应用死锁的分析

最新推荐文章于 2022-11-21 08:12:54 发布

mergerly

最新推荐文章于 2022-11-21 08:12:54 发布

阅读量7.6k

点赞数 2

分类专栏：逆向调试

本文链接：https://blog.csdn.net/mergerly/article/details/18983937

版权

逆向调试专栏收录该内容

48 篇文章 20 订阅

订阅专栏

一款软件嘟嘟启动时无法启动，卡死在某个地方，界面显示不出来，于是分析了一番。

启动利器Windbg，Attach到目标进程dudu_d.exe。

首先显示一下所有堆栈

0:007> ~*kb

   0  Id: d2c.1abc Suspend: 1 Teb: 7efdd000 Unfrozen
ChildEBP RetAddr  Args to Child              
0018e630 77698e44 000000f4 00000000 00000000 ntdll!NtWaitForSingleObject+0x15
0018e694 77698d28 00000000 00000000 7768faa4 ntdll!RtlpWaitOnCriticalSection+0x13e
0018e6bc 7768fff3 777620c0 77e0f74b 00000001 ntdll!RtlEnterCriticalSection+0x150
0018e82c 7768fd4f 00000001 00000001 00000000 ntdll!LdrGetDllHandleEx+0x2f7
0018e848 77121a35 00000001 00000000 0018e8b8 ntdll!LdrGetDllHandle+0x18
0018e89c 77121c49 0018e8b8 7dfd51df 00000000 KERNELBASE!GetModuleHandleForUnicodeString+0x22
0018ed14 77121d44 00000001 00000002 76435f90 KERNELBASE!BasepGetModuleHandleExW+0x181
0018ed2c 76435f25 76435f90 00000000 76538bd4 KERNELBASE!GetModuleHandleW+0x29
0018ed44 76435b87 764355e0 76538bf0 00000000 ole32!GetRegCatalogObject+0x25 [d:\w7rtm\com\ole32\com\catalog\regcat.cxx @ 66]
0018ed68 76435d77 01000000 0018ed90 76435cff ole32!CComCatalog::InitializeCatalogIfNeccessary+0x43 [d:\w7rtm\com\ole32\com\catalog\catalog.cxx @ 305]
0018ed74 76435cff 7643556c 0018ed8c 0018ef7c ole32!GetCatalogHelper+0x12 [d:\w7rtm\com\ole32\com\catalog\catalog.cxx @ 160]
0018ed90 7643ab70 0018ef30 00000000 0018eddc ole32!InitializeCatalogIfNecessary+0x32 [d:\w7rtm\com\ole32\common\catinit.cxx @ 45]
0018eda0 7640223b 0018ef7c 0018edc8 00000100 ole32!LookForConfiguredClsid+0x43 [d:\w7rtm\com\ole32\com\objact\objact.cxx @ 1032]
*** WARNING: Unable to verify checksum for D:\IM\dudu_d.exe
0018eddc 013576fd 0018ef7c 039c2210 00000004 ole32!CoRegisterClassObject+0x5c [d:\w7rtm\com\ole32\com\objact\sobjact.cxx @ 289]
0018ef74 00b0206d 87fb1290 4ecb800f 0c74a89c dudu_d!CFactory::StartFactories+0xfd [d:\im\trunk_dev_v3.0_20131218\client\imservice\cfactory.cpp @ 214]
0018f2ec 00b019ad 7d1e0ed0 0018fdb4 0018fac8 dudu_d!CIMApp::InitInstanceAppData+0x2bd [d:\im\trunk_dev_v3.0_20131218\client\im\im.cpp @ 433]
0018fabc 00b013e2 00000000 0018fe94 00000000 dudu_d!CIMApp::ContinueInitInstance+0x54d [d:\im\trunk_dev_v3.0_20131218\client\im\im.cpp @ 342]
0018fdb4 00b00ecb 00000000 00000000 7efde000 dudu_d!CIMApp::InitInstanceCheckUpdate+0x62 [d:\im\trunk_dev_v3.0_20131218\client\im\im.cpp @ 234]
0018fe94 78374592 cccccccc cccccccc cccccccc dudu_d!CIMApp::InitInstance+0x3b [d:\im\trunk_dev_v3.0_20131218\client\im\im.cpp @ 129]
0018feb8 017ae0d8 00400000 00000000 01b62b02 MFC80UD!AfxWinMain+0x82 [f:\rtm\vctools\vc7libs\ship\atlmfc\src\mfc\winmain.cpp @ 37]

   1  Id: d2c.1dc0 Suspend: 1 Teb: 7efda000 Unfrozen
ChildEBP RetAddr  Args to Child              
03dcfdb0 7712149d 000000d4 00000000 00000000 ntdll!NtWaitForSingleObject+0x15
03dcfe1c 76bf1194 000000d4 ffffffff 00000000 KERNELBASE!WaitForSingleObjectEx+0x98
03dcfe34 76bf1148 000000d4 ffffffff 00000000 kernel32!WaitForSingleObjectExImplementation+0x75
03dcfe48 00ddadff 000000d4 ffffffff 00000000 kernel32!WaitForSingleObject+0x12
03dcff40 102047c1 019c8e98 7edd8dac 00000000 dudu_d!CTrayPos::TrackMousePt+0x3f [d:\im\trunk_dev_v3.0_20131218\client\im\traypos.cpp @ 47]
03dcff7c 10204767 01d5cb80 03dcff94 76bf336a MSVCR80D!_callthreadstartex+0x51 [f:\rtm\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
03dcff88 76bf336a 01d5cb80 03dcffd4 77699f72 MSVCR80D!_threadstartex+0x87 [f:\rtm\vctools\crt_bld\self_x86\crt\src\threadex.c @ 331]
03dcff94 77699f72 01d5f7b8 7424e0b3 00000000 kernel32!BaseThreadInitThunk+0xe
03dcffd4 77699f45 102046e0 01d5f7b8 00000000 ntdll!__RtlUserThreadStart+0x70
03dcffec 00000000 102046e0 01d5f7b8 00000000 ntdll!_RtlUserThreadStart+0x1b

   2  Id: d2c.2168 Suspend: 1 Teb: 7efd7000 Unfrozen
ChildEBP RetAddr  Args to Child              
03ecfca0 7712149d 000000e0 00000000 00000000 ntdll!NtWaitForSingleObject+0x15
03ecfd0c 76bf1194 000000e0 ffffffff 00000000 KERNELBASE!WaitForSingleObjectEx+0x98
03ecfd24 76bf1148 000000e0 ffffffff 00000000 kernel32!WaitForSingleObjectExImplementation+0x75
03ecfd38 01633b97 000000e0 ffffffff 03ecff48 kernel32!WaitForSingleObject+0x12
03ecfe20 01634b71 00000000 00000000 01ced0f0 dudu_d!CTempFileUploadManager::ThreadWait+0x37 [d:\im\trunk_dev_v3.0_20131218\client\imlib\tempfileuploadmanager.cpp @ 389]
03ecff48 74db29bb 01d5ca20 7eed8b87 00000000 dudu_d!CTempFileUploadManager::UploadFile_Thread+0x41 [d:\im\trunk_dev_v3.0_20131218\client\imlib\tempfileuploadmanager.cpp @ 615]
03ecff80 74db2a47 00000000 76bf336a 01ced0f0 MSVCR80!_callthreadstartex+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
03ecff88 76bf336a 01ced0f0 03ecffd4 77699f72 MSVCR80!_threadstartex+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
03ecff94 77699f72 01ced0f0 7414e0b3 00000000 kernel32!BaseThreadInitThunk+0xe
03ecffd4 77699f45 74db29e1 01ced0f0 00000000 ntdll!__RtlUserThreadStart+0x70
03ecffec 00000000 74db29e1 01ced0f0 00000000 ntdll!_RtlUserThreadStart+0x1b

   3  Id: d2c.1ad0 Suspend: 1 Teb: 7ef9f000 Unfrozen
ChildEBP RetAddr  Args to Child              
03fcfc94 7712149d 000000ec 00000000 00000000 ntdll!NtWaitForSingleObject+0x15
03fcfd00 76bf1194 000000ec ffffffff 00000000 KERNELBASE!WaitForSingleObjectEx+0x98
03fcfd18 76bf1148 000000ec ffffffff 00000000 kernel32!WaitForSingleObjectExImplementation+0x75
03fcfd2c 01639db7 000000ec ffffffff 03fcff48 kernel32!WaitForSingleObject+0x12
03fcfe14 0163acd1 00000000 00000000 01ced310 dudu_d!CTempFileDownloadManager::ThreadWait+0x37 [d:\im\trunk_dev_v3.0_20131218\client\imlib\tempfiledownloadmanager.cpp @ 391]
03fcff48 74db29bb 01d5cdf8 7efd8b87 00000000 dudu_d!CTempFileDownloadManager::DownLoadFile_Thread+0x41 [d:\im\trunk_dev_v3.0_20131218\client\imlib\tempfiledownloadmanager.cpp @ 626]
03fcff80 74db2a47 00000000 76bf336a 01ced310 MSVCR80!_callthreadstartex+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
03fcff88 76bf336a 01ced310 03fcffd4 77699f72 MSVCR80!_threadstartex+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
03fcff94 77699f72 01ced310 7404e0b3 00000000 kernel32!BaseThreadInitThunk+0xe
03fcffd4 77699f45 74db29e1 01ced310 00000000 ntdll!__RtlUserThreadStart+0x70
03fcffec 00000000 74db29e1 01ced310 00000000 ntdll!_RtlUserThreadStart+0x1b

   4  Id: d2c.824 Suspend: 1 Teb: 7ef9c000 Unfrozen
ChildEBP RetAddr  Args to Child              
046dfdd0 771215e9 00000002 046dfe20 00000001 ntdll!ZwWaitForMultipleObjects+0x15
046dfe6c 76bf19fc 046dfe20 046dfe94 00000000 KERNELBASE!WaitForMultipleObjectsEx+0x100
046dfeb4 7718086a 00000002 7efde000 00000000 kernel32!WaitForMultipleObjectsExImplementation+0xe0
046dff08 77180b69 00000174 046dff68 ffffffff USER32!RealMsgWaitForMultipleObjectsEx+0x14d
046dff24 706a795b 00000001 046dff68 00000000 USER32!MsgWaitForMultipleObjects+0x1f
046dff70 706a787a 00000000 00000000 00000000 gdiplus!BackgroundThreadProc+0x59
046dff88 76bf336a 04792c98 046dffd4 77699f72 gdiplus!DllRefCountSafeThreadThunk+0x10
046dff94 77699f72 04792c98 7395e0b3 00000000 kernel32!BaseThreadInitThunk+0xe
046dffd4 77699f45 706a786a 04792c98 00000000 ntdll!__RtlUserThreadStart+0x70
046dffec 00000000 706a786a 04792c98 00000000 ntdll!_RtlUserThreadStart+0x1b

   5  Id: d2c.150c Suspend: 1 Teb: 7ef99000 Unfrozen
ChildEBP RetAddr  Args to Child              
0704fc78 7712149d 000001dc 00000000 00000000 ntdll!NtWaitForSingleObject+0x15
0704fce4 76bf1194 000001dc ffffffff 00000000 KERNELBASE!WaitForSingleObjectEx+0x98
0704fcfc 76bf1148 000001dc ffffffff 00000000 kernel32!WaitForSingleObjectExImplementation+0x75
0704fd10 01628254 000001dc ffffffff 0704ff48 kernel32!WaitForSingleObject+0x12
0704fdf8 01628323 00000000 00000000 03bffd98 dudu_d!CBBNetWorkIOManager::ThreadWait+0x34 [d:\im\trunk_dev_v3.0_20131218\client\imlib\bbnetworkiomanager.cpp @ 235]
0704ff48 74db29bb 039c7810 7a058b87 00000000 dudu_d!CBBNetWorkIOManager::CheckSocket_Thread+0x33 [d:\im\trunk_dev_v3.0_20131218\client\imlib\bbnetworkiomanager.cpp @ 255]
0704ff80 74db2a47 00000000 76bf336a 03bffd98 MSVCR80!_callthreadstartex+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0704ff88 76bf336a 03bffd98 0704ffd4 77699f72 MSVCR80!_threadstartex+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0704ff94 77699f72 03bffd98 70fce0b3 00000000 kernel32!BaseThreadInitThunk+0xe
0704ffd4 77699f45 74db29e1 03bffd98 00000000 ntdll!__RtlUserThreadStart+0x70
0704ffec 00000000 74db29e1 03bffd98 00000000 ntdll!_RtlUserThreadStart+0x1b

