dump文件分析笔记

首先蓝屏时候，会发生文件转储，先开启蓝屏文件转储。

 

一般内核开发，选核心内存转储即可，下面就是生成文件的位置，为了学习把自动重新启动点掉，不然蓝屏后系统会自动重启。

下面写个蓝屏驱动让其发生BAD_POOL_CALLER(如果造成蓝屏的驱动是随系统启动而启动，会反复重启，则可以通过安全模式进入系统去拿dump文件)

dump文件在之前设置的目录中，一般不修改位置就在window目录里。就是MEMORY.DMP，拖到开发机来，然后用windbg开始分析他，选择file里open crash dump开始分析它。首先加载符号。然后设置源文件的路径。

然后运行命令!analyze -v,然后产生了如下图的一个蓝屏分析报告

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000099, Attempt to free pool with invalid address  (or corruption in pool header)
Arg2: 98acd700, Address being freed
Arg3: 00000000, 0
Arg4: 00000000, 0

Debugging Details:
------------------

SYMSRV:  BYINDEX: 0x5CF
         d:\symbols 7x86*http://msdl.microsoft.com/download/symbols
         ntkrpamp.exe
         4CE78A09412000
SYMSRV:  PATH: d:\symbols 7x86\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
SYMSRV:  RESULT: 0x00000000
DBGHELP: d:\symbols 7x86\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe - OK
SYMSRV:  BYINDEX: 0x5D0
         d:\symbols 7x86*http://msdl.microsoft.com/download/symbols
         UcOperDrv.sys
         59ABCCDCc00
SYMSRV:  UNC: d:\symbols 7x86\UcOperDrv.sys\59ABCCDCc00\UcOperDrv.sys - path not found
SYMSRV:  UNC: d:\symbols 7x86\UcOperDrv.sys\59ABCCDCc00\UcOperDrv.sy_ - path not found
SYMSRV:  UNC: d:\symbols 7x86\UcOperDrv.sys\59ABCCDCc00\file.ptr - path not found
SYMSRV:  HTTPGET: /download/symbols/UcOperDrv.sys/59ABCCDCc00/UcOperDrv.sys
SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/UcOperDrv.sys/59ABCCDCc00/UcOperDrv.sy_
SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/UcOperDrv.sys/59ABCCDCc00/file.ptr
SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV:  RESULT: 0x80190194
DBGHELP: E:\MF\1firstl-Hello\dbgdemo\bsod\debug\i386\UcOperDrv.sys - OK

KEY_VALUES_STRING: 1


STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING:  7601.17514.x86fre.win7sp1_rtm.101119-1850

SYSTEM_MANUFACTURER:  VMware, Inc.

VIRTUAL_MACHINE:  VMware

SYSTEM_PRODUCT_NAME:  VMware Virtual Platform

SYSTEM_VERSION:  None

BIOS_VENDOR:  Phoenix Technologies LTD

BIOS_VERSION:  6.00

BIOS_DATE:  05/19/2017

BASEBOARD_MANUFACTURER:  Intel Corporation

BASEBOARD_PRODUCT:  440BX Desktop Reference Platform

BASEBOARD_VERSION:  None

DUMP_TYPE:  1

BUGCHECK_P1: 99

BUGCHECK_P2: ffffffff98acd700

BUGCHECK_P3: 0

BUGCHECK_P4: 0

FAULTING_IP: 
UcOperDrv!OperUnicodeStr+2ab [d:\mallocfree_2017\windows\1firstl-hello\dbgdemo\bsod\main.c @ 70]
98acd6db 8be5            mov     esp,ebp

BUGCHECK_STR:  0xc2_99

CPU_COUNT: 1

CPU_MHZ: 9c5

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R)  SIG: 25'00000000 (cache) 25'00000000 (init)

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ANALYSIS_SESSION_HOST:  DESKTOP-4BL1C4H

