windows用户态调试

最新推荐文章于 2023-08-12 14:18:18 发布

张某人的胡思乱想

最新推荐文章于 2023-08-12 14:18:18 发布

阅读量1.1k

点赞数 1

分类专栏：杂谈 debug 文章标签： windows

本文链接：https://blog.csdn.net/hb_zxl/article/details/116562103

版权

杂谈同时被 2 个专栏收录

25 篇文章 1 订阅

订阅专栏

debug

9 篇文章 0 订阅

订阅专栏

windows用户态调试

打开windows的记事本小程序，windbg attach到这个进程，发现notepad不能动了，这是用户态调试的特点：
进入调试模式，应用程序所有线程都处于freeze状态。
观察一下线程状态：会看到有6个线程。
0:006> ~*
0 Id: 1de4.1f6c Suspend: 1 Teb: 000007ff`fffdc000 Unfrozen
Start: notepad!WinMainCRTStartup (00000000`ff683acc)
Priority: 0 Priority class: 32 Affinity: 3
1 Id: 1de4.2228 Suspend: 1 Teb: 000007ff`fffda000 Unfrozen
Start: winhadnt64!DelPassthru+0x15a0 (000007fe`f5d5fab0)
Priority: 0 Priority class: 32 Affinity: 3
2 Id: 1de4.1ca4 Suspend: 1 Teb: 000007ff`fffd8000 Unfrozen
Start: ntdll!TppWaiterpThread (00000000`76ff31e0)
Priority: 0 Priority class: 32 Affinity: 3
3 Id: 1de4.2070 Suspend: 1 Teb: 000007ff`fff9e000 Unfrozen
Start: SOGOUPY!ImeDestroy+0x3ec204 (000007fe`f2393a44)
Priority: 0 Priority class: 32 Affinity: 3
4 Id: 1de4.13c0 Suspend: 1 Teb: 000007ff`fff9c000 Unfrozen
Start: SOGOUPY!ImeDestroy+0x3ec204 (000007fe`f2393a44)
Priority: 0 Priority class: 32 Affinity: 3
5 Id: 1de4.217c Suspend: 1 Teb: 000007ff`fff9a000 Unfrozen
Start: SOGOUPY!ImeDestroy+0x3ab110 (000007fe`f2352950)
Priority: 0 Priority class: 32 Affinity: 3
. 6 Id: 1de4.1dc8 Suspend: 1 Teb: 000007ff`fffd6000 Unfrozen
Start: ntdll!DbgUiRemoteBreakin (00000000`770d9470)
Priority: 0 Priority class: 32 Affinity: 3
大部分线程不知所云，0号线程看着亲切，查看0号线程：
0:006> ~0k
# Child-SP RetAddr Call Site
00 00000000`001afa08 00000000`76dd9d7e USER32!NtUserGetMessage+0xa
01 00000000`001afa10 00000000`ff681064 USER32!GetMessageW+0x34
02 00000000`001afa40 00000000`ff68133c notepad!WinMain+0x182
03 00000000`001afac0 00000000`76ed556d notepad!DisplayNonGenuineDlgWorker+0x2da
04 00000000`001afb80 00000000`7703372d kernel32!BaseThreadInitThunk+0xd
05 00000000`001afbb0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
WinMain说明是windows的主函数，GetMessageW 说明是在等windows消息。看来这个线程是主处理函数。
还有个6号线程，比较关键，DbgUiRemoteBreakin好像是远程中断的意思。我们分析一下：
0:006> u
ntdll!DbgBreakPoint:
00000000`7704b0f0 cc int 3
00000000`7704b0f1 c3 ret
00000000`7704b0f2 cc int 3
00000000`7704b0f3 cc int 3
00000000`7704b0f4 cc int 3
00000000`7704b0f5 cc int 3
反汇编发现是int 3中断
0:006> r
rax=000007fffffd6000 rbx=0000000000000000 rcx=000007fffffde000
rdx=00000000770d9470 rsi=0000000000000000 rdi=0000000000000000
rip=000000007704b0f0 rsp=0000000006b5fda8 rbp=0000000000000000
r8=0000000000000000 r9=00000000770d9470 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000244
ntdll!DbgBreakPoint:
00000000`7704b0f0 cc int 3
r命令观察现场，也是执行int 3
调试器中断被调试程序，会在被调试程序中创建一个线程，叫做远程中断线程RemoteBreakin，就是这个6号线程。
这个线程的作用就是触发一个int3, 被调试程序中本来没有这个线程，调试器通过windows的RemoteCreateThread在notepad中创建了这个线程。
int3中断会调用到内核，内核就会将notepad的所有thread都 freeze，程序就停下来了。
要恢复运行，就执行g命令，调试器执行continue debug event，notepad恢复运行。

像上次研究winmine小程序，这次再观察一下readfile在notepad中的调用。
0:006> x ntdll!*readfile*
00000000`770acce0 ntdll!ResReadFile (<no parameter info>)
00000000`7708f020 ntdll!LdrpResReadFile (<no parameter info>)
00000000`77049800 ntdll!ZwReadFile (<no parameter info>)
00000000`77049a80 ntdll!NtReadFileScatter (<no parameter info>)
00000000`77049a80 ntdll!ZwReadFileScatter (<no parameter info>)
00000000`77049800 ntdll!NtReadFile (<no parameter info>)
0:007> bp ntdll!ZwReadFile

然后很开命中了
0:000> k
# Child-SP RetAddr Call Site
00 00000000`001cced8 000007fe`fcb51a6a ntdll!ZwReadFile
01 00000000`001ccee0 00000000`76ed0599 KERNELBASE!ReadFile+0x76
02 00000000`001ccf60 000007fe`f5d1ed8e kernel32!ReadFileImplementation+0x55
03 00000000`001ccfa0 000007fe`f5a6a7af winhadnt64!INJUninstallDetours+0xaa1fe
04 00000000`001cd0a0 000007fe`f20800f2 DtFrame64!EATUninstallRaw+0x18f2f
05 00000000`001cd140 000007fe`f2082b76 SOGOUPY!ImeDestroy+0xd88b2
06 00000000`001cd190 000007fe`f2087116 SOGOUPY!ImeDestroy+0xdb336
07 00000000`001cd1d0 000007fe`f206ef4f SOGOUPY!ImeDestroy+0xdf8d6
08 00000000`001cd600 000007fe`f206901c SOGOUPY!ImeDestroy+0xc770f
09 00000000`001cdbf0 000007fe`f208d6ee SOGOUPY!ImeDestroy+0xc17dc
0a 00000000`001cdc20 000007fe`f208da6a SOGOUPY!ImeDestroy+0xe5eae
0b 00000000`001cde10 000007fe`f1fb1cc0 SOGOUPY!ImeDestroy+0xe622a
0c 00000000`001cdea0 000007fe`f203d132 SOGOUPY!ImeDestroy+0xa480
0d 00000000`001ce3b0 000007fe`f203c8b0 SOGOUPY!ImeDestroy+0x958f2
0e 00000000`001ce4b0 000007fe`f203cabb SOGOUPY!ImeDestroy+0x95070
0f 00000000`001ce500 000007fe`f203c3a9 SOGOUPY!ImeDestroy+0x9527b
10 00000000`001ce780 00000000`76dd9ac1 SOGOUPY!ImeDestroy+0x94b69
11 00000000`001ce7e0 00000000`76dd694c USER32!UserCallWinProcCheckWow+0x1ad
12 00000000`001ce8a0 00000000`76dd3cd6 USER32!SendMessageWorker+0x682
13 00000000`001ce930 00000000`76dd3e56 USER32!SendMessageToUI+0x6a
原来是搜狗拼音的钩子进程，影响了我调试notepad
这个搜狗拼音只要一打开窗口就会读文件。

uninstall the sougoupin, attach the notepad process
0:000> k
# Child-SP RetAddr Call Site
00 00000000`000ddf38 00000000`76f167d8 ntdll!ZwReadFile
01 00000000`000ddf40 00000000`76f163bf kernel32!BaseDllOpenIniFileOnDisk+0x338
02 00000000`000de030 00000000`76f162d9 kernel32!BaseDllReadWriteIniFileOnDisk+0x3f
03 00000000`000de070 00000000`76f914f2 kernel32!BaseDllReadWriteIniFile+0xe9
04 00000000`000de250 00000000`76f9165d kernel32!GetPrivateProfileStringA+0x62
05 00000000`000de2b0 000007fe`f3392280 kernel32!GetPrivateProfileIntA+0x3d
06 00000000`000de410 000007fe`fb415504 MsftEdit!CreateTextServices+0x2f1
07 00000000`000de4a0 000007fe`fb00a61f explorerframe!CSearchEditBox::OnHosted+0xf2
08 00000000`000de510 000007fe`fb007adb DUI70!DirectUI::Element::OnHosted+0xb5
09 00000000`000de560 000007fe`fb0036da DUI70!DirectUI::Element::OnPropertyChanged+0xa1e
0a 00000000`000de5f0 000007fe`fb009c05 DUI70!DirectUI::Element::_PostSourceChange+0x27a
0b 00000000`000de650 000007fe`fb009a84 DUI70!DirectUI::Element::Insert+0x42c
0c 00000000`000de6e0 000007fe`fb00a80b DUI70!DirectUI::Element::Add+0x6c
0d 00000000`000de710 000007fe`fb00a8a8 DUI70!DirectUI::DUIParsePlayer::_AddArgs+0x4b
0e 00000000`000de760 000007fe`fb00a765 DUI70!DirectUI::DUIParsePlayer::CreateElement+0x227
0f 00000000`000de7e0 000007fe`fb415a59 DUI70!DirectUI::DUIXmlParser::CreateElement+0x1b3
10 00000000`000de850 000007fe`fb415931 explorerframe!DUI_CreateElementFromResource+0x65
11 00000000`000de8a0 000007fe`fb415c29 explorerframe!CSearchBoxDUIHost::Create+0xc1
12 00000000`000de8f0 000007fe`fb437a0e explorerframe!CSearchBox::Initialize+0x1c3
13 00000000`000de9d0 000007fe`fb4200af explorerframe!CUniversalSearchBand::_Initialize+0x15e
14 00000000`000dea90 000007fe`fd3aae99 explorerframe!CUniversalSearchBand::SetSite+0x67
15 00000000`000deac0 000007fe`fb417144 SHLWAPI!IUnknown_SetSite+0x55
16 00000000`000deb10 000007fe`fb417209 explorerframe!CBandSite::_AddBandByID+0xb2
17 00000000`000deb40 000007fe`fb4372f6 explorerframe!CBandSite::AddBand+0x19
18 00000000`000deb70 000007fe`fb43681a explorerframe!CNavBar::_CreateBands+0x21a
19 00000000`000dec40 000007fe`fb436672 explorerframe!CNavBar::_CreateBar+0x149
1a 00000000`000ded80 000007fe`feb05e84 explorerframe!CNavBar::ShowDW+0x1e
1b 00000000`000dedb0 000007fe`feb05503 COMDLG32!CFileOpenSave::_CreateNavigationBar+0xcc
1c 00000000`000dedf0 000007fe`feb056a2 COMDLG32!CFileOpenSave::_InitOpenSaveDialog+0x8f4
1d 00000000`000df120 00000000`76e35f0f COMDLG32!CFileOpenSave::s_OpenSaveDlgProc+0x12b
1e 00000000`000df410 00000000`76e3760e USER32!UserCallDlgProcCheckWow+0x15f
1f 00000000`000df4d0 00000000`76e3753e USER32!DefDlgProcWorker+0xf1
20 00000000`000df550 00000000`76e29ac1 USER32!DefDlgProcW+0x36

打开反汇编窗口，可以看到syscall，这是调用内核函数，用户态调试无法跟踪到。

也可以通过条件断点察看notepad调用readfile的情况：
0:001> bp ntdll!ZwReadFile ".echo***hello readfile is being invoked***;k;gc"
0:001> g
***hello readfile is being invoked***
# Child-SP RetAddr Call Site
00 00000000`02c3f5b8 000007fe`fcaf8976 ntdll!ZwReadFile
01 00000000`02c3f5c0 00000000`76f20599 KERNELBASE!ReadFile+0x112
02 00000000`02c3f640 000007fe`f5bfa671 kernel32!ReadFileImplementation+0x55
03 00000000`02c3f680 000007fe`f5f84ee1 DtFrame64!EATUninstallRaw+0x18df1
04 00000000`02c3f720 000007fe`f5f85278 winhadnt64!TSetLogConfig+0x65001
05 00000000`02c3f7a0 000007fe`f5f85f07 winhadnt64!TSetLogConfig+0x65398
06 00000000`02c3f800 000007fe`f5e95c94 winhadnt64!TSetLogConfig+0x66027
07 00000000`02c3f8d0 000007fe`f5f10380 winhadnt64!INJUninstallDetours+0x71104
08 00000000`02c3f9c0 00000000`76f2556d winhadnt64!DelPassthru+0x1e70
09 00000000`02c3fb20 00000000`7708372d kernel32!BaseThreadInitThunk+0xd
0a 00000000`02c3fb50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
***hello readfile is being invoked***
# Child-SP RetAddr Call Site
00 00000000`02c3f618 000007fe`fcaf8976 ntdll!ZwReadFile
01 00000000`02c3f620 00000000`76f20599 KERNELBASE!ReadFile+0x112
02 00000000`02c3f6a0 000007fe`f5bfa671 kernel32!ReadFileImplementation+0x55
03 00000000`02c3f6e0 000007fe`f5f84ee1 DtFrame64!EATUninstallRaw+0x18df1
04 00000000`02c3f780 000007fe`f5f85fb2 winhadnt64!TSetLogConfig+0x65001
05 00000000`02c3f800 000007fe`f5e95c94 winhadnt64!TSetLogConfig+0x660d2
06 00000000`02c3f8d0 000007fe`f5f10380 winhadnt64!INJUninstallDetours+0x71104
07 00000000`02c3f9c0 00000000`76f2556d winhadnt64!DelPassthru+0x1e70
08 00000000`02c3fb20 00000000`7708372d kernel32!BaseThreadInitThunk+0xd
09 00000000`02c3fb50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
***hello readfile is being invoked***
# Child-SP RetAddr Call Site
00 00000000`02c3f5e8 000007fe`fcaf8976 ntdll!ZwReadFile
01 00000000`02c3f5f0 00000000`76f20599 KERNELBASE!ReadFile+0x112
02 00000000`02c3f670 000007fe`f5bfa671 kernel32!ReadFileImplementation+0x55
03 00000000`02c3f6b0 000007fe`f5f84ee1 DtFrame64!EATUninstallRaw+0x18df1
04 00000000`02c3f750 000007fe`f5f86352 winhadnt64!TSetLogConfig+0x65001
05 00000000`02c3f7d0 000007fe`f5f80de0 winhadnt64!TSetLogConfig+0x66472
06 00000000`02c3f800 000007fe`f5f80ce1 winhadnt64!TSetLogConfig+0x60f00
07 00000000`02c3f890 000007fe`f5e95d16 winhadnt64!TSetLogConfig+0x60e01
08 00000000`02c3f8d0 000007fe`f5f10380 winhadnt64!INJUninstallDetours+0x71186
09 00000000`02c3f9c0 00000000`76f2556d winhadnt64!DelPassthru+0x1e70
0a 00000000`02c3fb20 00000000`7708372d kernel32!BaseThreadInitThunk+0xd
0b 00000000`02c3fb50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
***hello readfile is being invoked***
# Child-SP RetAddr Call Site
00 00000000`02c3f668 000007fe`fcaf8976 ntdll!ZwReadFile
01 00000000`02c3f670 00000000`76f20599 KERNELBASE!ReadFile+0x112
02 00000000`02c3f6f0 000007fe`f5bfa671 kernel32!ReadFileImplementation+0x55
03 00000000`02c3f730 000007fe`f5f84ee1 DtFrame64!EATUninstallRaw+0x18df1
04 00000000`02c3f7d0 000007fe`f5f85e61 winhadnt64!TSetLogConfig+0x65001
05 00000000`02c3f850 000007fe`f5f816d5 winhadnt64!TSetLogConfig+0x65f81
06 00000000`02c3f8c0 000007fe`f5f24f61 winhadnt64!TSetLogConfig+0x617f5
07 00000000`02c3f8f0 000007fe`f5f1038c winhadnt64!TSetLogConfig+0x5081
08 00000000`02c3f9c0 00000000`76f2556d winhadnt64!DelPassthru+0x1e7c
09 00000000`02c3fb20 00000000`7708372d kernel32!BaseThreadInitThunk+0xd
0a 00000000`02c3fb50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

重启动notepad还可以观察到一些调试事件：
.restart /f
0:000> k
# Child-SP RetAddr Call Site
00 00000000`001ff1b0 00000000`77064701 ntdll!LdrpDoDebuggerBreak+0x30
01 00000000`001ff1f0 00000000`770c96e0 ntdll!LdrpInitializeProcess+0x1b51
02 00000000`001ff6e0 00000000`7707373e ntdll! ?? ::FNODOBFM::`string'+0x22770
03 00000000`001ff750 00000000`00000000 ntdll!LdrInitializeThunk+0xe
会进入早期的端点：LdrpInitializeProcess 这是在程序的初始化阶段
0:000> sxe ld
意思是加载模块时通知调试器，g看看效果
0:000> g
ModLoad: 000007fe`fdad0000 000007fe`fdafe000 C:\Windows\system32\IMM32.DLL
ntdll!ZwMapViewOfSection+0xa:
00000000`77099a2a c3 ret
0:000> g
ModLoad: 000007fe`fcdb0000 000007fe`fcebb000 C:\Windows\system32\MSCTF.dll
ntdll!ZwMapViewOfSection+0xa:
00000000`77099a2a c3 ret
0:000> g
ModLoad: 000007fe`f5e10000 000007fe`f62bf000 C:\Windows\system32\winhadnt64.dll
ntdll!ZwMapViewOfSection+0xa:
00000000`77099a2a c3 ret
0:000> g
ModLoad: 000007fe`f5df0000 000007fe`f5e08000 C:\Windows\system32\MPR.dll
ntdll!ZwMapViewOfSection+0xa:
00000000`77099a2a c3 ret
0:000> g
ModLoad: 000007fe`fd350000 000007fe`fd39d000 C:\Windows\system32\WS2_32.dll
ntdll!ZwMapViewOfSection+0xa:
00000000`77099a2a c3 ret
每次加载模块都通知调试器，g了十几次，说明我的机器上加载的无用模块很多，有些不知道名字。
通过学习事件通知机制，说明windows内核对调试的很给力的支持.windows对调试支持很友好。