   6  Id: d2c.1b60 Suspend: 1 Teb: 7ef96000 Unfrozen
ChildEBP RetAddr  Args to Child              
0742f02c 77698e44 0000021c 00000000 00000000 ntdll!NtWaitForSingleObject+0x15
0742f090 77698d28 00000000 00000000 76538bd4 ntdll!RtlpWaitOnCriticalSection+0x13e
0742f0b8 76435b6a 76536814 00000000 0743c39c ntdll!RtlEnterCriticalSection+0x150
0742f0d0 76435d77 76439af4 0742f0f8 76435cff ole32!CComCatalog::InitializeCatalogIfNeccessary+0x26 [d:\w7rtm\com\ole32\com\catalog\catalog.cxx @ 297]
0742f0dc 76435cff 7643556c 0742f0f4 00000000 ole32!GetCatalogHelper+0x12 [d:\w7rtm\com\ole32\com\catalog\catalog.cxx @ 160]
0742f0f8 764150b3 0743e728 0742f348 00000000 ole32!InitializeCatalogIfNecessary+0x32 [d:\w7rtm\com\ole32\common\catinit.cxx @ 45]
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNsp.dll - 
0742f11c 07433f3e 0743c39c 0742f338 0743e728 ole32!CLSIDFromProgID+0x8c [d:\w7rtm\com\ole32\com\class\compapi.cxx @ 700]
WARNING: Stack unwind information not available. Following frames may be wrong.
0742f348 07438ae9 0743c39c 0743e728 0743e728 SangforNsp!DllUnregisterServer+0x26e5
0742f514 07439385 07430000 00000000 00000000 SangforNsp!SetInnerDnsIPAndSuffix+0x1e2
0742f534 776999a0 07430000 00000001 00000000 SangforNsp!SetInnerDnsIPAndSuffix+0xa7e
0742f554 7769d939 07439335 07430000 00000001 ntdll!LdrpCallInitRoutine+0x14
0742f648 7769d7fc 00000000 70bae8d3 00000000 ntdll!LdrpRunInitializeRoutines+0x26f
0742f7b4 7769c558 0742f818 0742f7e0 00000000 ntdll!LdrpLoadDll+0x4d1
0742f7ec 77122c95 0742f7e0 0742f830 0742f818 ntdll!LdrLoadDll+0xaa
0742f828 75339b85 00000000 00000000 01bc64f4 KERNELBASE!LoadLibraryExW+0x1f1
0742fa7c 75339cb6 03ac8628 03ac8618 0000000c WS2_32!NSPROVIDER::Initialize+0x5b
0742faa0 75339d2e 03ac85f0 7a4389d3 03ac0868 WS2_32!NSCATALOG::LoadProvider+0x4d
0742fad4 7533473a 0742fb1c 03aca448 03aca448 WS2_32!LookupBeginEnumerationProc+0x8d
0742faf0 753358b4 75335c51 0742fb1c 03aca448 WS2_32!NSCATALOG::EnumerateCatalogItems+0x25
0742fb4c 753357cc 03aca448 03aca3c8 00000210 WS2_32!NSQUERY::LookupServiceBegin+0xdd

#  7  Id: d2c.2008 Suspend: 1 Teb: 7ef93000 Unfrozen
ChildEBP RetAddr  Args to Child              
0769ff58 776ff926 7091e0ef 00000000 00000000 ntdll!DbgBreakPoint
0769ff88 76bf336a 00000000 0769ffd4 77699f72 ntdll!DbgUiRemoteBreakin+0x3c
0769ff94 77699f72 00000000 7091e0b3 00000000 kernel32!BaseThreadInitThunk+0xe
0769ffd4 77699f45 776ff8ea 00000000 00000000 ntdll!__RtlUserThreadStart+0x70
0769ffec 00000000 776ff8ea 00000000 00000000 ntdll!_RtlUserThreadStart+0x1b

看到0号线程和6号线程都卡在函数RtlEnterCriticalSection上面，估计是死锁了，显示当前所有的锁

0:000> !locks

CritSec ntdll!LdrpLoaderLock+0 at 777620c0
WaiterWoken        No
LockCount          1
RecursionCount     1
OwningThread       1b60
EntryCount         0
ContentionCount    3
*** Locked

CritSec ole32!g_catLock+0 at 76536814
WaiterWoken        No
LockCount          1
RecursionCount     1
OwningThread       1abc
EntryCount         0
ContentionCount    1
*** Locked

CritSec +3ac0880 at 03ac0880
WaiterWoken        No
LockCount          0
RecursionCount     2
OwningThread       1b60
EntryCount         0
ContentionCount    0
*** Locked

Scanned 564 critical sections

0号线程ntdll!RtlEnterCriticalSection的第一个参数777620c0就是锁，在锁中正好对应第一个锁，查看当前锁所在的线程OwningThread是1b60，这个线程是6号线程。

