...................................................... Loading unloaded module list .............. This dump file has an exception of interest stored in it. The stored exception information can be accessed via .ecxr. (40c.468): Access violation - code c0000005 (first/second chance not available) eax=637964b8 ebx=00000000 ecx=78ca7d2d edx=78e1acf4 esi=63580000 edi=00000000 eip=63af2ca1 esp=00eea04c ebp=00eea080 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200206 SgHI!HICreateHostIntegrity+0x73: 63af2ca1 89700c mov dword ptr [eax+0Ch],esi ds:0023:637964c4=???????? 0:003> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* GetPageUrlData failed, server returned HTTP status 404 URL requested: http://watson.microsoft.com/StageOne/Smc_exe/12_1_2015_2015/SgHI_dll/12_1_2015_2015/00032ca1.htm?Retriage=1 FAULTING_IP: SgHI!HICreateHostIntegrity+73 [c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 183] 63af2ca1 89700c mov dword ptr [eax+0Ch],esi EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 63af2ca1 (SgHI!HICreateHostIntegrity+0x00000073) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 637964c4 Attempt to write to address 637964c4 DEFAULT_BUCKET_ID: INVALID_POINTER_READ PROCESS_NAME: Smc.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx" EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx" EXCEPTION_PARAMETER1: 00000001 EXCEPTION_PARAMETER2: 637964c4 WRITE_ADDRESS: 637964c4 FOLLOWUP_IP: GUProxy!afxModuleState+0 637964b8 ?? ??? MOD_LIST: <ANALYSIS/> NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [UnloadedModule_Arch_BP] from Frame:[0] on thread:[468] ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD] LAST_CONTROL_TRANSFER: from 0048698a to 63af2ca1 FAULTING_THREAD: ffffffff PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ_INVALID_POINTER_WRITE STACK_TEXT: 00000000 00000000 guproxy!afxModuleState+0x0 STACK_COMMAND: .ecxr ; ~~[468] ; .frame 0 ; dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ** Pseudo Context ** ; kb SYMBOL_NAME: guproxy!afxModuleState+0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: GUProxy IMAGE_NAME: GUProxy.plg DEBUG_FLR_IMAGE_TIMESTAMP: 5095227b FAILURE_BUCKET_ID: INVALID_POINTER_READ_c0000005_GUProxy.plg!afxModuleState BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_INVALID_POINTER_WRITE_guproxy!afxModuleState+0 WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/Smc_exe/12_1_2015_2015/50951df4/SgHI_dll/12_1_2015_2015/5095227c/c0000005/00032ca1.htm?Retriage=1 Followup: MachineOwner --------- 0:003> k ChildEBP RetAddr 00eea080 0048698a SgHI!HICreateHostIntegrity+0x73 [c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 183] 00eea320 0048957e Smc!Initialize+0x11fb [c:\bld_area\sep_12.1\windows\sepclient\ci\smc\smcserv.cpp @ 3407] 00eefe30 0049ef38 Smc!ServiceStart+0x13e7 [c:\bld_area\sep_12.1\windows\sepclient\ci\smc\smcserv.cpp @ 6807] 00eefe40 004a1853 Smc!CServiceResponder::Wait_StartService+0x53 [c:\bld_area\sep_12.1\windows\sepclient\ci\smc\servthrd.cpp @ 104] 00eeffa0 77d9deab Smc!service_main+0x113 [c:\bld_area\sep_12.1\windows\sepclient\ci\smc\service.cpp @ 146] 00eeffb4 7c80b699 advapi32!ScSvcctrlThreadW+0x12 00eeffec 00000000 kernel32!BaseThreadStart+0x37 0:003> 0:003> uf SgHI!HICreateHostIntegrity SgHI!HICreateHostIntegrity [c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 176]: 176 63af2c2e 55 push ebp 176 63af2c2f 8bec mov ebp,esp 176 63af2c31 83e4f8 and esp,0FFFFFFF8h 176 63af2c34 6aff push 0FFFFFFFFh 176 63af2c36 6824f0af63 push offset SgHI!_chkstk+0x4714 (63aff024) 176 63af2c3b 64a100000000 mov eax,dword ptr fs:[00000000h] 176 63af2c41 50 push eax 176 63af2c42 83ec18 sub esp,18h 176 63af2c45 53 push ebx 176 63af2c46 56 push esi 176 63af2c47 57 push edi 176 63af2c48 a17c30b163 mov eax,dword ptr [SgHI!__security_cookie (63b1307c)] 176 63af2c4d 33c4 xor eax,esp 176 63af2c4f 50 push eax 176 63af2c50 8d442428 lea eax,[esp+28h] 176 63af2c54 64a300000000 mov dword ptr fs:[00000000h],eax 179 63af2c5a 68a8050000 push 5A8h 179 63af2c5f ff154004b063 call dword ptr [SgHI!_imp_??2YAPAXIZ (63b00440)] 179 63af2c65 59 pop ecx 179 63af2c66 89442410 mov dword ptr [esp+10h],eax 179 63af2c6a 33ff xor edi,edi 179 63af2c6c 897c2430 mov dword ptr [esp+30h],edi 179 63af2c70 3bc7 cmp eax,edi 179 63af2c72 740f je SgHI!HICreateHostIntegrity+0x55 (63af2c83) SgHI!HICreateHostIntegrity+0x46 [c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 179]: 179 63af2c74 ff750c push dword ptr [ebp+0Ch] 179 63af2c77 50 push eax 179 63af2c78 e87162fdff call SgHI!CHIEngine::CHIEngine (63ac8eee) 179 63af2c7d 89442410 mov dword ptr [esp+10h],eax 179 63af2c81 eb04 jmp SgHI!HICreateHostIntegrity+0x59 (63af2c87) SgHI!HICreateHostIntegrity+0x55 [c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 179]: 179 63af2c83 897c2410 mov dword ptr [esp+10h],edi SgHI!HICreateHostIntegrity+0x59 [c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 179]: 179 63af2c87 834c2430ff or dword ptr [esp+30h],0FFFFFFFFh 181 63af2c8c e8e977ffff call SgHI!CResourceLoader::Initialize (63aea47a) 181 63af2c91 85c0 test eax,eax 181 63af2c93 7814 js SgHI!HICreateHostIntegrity+0x7b (63af2ca9) SgHI!HICreateHostIntegrity+0x67 [c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 183]: 183 63af2c95 8b35d457b163 mov esi,dword ptr [SgHI!g_ResLoader+0x4 (63b157d4)] 183 63af2c9b ff158404b063 call dword ptr [SgHI!_imp_?AfxGetModuleStateYGPAVAFX_MODULE_STATEXZ (63b00484)] 183 63af2ca1 89700c mov dword ptr [eax+0Ch],esi ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ crashed here. 185 63af2ca4 e9d9000000 jmp SgHI!HICreateHostIntegrity+0x154 (63af2d82) SgHI!HICreateHostIntegrity+0x7b [c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 187]: 187 63af2ca9 8b1d0447b163 mov ebx,dword ptr [SgHI!g_opsys_IWPPLog (63b14704)] 187 63af2caf 3bdf cmp ebx,edi 187 63af2cb1 7454 je SgHI!HICreateHostIntegrity+0xd9 (63af2d07) ... ... SgHI!HICreateHostIntegrity+0x149 [c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 187]: 187 63af2d77 ff74241c push dword ptr [esp+1Ch] 187 63af2d7b ff15dc02b063 call dword ptr [SgHI!_imp__free (63b002dc)] 187 63af2d81 59 pop ecx SgHI!HICreateHostIntegrity+0x154 [c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 190]: 190 63af2d82 8b442410 mov eax,dword ptr [esp+10h] 191 63af2d86 8b4c2428 mov ecx,dword ptr [esp+28h] 191 63af2d8a 64890d00000000 mov dword ptr fs:[0],ecx 191 63af2d91 59 pop ecx 191 63af2d92 5f pop edi 191 63af2d93 5e pop esi 191 63af2d94 5b pop ebx 191 63af2d95 8be5 mov esp,ebp 191 63af2d97 5d pop ebp 191 63af2d98 c3 ret 0:003> dd SgHI!g_ResLoader 63b157d0 