Crash Dump分析笔记

最新推荐文章于 2023-11-21 21:55:45 发布

iiprogram

最新推荐文章于 2023-11-21 21:55:45 发布

阅读量1.8k

点赞数

分类专栏： windows底层核心編程病毒汇编和调试逆向技术加脱壳文章标签： crash c exception hook 测试 blog

本文链接：https://blog.csdn.net/iiprogram/article/details/2915253

版权

本文详细记录了对Crash Dump的分析过程，涵盖了C语言异常处理、内存hook技术及其在测试中的应用。通过实例探讨如何从dump文件中提取关键信息，帮助定位和解决问题。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

作者: softworm
时间: 2008-08-29,20:19
链接: http://bbs.pediy.com/showthread.php?t=71643

Crash Dump分析笔记

我自己的隐藏OD插件,带驱动,在跑ExeCryptor时偶尔BSOD。驱动挂了2个中断,分别是Int0D,用来对抗rdtsc,从
deroko的fakerRdtsc改的,另外1个是Int0E,抄的OllyBonE。

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: f7737d70

最低0.47元/天解锁文章