而6号线程ntdll!RtlEnterCriticalSection的第一个参数76536814在锁中对应第二个锁，查看当前锁所在的线程OwningThread是1abc，这个线程是0号线程。典型的临界区死锁啊。分析一下原因，0号线程是主界面UI线程，原因只能出在6号线程了。看一下6号线程干了什么。

0:006> kb
ChildEBP RetAddr  Args to Child              
0742f02c 77698e44 0000021c 00000000 00000000 ntdll!NtWaitForSingleObject+0x15
0742f090 77698d28 00000000 00000000 76538bd4 ntdll!RtlpWaitOnCriticalSection+0x13e
0742f0b8 76435b6a 76536814 00000000 0743c39c ntdll!RtlEnterCriticalSection+0x150
0742f0d0 76435d77 76439af4 0742f0f8 76435cff ole32!CComCatalog::InitializeCatalogIfNeccessary+0x26 [d:\w7rtm\com\ole32\com\catalog\catalog.cxx @ 297]
0742f0dc 76435cff 7643556c 0742f0f4 00000000 ole32!GetCatalogHelper+0x12 [d:\w7rtm\com\ole32\com\catalog\catalog.cxx @ 160]
0742f0f8 764150b3 0743e728 0742f348 00000000 ole32!InitializeCatalogIfNecessary+0x32 [d:\w7rtm\com\ole32\common\catinit.cxx @ 45]
0742f11c 07433f3e 0743c39c 0742f338 0743e728 ole32!CLSIDFromProgID+0x8c [d:\w7rtm\com\ole32\com\class\compapi.cxx @ 700]
WARNING: Stack unwind information not available. Following frames may be wrong.
0742f348 07438ae9 0743c39c 0743e728 0743e728 SangforNsp!DllUnregisterServer+0x26e5
0742f514 07439385 07430000 00000000 00000000 SangforNsp!SetInnerDnsIPAndSuffix+0x1e2
0742f534 776999a0 07430000 00000001 00000000 SangforNsp!SetInnerDnsIPAndSuffix+0xa7e
0742f554 7769d939 07439335 07430000 00000001 ntdll!LdrpCallInitRoutine+0x14
0742f648 7769d7fc 00000000 70bae8d3 00000000 ntdll!LdrpRunInitializeRoutines+0x26f
0742f7b4 7769c558 0742f818 0742f7e0 00000000 ntdll!LdrpLoadDll+0x4d1
0742f7ec 77122c95 0742f7e0 0742f830 0742f818 ntdll!LdrLoadDll+0xaa
0742f828 75339b85 00000000 00000000 01bc64f4 KERNELBASE!LoadLibraryExW+0x1f1
0742fa7c 75339cb6 03ac8628 03ac8618 0000000c WS2_32!NSPROVIDER::Initialize+0x5b
0742faa0 75339d2e 03ac85f0 7a4389d3 03ac0868 WS2_32!NSCATALOG::LoadProvider+0x4d
0742fad4 7533473a 0742fb1c 03aca448 03aca448 WS2_32!LookupBeginEnumerationProc+0x8d
0742faf0 753358b4 75335c51 0742fb1c 03aca448 WS2_32!NSCATALOG::EnumerateCatalogItems+0x25
0742fb4c 753357cc 03aca448 03aca3c8 00000210 WS2_32!NSQUERY::LookupServiceBegin+0xdd

有个DLL是SangforNsp，非常可疑，看一下这个是什么DLL。

0:006> lmvm SangforNsp
start    end        module name
07430000 07595000   SangforNsp   (export symbols)       C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNsp.dll
    Loaded symbol image file: C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNsp.dll
    Image path: C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNsp.dll
    Image name: SangforNsp.dll
    Timestamp:        Fri Dec 09 10:04:03 2011 (4EE16C93)
    CheckSum:         00171DBC
    ImageSize:        00165000
    File version:     5.3.1.0
    Product version:  5.3.1.0
    File flags:       20 (Mask 3F) Special
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Sangfor
    ProductName:      SangforNsp Module
    InternalName:     SangforNsp
    OriginalFilename: SangforNsp.DLL
    ProductVersion:   5, 3, 1, 0
    FileVersion:      5, 3, 1, 0
    PrivateBuild:     5, 3, 1, 0
    SpecialBuild:     20100527
    FileDescription:  SangforNsp Module
    LegalCopyright:   Copyright 2009
    LegalTrademarks:  Copyright 2009
    Comments:         SSL Client DNS

看文件属于深信服的VPN的DLL，这就是软件冲突了。卸载深信服的软件就好了。