fcb8 L100 "hello" 00000000`0014fcc0 68 65 6c 6c 6f 00 00 00-00 00 00 00 00 00 00 00 hello........... |
dt
- 查看结构体
|
1 2 3 4 5 6 7 8 9 10 11 |
0:000> dt MyStruct aet_breakpad_test!MyStruct +0x000 a : Int4B +0x004 b : Int4B 0:000> dt test Local var @ 0x14fcb8 Type std::basic_string<char,std::char_traits<char>,std::allocator<char> > +0x000 _Mypair : std::_Compressed_pair<std::allocator<char>,std::_String_val<std::_Simple_types<char> >,1> 0:000> dt sttt Local var @ 0x14fcf8 Type MyStruct +0x000 a : 0n1 +0x004 b : 0n2 |
|
1 2 3 4 5 6 7 8 |
0:000> dt -r test Local var @ 0x14fcb8 Type std::basic_string<char,std::char_traits<char>,std::allocator<char> > +0x000 _Mypair : std::_Compressed_pair<std::allocator<char>,std::_String_val<std::_Simple_types<char> >,1> +0x000 _Myval2 : std::_String_val<std::_Simple_types<char> > +0x000 _Myproxy : 0x00000000`022f4fe0 std::_Container_proxy +0x008 _Bx : std::_String_val<std::_Simple_types<char> >::_Bxty +0x018 _Mysize : 5 +0x020 _Myres : 0xf |
其他总结
int 3
- 调试中断
nop dword ptr [rax+rax]
- 概述
NOP（No Operation）指令表示“无操作”，通常用于填充代码、对齐指令边界或占位- 单字节
NOP的机器码是0x90
- 汇编
dword ptr表示操作数是一个4字节（双字）的内存地址[rax+rax]是内存寻址表达式，等效于[rax*2]
- 效果
- 虽然语法上涉及内存访问，但
CPU不会真正读写rax*2指向的内存 - 这条指令的实质是通过复杂的寻址形式生成一个多字节的
NOP，仅用于占用指令空间
- 虽然语法上涉及内存访问，但
- 为什么？
- 现代
CPU对指令对齐敏感。 - 通过插入多字节
NOP（如5字节、7字节），编译器可使后续指令（如循环入口）对齐到16/32字节边界，提高指令预取和解码效率
- 现代
本文为原创文章，版权归Aet所有，欢迎分享本文，转载请保留出处！
你可能也喜欢
- ♥ C++程序高级调试与优化_第一篇07/20
- ♥ breakpad记述：Windows下静态库的编译使用03/15
- ♥ Windows 核心编程 _ 用户模式：线程同步一07/15
- ♥ WinDbg命令标记、命令07/11
- ♥ COM组件_303/07
- ♥ Windows 核心编程 _ 内核对象一06/04