内存断点
描述:当需要在某块内存被访问时产生中断,可以使用内存断点。
内存断点能够分为两种类型:
内存访问:内存被读写时产生中断
内存写入:内存被写入时产生中断
原理:VirtualProtectEx
flNewProtect
内存访问:将指定内存的属性修改为PAGE_NOACCESS
(修改后,PTE的P位等于0)
内存写入:将指定内存的属性修改为PAGE_EXECUTE_READ
(修改后,PTE的P位等于1,R/W位等于0)
流程
被调试进程:
1)CPU访问错误的内存地址,触发页异常
2)查IDT表找到对应的中断处理函数(
nt!_KiTrap0E
)3)
CommonDispatchException
4)
KiDispatchException
5)
DbgkForwardException
收集并发送调试事件
最终调用DbgkpSendApiMessage(x, x)
,第一个参数:消息类型,共有7种类型,第二个参数:是否挂起其它线程
调试器进程:
1)循环判断
2)取出调试事件
3)列出消息(寄存器/内存)
4)用户处理
在创建进程的地方使用内存断点
通过修改PTE的P=0来设置页不可访问
我们首先看一下EXCEPTION_DEBUG_INFO
结构
然后再看ExceptionRecord
到msdn里面看一下EXCEPTION_RECORD
,这里主要关注ExceptionInformation
如果这个值为0有线程试图读这块内存,如果这个值为1则有线程试图写这块内存
这里显示出异常的信息,打印异常类型和异常地址
实现代码如下
// Debug4.cpp : Defines the entry point for the console application.
//
#include "stdafx.h"
#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>
#define DEBUGGEE "C:\\ipmsg.exe"
//被调试进程ID,进程句柄,OEP
DWORD dwDebuggeePID = 0;
//被调试线程句柄
HANDLE hDebuggeeThread = NULL;
HANDLE hDebuggeeProcess = NULL;
//系统断点
BOOL bIsSystemInt3 = TRUE;
//被INT 3覆盖的数据
CHAR OriginalCode = 0;
//原始内存属性
DWORD dwOriginalProtect;
//线程上下文
CONTEXT Context;
typedef HANDLE (__stdcall *FnOpenThread) (DWORD, BOOL, DWORD);
VOID InitDebuggeeInfo(DWORD dwPID, HANDLE hProcess)
{
dwDebuggeePID = dwPID;
hDebuggeeProcess = hProcess;
}
DWORD GetProcessId(LPTSTR lpProcessName)
{
HANDLE hProcessSnap = NULL;
PROCESSENTRY32 pe32 = {0};
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if(hProcessSnap == (HANDLE)-1)
{
return 0;
}
pe32.dwSize = sizeof(PROCESSENTRY32);
if(Process32First(hProcessSnap, &pe32))
{
do
{
if(!strcmp(lpProcessName, pe32.szExeFile))
return (int)pe32.th32ProcessID;
} while (Process32Next(hProcessSnap, &pe32));
}
else
{
CloseHandle(hProcessSnap);
}
return 0;
}
BOOL WaitForUserCommand()
{
BOOL bRet = FALSE;
CHAR command;
printf("COMMAND>");
command = getchar();
switch(command)
{
case 't':
bRet = TRUE;
break;
case 'p':
bRet = TRUE;
break;
case 'g':
bRet = TRUE;
break;
}
getchar();
return bRet;
}
BOOL Int3ExceptionProc(EXCEPTION_DEBUG_INFO *pExceptionInfo)
{
BOOL bRet = FALSE;
//1. 将INT 3修复为原来的数据(如果是系统断点,不用修复)
if(bIsSystemInt3)
{
bIsSystemInt3 = FALSE;
return TRUE;
}
else
{
WriteProcessMemory(hDebuggeeProcess, pExceptionInfo->ExceptionRecord.ExceptionAddress, &OriginalCode, 1, NULL);
}
//2. 显示断点位置
printf("Int 3断点 : 0x%p \r\n", pExceptionInfo->ExceptionRecord.ExceptionAddress);
//3. 获取线程上下文
Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
GetThreadContext(hDebuggeeThread, &Context);
//4. 修正EIP
Context.Eip--;
SetThreadContext(hDebuggeeThread, &Context);
//5. 显示反汇编代码、寄存器等
//6. 等待用户命令
while(bRet == FALSE)
{
bRet = WaitForUserCommand();
}
return bRet;
}
BOOL AccessExceptionProc(EXCEPTION_DEBUG_INFO *pExceptionInfo)
{
BOOL bRet = FALSE;
DWORD dwAccessFlag; //访问类型 0为读 1为写
DWORD dwAccessAddr; //访问地址
DWORD dwProtect; //内存属性
//1. 获取异常信息,修改内存属性
dwAccessFlag = pExceptionInfo->ExceptionRecord.ExceptionInformation[0];
dwAccessAddr = pExceptionInfo->ExceptionRecord.ExceptionInformation[1];
printf("内存断点 : dwAccessFlag - %x dwAccessAddr - %x \n", dwAccessFlag, dwAccessAddr);