63b0910c 63580000 63ac0000 49486753 63b157e0 2e736552 006c6c64 00000000 0000000b 63b157f0 0000000f 00000000 026d4860 00000000 63b15800 00000000 00000000 0000005e 0000005f 63b15810 00000000 026d4760 00000000 00000000 63b15820 00000000 00000056 0000005f 00000000 63b15830 00000100 00000000 00000000 00000000 63b15840 00000000 00000000 0000000f 00000000 0:003> dt CSPAResourceLoader 63b157d0 Smc!CSPAResourceLoader +0x000 __VFN_table : 0x63b0910c +0x004 m_hResModule : 0x63580000 HINSTANCE__ +0x008 m_hModule : 0x63ac0000 HINSTANCE__ +0x00c m_szSatelliteDll : std::basic_string<char,std::char_traits<char>,std::allocator<char> > +0x028 m_szFullResDllPath : std::basic_string<char,std::char_traits<char>,std::allocator<char> > +0x044 m_szFullBinaryDllPath : std::basic_string<char,std::char_traits<char>,std::allocator<char> > +0x060 m_bVersionMissMatch : 0 +0x061 m_bVersionCheckEnabled : 1 +0x064 m_szVersionMismatchMsg : std::basic_string<char,std::char_traits<char>,std::allocator<char> > +0x080 m_szErrorTitle : std::basic_string<char,std::char_traits<char>,std::allocator<char> > // m_szSatelliteDll 0:003> !stl -n (std::basic_string<char,std::char_traits<char>,std::allocator<char> >) 63b157d0+0xc [da 0x63b157dc] 63b157dc "SgHIRes.dll" // m_szFullResDllPath 0:003> !stl -n (std::basic_string<char,std::char_traits<char>,std::allocator<char> >) 63b157d0+0x28 [da 0x26d4860] 026d4860 "C:\Program Files\Symantec\Symant" 026d4880 "ec Endpoint Protection\12.1.2015" 026d48a0 ".2015.105\Res\1041\SgHIRes.dll" // m_szFullBinaryDllPath 0:003> !stl -n (std::basic_string<char,std::char_traits<char>,std::allocator<char> >) 63b157d0+0x44 [da 0x26d4760] 026d4760 "C:\Program Files\Symantec\Symant" 026d4780 "ec Endpoint Protection\12.1.2015" 026d47a0 ".2015.105\Bin\SgHI.dll" 0:003> // These string members in this CResourceLoader object were empty. // m_szVersionMismatchMsg // m_szErrorTitle SGHI_API IHIEngine* HICreateHostIntegrity(dword *err_code, HANDLE hSmcStopEvent) { ... if(SUCCEEDED(g_ResLoader.Initialize())) { AfxSetResourceHandle(g_ResLoader.GetResourceInstance()); } ... ... class CResourceLoader { public: ... const HINSTANCE GetResourceInstance(void) const { return m_hResModule; } :::::::::: atlmfc\include\afxwin1.inl :::::::::: _AFXWIN_INLINE void AFXAPI AfxSetResourceHandle(HINSTANCE hInstResource) { ASSERT(hInstResource != NULL); afxCurrentResourceHandle = hInstResource; } atlmfc\include\afxwin.h #define afxCurrentResourceHandle AfxGetModuleState()->m_hCurrentResourceHandle :::::::::: atlmfc\include\afxstat_.h :::::::::: AFX_MODULE_STATE* AFXAPI AfxGetModuleState(); :::::::::: atlmfc\include\afxstat_.h :::::::::: class AFX_MODULE_STATE : public CNoTrackObject { public: #ifdef _AFXDLL AFX_MODULE_STATE(BOOL bDLL, WNDPROC pfnAfxWndProc, DWORD dwVersion, BOOL bSystem = FALSE); #else explicit AFX_MODULE_STATE(BOOL bDLL); #endif ~AFX_MODULE_STATE(); CWinApp* m_pCurrentWinApp; HINSTANCE m_hCurrentInstanceHandle; HINSTANCE m_hCurrentResourceHandle; LPCTSTR m_lpszCurrentAppName; ... 