gdiplus函数调用错误导致程序Crash分析

前几天看一个Crash的问题。功能是Word上的一个插件，点击上面的一个button，cation实现了，但点击结束后，过一会Word就crash了。下面是问题的分析.

 

 

调试问题

 

问题复现

程序crash时，获得如下log.

 4aea74b2 ?? ??? 0:006> kb ChildEBP RetAddr Args to Child WARNING: Frame IP not in any known module. Following frames may be wrong. 0a89ff80 7c80a173 00000011 00000000 8984c9f8 0x4aea74b2 0a89ffb4 7c80b729 00000000 7c80a174 00000011 kernel32!_allmul+0xa 0a89ffec 00000000 4aea7456 00000000 00000000 kernel32!BaseThreadStart+0x37

0x4aea74b2，指令无效。是访问内存溢出导致EIP被修改，还是对应模块从内存中unload出去了？

 

开始调试

上调试器,看看是否有模块被unload了。

0:004> .logopen c:/crash.log 0:004> sxn ld 0:004> sxn ud 0:004> g ModLoad: 0a490000 0a501000 D:/Program Files/ProductPath/dllistmt.dll ModLoad: 4ae90000 4b03b000 D:/WINDOWS/WinSxS/x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22509_x-ww_c7dad023/gdiplus.dll ModLoad: 0a970000 0aaf4000 D:/Program Files/ProductPath/dllocres.dll ModLoad: 0ab00000 0ab8d000 D:/Program Files/ProductPath/dllWebAPI.dll ModLoad: 0a540000 0a561000 D:/Program Files/ProductPath/dllhttp.dll ModLoad: 3e410000 3e4e1000 D:/WINDOWS/system32/WININET.dll ModLoad: 0a580000 0a589000 D:/WINDOWS/system32/Normaliz.dll ModLoad: 3eab0000 3eaf5000 D:/WINDOWS/system32/iertutil.dll Launching spec process to start at spec directory. /helpModLoad: 5fdd0000 5fe25000 D:/WINDOWS/system32/netapi32.dll ModLoad: 43ce0000 43e08000 D:/WINDOWS/system32/urlmon.dll Unload module D:/Program Files/ProductPath/dllistmt.dll at 0a490000 Unload module D:/WINDOWS/WinSxS/x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22509_x-ww_c7dad023/gdiplus.dll at 4ae90000 Unload module D:/Program Files/ProductPath/dllWebAPI.dll at 0ab00000 Unload module D:/Program Files/ProductPath/dllhttp.dll at 0a540000 Unload module D:/WINDOWS/system32/WININET.dll at 3e410000 Unload module D:/WINDOWS/system32/Normaliz.dll at 0a580000 Unload module D:/Program Files/ProductPath/dllocres.dll at 0a970000 (d1c.a18): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000001 ebx=00000000 ecx=00000000 edx=7c92e514 esi=4b0172a4 edi=77d2a340 eip=4aea74c6 esp=0afaff84 ebp=0afaffb4 iopl=0 nv up ei pl nz ac pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010216 4aea74c6 ?? ???

 

 

从L6和L29的内容，说明准备执行unloaded模块GdiPlus中的函数，导致访问违例。

这时我们可以继续跟踪看看这个地址偏移量是什么code，也可以使用Application Verifier看看它能不能给我们更多的信息。

 

 

Application Verifier

 

下面是启动Application Verifier后的调试结果。

Launching spec process to start at spec directory. /help =========================================================== VERIFIER STOP 00000201: pid 0xFAC: unloading dll containing active critical section 4B0172D4 : Critical section address 002EB2F4 : Initialization stack trace. Use dds to dump it if non-NULL. 0145740C : DLL name address (use `du ADDRESS' to dump if not null) 4AE90000 : DLL base address =========================================================== (fac.fb8): Break instruction exception - code 80000003 (first chance) eax=00000000 ebx=002eb2f4 ecx=7c93f6a7 edx=0012ef04 esi=00000201 edi=4b0172d4 eip=7c92120e esp=0012f138 ebp=0012f14c iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 ntdll!DbgBreakPoint: