①0环异常
text:00422CAB cmp ds:_KdDebuggerEnabled, 0 ; 查看当前内核调试器是否存在
.text:00422CB2 jz short loc_422CD1
.text:00422CB4
.text:00422CB4 loc_422CB4: ; CODE XREF: KiDispatchException(x,x,x,x,x)+4C↑j
.text:00422CB4 mov [ebp+Context.ContextFlags], 1001Fh
.text:00422CBE cmp ds:_KeI386XMMIPresent, 0
.text:00422CC5 jz short loc_422CD1
.text:00422CC7 mov [ebp+Context.ContextFlags], 1003Fh
.text:00422CD1
.text:00422CD1 loc_422CD1: ; CODE XREF: KiDispatchException(x,x,x,x,x)+55↑j
.text:00422CD1 ; KiDispatchException(x,x,x,x,x)+68↑j
.text:00422CD1 lea eax, [ebp+Context]
.text:00422CD7 push eax
.text:00422CD8 push ecx
.text:00422CD9 push ebx
.text:00422CDA call _KeContextFromKframes@12 ; 把当前的Trap_Frame保存到Context准备为返回三环做准备;
.text:00422CDF mov eax, [esi]
.text:00422CE1 cmp eax, 80000003h
.text:00422CE6 jnz loc_441136
.text:00422CEC dec [ebp+Context._Eip]
.text:00422CF2
.text:00422CF2 loc_422CF2: ; CODE XREF: KiDispatchException(x,x,x,x,x)+1E4DE↓j
.text:00422CF2 ; KiDispatchException(x,x,x,x,x)+1E4EE↓j ...
.text:00422CF2 xor edi, edi
.text:00422CF4
.text:00422CF4 loc_422CF4: ; CODE XREF: KiDispatchException(x,x,x,x,x)+2846C↓j
.text:00422CF4 cmp byte ptr [ebp+PreviousMode], 0 ; 判断是三环异常还是零环异常
.text:00422CF8 jnz loc_440FC6 ; 跳转处理三环异常
.text:00422CFE cmp [ebp+FirstChanel], 1
.text:00422D02 jnz loc_44B0D6 ; RtlDispatchException没有处理异常
.text:00422D08 mov eax, ds:_KiDebugRoutine
.text:00422D0D cmp eax, edi
.text:00422D0F jz loc_4335B6 ; 没有内核调试器,则调用RtlDispatchException处理异常
.text:00422D15 push edi
.text:00422D16 push edi
.text:00422D17 lea ecx, [ebp+Context]
.text:00422D1D push ecx
.text:00422D1E push esi
.text:00422D1F push [ebp+var_2F0]
.text:00422D25 push ebx
.text:00422D26 call eax ; _KiDebugRoutine
.text:00422D28 test al, al ; 有内核调试器,但是内核调试器不处理,调用RtlDispatchException处理异常
.text:00422D2A jz loc_4335B6
.text:004335B6 lea eax, [ebp+Context]
.text:004335BC push eax ; Context
.text:004335BD push esi ; ExceptionRecord
.text:004335BE call _RtlDispatchException@8 ; RtlDispatchException(x,x)
.text:004335C3 jmp loc_44B0CE
.text:0044B1D8 ; KiDispatchException(x,x,x,x,x)+2849C↑j ...
.text:0044B1D8 push edi ; BugCheckParameter4
.text:0044B1D9 push ebx ; BugCheckParameter3
.text:0044B1DA push dword ptr [esi+0Ch] ; BugCheckParameter2
.text:0044B1DD push dword ptr [esi] ; BugCheckParameter1
.text:0044B1DF push 8Eh ; BugCheckCode
.text:0044B1E4 call _KeBugCheckEx@20
②三环异常
.text:0044100E ; KiDispatchException(x,x,x,x,x)+1E379↑j
.text:0044100E push edi
.text:0044100F push 1
.text:00441011 push esi
.text:00441012 call _DbgkForwardException@12 ; 调用三环调试器,三环调试器不处理则准备返回三环
.text:00441103 sbb eax, eax
.text:00441105 and eax, 3
.text:00441108 add eax, 38h
.text:0044110B mov [ebx+_KTRAP_FRAME.SegFs], eax
.text:0044110E and [ebx+_KTRAP_FRAME.SegGs], 0
.text:00441112 mov eax, ds:_KeUserExceptionDispatcher
.text:00441117 mov [ebx+_KTRAP_FRAME._Eip], eax ; 修改Trap_Frame的EIP等于KiUserExceptionDispatcher,准备返回三环
.text:7C92E45C ; __stdcall KiUserExceptionDispatcher(x, x)
.text:7C92E45C public _KiUserExceptionDispatcher@8
.text:7C92E45C _KiUserExceptionDispatcher@8 proc near ; DATA XREF: .text:off_7C923428↑o
.text:7C92E45C
.text:7C92E45C var_C = dword ptr -0Ch
.text:7C92E45C var_8 = dword ptr -8
.text:7C92E45C var_4 = dword ptr -4
.text:7C92E45C arg_0 = dword ptr 4
.text:7C92E45C
.text:7C92E45C mov ecx, [esp+arg_0]
.text:7C92E460 mov ebx, [esp+0]
.text:7C92E463 push ecx
.text:7C92E464 push ebx
.text:7C92E465 call _RtlDispatchException@8 ; RtlDispatchException(x,x)
.text:7C92E46A or al, al
.text:7C92E46C jz short loc_7C92E47A ; 没有处理异常,进入二次分发
.text:7C92E46E pop ebx
.text:7C92E46F pop ecx
.text:7C92E470 push 0
.text:7C92E472 push ecx
.text:7C92E473 call _ZwContinue@8 ; 如果处理了异常,则调用ZwContinue进入0环之后,再次修改
.text:7C92E473 ; Trap_Frame为CONTEXT的值,返回到原来发生异常的地方
.text:7C92E478 jmp short loc_7C92E485
.text:7C92E47A ; ---------------------------------------------------------------------------
.text:7C92E47A
.text:7C92E47A loc_7C92E47A: ; CODE XREF: KiUserExceptionDispatcher(x,x)+10↑j
.text:7C92E47A pop ebx
.text:7C92E47B pop ecx
.text:7C92E47C push 0
.text:7C92E47E push ecx
.text:7C92E47F push ebx
.text:7C92E480 call _ZwRaiseException@12 ; 二次分发异常
.text:7C92E485