VirtualProtectEx(hDebuggeeProcess, (VOID*)dwAccessAddr, 1, dwOriginalProtect, &dwProtect);
//2. 获取线程上下文
Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
GetThreadContext(hDebuggeeThread, &Context);
//3. 修正EIP(内存访问异常,不需要修正EIP)
printf("Eip: 0x%p \n", Context.Eip);
//4. 显示汇编/寄存器等信息
//5. 等待用户命令
while(bRet == FALSE)
{
bRet = WaitForUserCommand();
}
return bRet;
}
BOOL SingleStepExceptionProc(EXCEPTION_DEBUG_INFO *pExceptionInfo)
{
BOOL bRet = TRUE;
return bRet;
}
BOOL ExceptionHandler(DEBUG_EVENT *pDebugEvent)
{
BOOL bRet = TRUE;
EXCEPTION_DEBUG_INFO *pExceptionInfo = NULL;
pExceptionInfo = &pDebugEvent->u.Exception;
//得到线程句柄,后面要用
FnOpenThread MyOpenThread = (FnOpenThread)GetProcAddress(LoadLibrary("kernel32.dll"), "OpenThread");
hDebuggeeThread = MyOpenThread(THREAD_ALL_ACCESS, FALSE, pDebugEvent->dwThreadId);
switch(pExceptionInfo->ExceptionRecord.ExceptionCode)
{
//INT 3异常
case EXCEPTION_BREAKPOINT:
{
bRet = Int3ExceptionProc(pExceptionInfo);
break;
}
//访问异常
case EXCEPTION_ACCESS_VIOLATION:
bRet = AccessExceptionProc(pExceptionInfo);
break;
//单步执行
case EXCEPTION_SINGLE_STEP:
bRet = SingleStepExceptionProc(pExceptionInfo);
break;
}
return bRet;
}
VOID SetInt3BreakPoint(LPVOID addr)
{
CHAR int3 = 0xCC;
//1. 备份
ReadProcessMemory(hDebuggeeProcess, addr, &OriginalCode, 1, NULL);
//2. 修改
WriteProcessMemory(hDebuggeeProcess, addr, &int3, 1, NULL);
}
VOID SetMemBreakPoint(PCHAR pAddress)
{
//1. 访问断点
VirtualProtectEx(hDebuggeeProcess, pAddress, 1, PAGE_NOACCESS, &dwOriginalProtect); //PTE P=0
//2. 写入断点
//VirtualProtectEx(hDebuggeeProcess, pAddress, 1, PAGE_EXECUTE_READ, &dwOriginalProtect); //PTE R/W=0
}
int main(int argc, char* argv[])
{
BOOL nIsContinue = TRUE;
DEBUG_EVENT debugEvent = {0};
BOOL bRet = TRUE;
DWORD dwContinue = DBG_CONTINUE;
//1.创建调试进程
STARTUPINFO startupInfo = {0};
PROCESS_INFORMATION pInfo = {0};
GetStartupInfo(&startupInfo);
bRet = CreateProcess(DEBUGGEE, NULL, NULL, NULL, TRUE, DEBUG_PROCESS || DEBUG_ONLY_THIS_PROCESS, NULL, NULL, &startupInfo, &pInfo);
if(!bRet)
{
printf("CreateProcess error: %d \n", GetLastError());
return 0;
}
hDebuggeeProcess = pInfo.hProcess;
//2.调试循环
while(nIsContinue)
{
bRet = WaitForDebugEvent(&debugEvent, INFINITE);
if(!bRet)
{
printf("WaitForDebugEvent error: %d \n", GetLastError());
return 0;
}
switch(debugEvent.dwDebugEventCode)
{
//1.异常
case EXCEPTION_DEBUG_EVENT:
bRet = ExceptionHandler(&debugEvent);
if(!bRet)
dwContinue = DBG_EXCEPTION_NOT_HANDLED;
break;
//2.
case CREATE_THREAD_DEBUG_EVENT:
break;
//3.创建进程
case CREATE_PROCESS_DEBUG_EVENT:
//int3 断点
//SetInt3BreakPoint((PCHAR)debugEvent.u.CreateProcessInfo.lpStartAddress);
//内存断点
SetMemBreakPoint((PCHAR)debugEvent.u.CreateProcessInfo.lpStartAddress);
break;
//4.
case EXIT_THREAD_DEBUG_EVENT:
break;
//5.
case EXIT_PROCESS_DEBUG_EVENT:
break;
//6.
case LOAD_DLL_DEBUG_EVENT:
break;
//7.
case UNLOAD_DLL_DEBUG_EVENT:
break;
//8.
case OUTPUT_DEBUG_STRING_EVENT:
break;
}
bRet = ContinueDebugEvent(debugEvent.dwProcessId, debugEvent.dwThreadId, DBG_CONTINUE);
}
return 0;
}
实现效果如下