0:003> dt AFX_MODULE_STATE Smc!AFX_MODULE_STATE +0x000 __VFN_table : Ptr32 +0x004 m_pCurrentWinApp : Ptr32 CWinApp +0x008 m_hCurrentInstanceHandle : Ptr32 HINSTANCE__ +0x00c m_hCurrentResourceHandle : Ptr32 HINSTANCE__ +0x010 m_lpszCurrentAppName : Ptr32 Char +0x014 m_bDLL : UChar +0x015 m_bSystem : UChar +0x016 m_bReserved : [2] UChar +0x018 m_fRegisteredClasses : Uint4B +0x01c m_pClassInit : Ptr32 CRuntimeClass +0x020 m_classList : CTypedSimpleList<CRuntimeClass *> +0x028 m_pFactoryInit : Ptr32 COleObjectFactory +0x02c m_factoryList : CTypedSimpleList<COleObjectFactory *> +0x034 m_nObjectCount : Int4B +0x038 m_bUserCtrl : Int4B +0x03c m_strUnregisterList : ATL::CStringT<char,StrTraitMFC_DLL<char,ATL::ChTraitsCRT<char> > > +0x040 m_pfnAfxWndProc : Ptr32 long +0x044 m_dwVersion : Uint4B +0x048 m_pfnFilterToolTipMessage : Ptr32 void +0x04c m_libraryList : CTypedSimpleList<CDynLinkLibrary *> +0x054 m_appLangDLL : Ptr32 HINSTANCE__ +0x058 m_pOccManager : Ptr32 COccManager +0x05c m_lockList : CTypedSimpleList<COleControlLock *> +0x064 m_pDaoState : Ptr32 _AFX_DAO_STATE +0x068 m_typeLibCache : CTypeLibCache +0x08c m_pTypeLibCacheMap : Ptr32 CTypeLibCacheMap +0x090 m_thread : CThreadLocal<AFX_MODULE_THREAD_STATE> +0x094 m_pDllIsolationWrappers : Ptr32 Ptr32 CDllIsolationWrapperBase +0x098 m_bSetAmbientActCtx : Int4B +0x09c m_hActCtx : Ptr32 Void +0x0a0 m_bInitNetworkAddressControl : Int4B +0x0a4 m_bInitNetworkAddressControlCalled : Int4B This is the reason why the code is accessing the returned value from AfxGetModuleState(). The inline function AfxSetResourceHandle() calls AfxGetModuleState(), and then stores the given HINSTANCE handle value (esi=63580000) to the m_hCurrentResourceHandle field of AFX_MODULE_STATE class object which address has been returned by AfxGetModuleState(). According to the eax register, the AfxGetModuleState() returned 637964b8. But, this address is invalid. 0:003> r Last set context: eax=637964b8 ebx=00000000 ecx=78ca7d2d edx=78e1acf4 esi=63580000 edi=00000000 eip=63af2ca1 esp=00eea04c ebp=00eea080 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200206 SgHI!HICreateHostIntegrity+0x73: 63af2ca1 89700c mov dword ptr [eax+0Ch],esi ds:0023:637964c4=???????? 0:003> lm start end module name 00400000 005b6000 Smc (private pdb symbols) c:\symbols\Smc.pdb\5A03CAD3F9C04EA3946049B7C0A27CAE1\Smc.pdb ... 63580000 63584000 SgHIRes (pdb symbols) c:\symbols\SgHIRes.pdb\82E676575B9845E88DD11159DCF5EC611\SgHIRes.pdb ... 63ac0000 63b36000 SgHI (private pdb symbols) c:\symbols\SgHI.pdb\10A6640B6A8E46D2A2C036D714F7EC311\SgHI.pdb ... ... Unloaded modules: ... 63760000 6379d000 GUProxy.plg ... ... 0:003> !address 637964b8 Failed to map Heaps (error 80004005) Address 637964b8 could not be mapped in any available regions 0:003> dt 637964b8 AFX_MODULE_STATE Smc!AFX_MODULE_STATE +0x000 __VFN_table : ???? +0x004 m_pCurrentWinApp : ???? +0x008 m_hCurrentInstanceHandle : ???? +0x00c m_hCurrentResourceHandle : ???? +0x010 m_lpszCurrentAppName : ???? +0x014 m_bDLL : ?? +0x015 m_bSystem : ?? +0x016 m_bReserved : [2] "--- memory read error at address 0x637964ce ---" +0x018 m_fRegisteredClasses : ?? +0x01c m_pClassInit : ???? +0x020 m_classList : CTypedSimpleList<CRuntimeClass *> +0x028 m_pFactoryInit : ???? +0x02c m_factoryList : CTypedSimpleList<COleObjectFactory *> +0x034 m_nObjectCount : ?? +0x038 m_bUserCtrl : ?? +0x03c m_strUnregisterList : ATL::CStringT<char,StrTraitMFC_DLL<char,ATL::ChTraitsCRT<char> > > +0x040 m_pfnAfxWndProc : ???? +0x044 m_dwVersion : ?? +0x048 m_pfnFilterToolTipMessage : ???? +0x04c m_libraryList : CTypedSimpleList<CDynLinkLibrary *> +0x054 m_appLangDLL : ???? +0x058 m_pOccManager : ???? +0x05c m_lockList : CTypedSimpleList<COleControlLock *> +0x064 m_pDaoState : ???? +0x068 m_typeLibCache : CTypeLibCache +0x08c m_pTypeLibCacheMap : ???? +0x090 m_thread : CThreadLocal<AFX_MODULE_THREAD_STATE> +0x094 m_pDllIsolationWrappers : ???? +0x098 m_bSetAmbientActCtx : ?? +0x09c m_hActCtx : ???? +0x0a0 m_bInitNetworkAddressControl : ?? +0x0a4 m_bInitNetworkAddressControlCalled : ?? Memory read error 6379655c Let's see what the AfxGetModuleState() function does. It calls mfc100!CThreadLocalObject::GetData function, and then add +4 offset to the returned value to get the address it returns. According to the function name, the data is obtained from TLS. 0:003> uf SgHI!AfxGetModuleState SgHI!AfxGetModuleState: 63af3b7a ff258404b063 jmp dword ptr [SgHI!_imp_?AfxGetModuleStateYGPAVAFX_MODULE_STATEXZ (63b00484)] mfc100!AfxGetModuleState: 78c959d6 68165bc978 push offset mfc100!CThreadLocal<_AFX_THREAD_STATE>::CreateObject (78c95b16) 78c959db b9bcfde178 mov ecx,offset mfc100!_afxThreadState (78e1fdbc) 78c959e0 e8cb220100 call mfc100!CThreadLocalObject::GetData (78ca7cb0) 78c959e5 85c0 test eax,eax 78c959e7 7505 jne mfc100!AfxGetModuleState+0x18 (78c959ee) mfc100!AfxGetModuleState+0x13: 78c959e9 e913f70b00 jmp mfc100!AfxThrowInvalidArgException (78d55101) mfc100!AfxGetModuleState+0x18: 78c959ee 8b4004 mov eax,dword ptr [eax+4] 78c959f1 85c0 test eax,eax 78c959f3 7513 jne mfc100!AfxGetModuleState+0x32 (78c95a08) mfc100!AfxGetModuleState+0x1f: 78c959f5 68335bc978 push offset mfc100!CProcessLocal<_AFX_BASE_MODULE_STATE>::CreateObject (78c95b33) 78c959fa b9b8fde178 mov ecx,offset mfc100!_afxBaseModuleState (78e1fdb8) 78c959ff e872230100 call mfc100!CProcessLocalObject::GetData (78ca7d76) 78c95a04 85c0 test eax,eax 78c95a06 74e1 je mfc100!AfxGetModuleState+0x13 (78c959e9) mfc100!AfxGetModuleState+0x32: 78c95a08 c3 ret mfc100!AfxThrowInvalidArgException: 78d55101 8bff mov edi,edi 78d55103 55 push ebp 78d55104 8bec mov ebp,esp 78d55106 51 push ecx 78d55107 68a0e4dd78 push offset mfc100!_TI5PAVCInvalidArgException (78dde4a0) 78d5510c 8d45fc lea eax,[ebp-4] 78d5510f 50 push eax 78d55110 c745fcd01fe178 mov dword ptr [ebp-4],offset mfc100!_simpleInvalidArgException (78e11fd0) 78d55117 e8ba9d0600 call mfc100!_CxxThrowException (78dbeed6) 78d5511c cc int 3 78d5511d cc int 3 78d5511e cc int 3 78d5511f cc int 3 78d55120 cc int 3 78d55121 cc int 3 78d55122 8bff mov edi,edi 78d55124 55 push ebp 78d55125 8bec mov ebp,esp 78d55127 f6450801 test byte ptr [ebp+8],1 78d5512b 56 push esi 78d5512c 8bf1 mov esi,ecx 78d5512e c706043cb978 mov dword ptr [esi],offset mfc100!CSimpleException::`vftable' (78b93c04) 78d55134 7408 je mfc100!CMemoryException::`scalar deleting destructor'+0x1c (78d5513e) mfc100!CMemoryException::`scalar deleting destructor'+0x14: 78d55136 56 push esi 78d55137 ff153815b678 call dword ptr [mfc100!_imp__free (78b61538)] 78d5513d 59 pop ecx mfc100!CMemoryException::`scalar deleting destructor'+0x1c: 78d5513e 8bc6 mov eax,esi 78d55140 5e pop esi 78d55141 5d pop ebp 78d55142 c20400 ret 4 0:003> dps 63b00484 l1 63b00484 78c959d6 mfc100!AfxGetModuleState 0:003>
dump analyze example
最新推荐文章于 2024-07-14 12:05:08 发布