ANALYSIS_SESSION_TIME:  05-23-2019 22:50:18.0491

ANALYSIS_VERSION: 10.0.17763.1 amd64fre

LAST_CONTROL_TRANSFER:  from 84173f03 to 83f1bf20

STACK_TEXT:  
807f18c4 84173f03 000000c2 00000099 98acd700 nt!KeBugCheckEx+0x1e
807f18e4 83f2d389 98acd700 98acd6f8 000001ff nt!VerifierBugCheckIfAppropriate+0x30
807f18f8 83f5eff9 98acd700 00000660 00000000 nt!VerifierFreeTrackedPool+0x24
807f1968 98acd6db 98acd700 00000000 0000000e nt!ExFreePoolWithTag+0x53e
807f19d0 98acd41a 807f1bbc 840012e6 86034190 UcOperDrv!OperUnicodeStr+0x2ab [d:\mallocfree_2017\windows\1firstl-hello\dbgdemo\bsod\main.c @ 70] 
807f19d8 840012e6 86034190 86036000 00000000 UcOperDrv!DriverEntry+0xa [d:\mallocfree_2017\windows\1firstl-hello\dbgdemo\bsod\main.c @ 11] 
807f1bbc 84004d98 00000001 00000000 807f1be4 nt!IopLoadDriver+0x7ed
807f1c00 83ebaaab 94f99bd0 00000000 85cdf798 nt!IopLoadUnloadDriver+0x70
807f1c50 84046f5e 00000001 a76e1e35 00000000 nt!ExpWorkerThread+0x10d
807f1c90 83eee219 83eba99e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


THREAD_SHA1_HASH_MOD_FUNC:  cb829f32645adac3007376ebdc069b62c0d10643

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  6973de209d28a1de8ac3d73dd48d1020a3075ae5

THREAD_SHA1_HASH_MOD:  589add185ebdeba4826121bc925fe3e22f690d15

FOLLOWUP_IP: 
UcOperDrv!OperUnicodeStr+2ab [d:\mallocfree_2017\windows\1firstl-hello\dbgdemo\bsod\main.c @ 70]
98acd6db 8be5            mov     esp,ebp

FAULT_INSTR_CODE:  c35de58b

FAULTING_SOURCE_LINE:  d:\mallocfree_2017\windows\1firstl-hello\dbgdemo\bsod\main.c

FAULTING_SOURCE_FILE:  d:\mallocfree_2017\windows\1firstl-hello\dbgdemo\bsod\main.c

FAULTING_SOURCE_LINE_NUMBER:  70

FAULTING_SOURCE_CODE:  
    66: 	DbgPrint("%wZ\n", &uStr4);
    67: 
    68: 	ExFreePool(uStr4.Buffer);
    69: 
>   70: }


SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  UcOperDrv!OperUnicodeStr+2ab

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: UcOperDrv

IMAGE_NAME:  UcOperDrv.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  59abccdc

STACK_COMMAND:  .thread ; .cxr ; kb

FAILURE_BUCKET_ID:  0xc2_99_UcOperDrv!OperUnicodeStr+2ab

BUCKET_ID:  0xc2_99_UcOperDrv!OperUnicodeStr+2ab

PRIMARY_PROBLEM_CLASS:  0xc2_99_UcOperDrv!OperUnicodeStr+2ab

TARGET_TIME:  2019-05-23T13:35:36.000Z

OSBUILD:  7601

OSSERVICEPACK:  1000

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x86

OSNAME:  Windows 7

OSEDITION:  Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2010-11-20 16:42:49

BUILDDATESTAMP_STR:  101119-1850

BUILDLAB_STR:  win7sp1_rtm

BUILDOSVER_STR:  6.1.7601.17514.x86fre.win7sp1_rtm.101119-1850

ANALYSIS_SESSION_ELAPSED_TIME:  c68

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0xc2_99_ucoperdrv!operunicodestr+2ab

FAILURE_ID_HASH:  {6ef3c91d-9314-e8dd-6cc0-f9889f201760}

Followup:     MachineOwner
---------

然后通过报告去看引起错误的地方，这里可以通过.open -a UcOperDrv!OperUnicodeStr+0x2ab查看

#include <ntddk.h>

VOID OperUnicodeStr(VOID);

NTSTATUS DriverEntry(
		IN PDRIVER_OBJECT pDriverObject, 
		IN PUNICODE_STRING pRegPath)
{
	OperUnicodeStr();

	return STATUS_SUCCESS;
}

VOID OperUnicodeStr(VOID)
{

	UNICODE_STRING 		uStr1 = {0};
	UNICODE_STRING 		uStr2 = {0};
	UNICODE_STRING		uStr3 = {0};
	UNICODE_STRING		uStr4 = {0};

	ANSI_STRING         aStr1 = {0};
	

	RtlInitUnicodeString(&uStr1, L"hello");
	RtlInitUnicodeString(&uStr2, L"Goodbye");
	DbgPrint("uStr1=%wZ\n", uStr1);
	DbgPrint("uStr2=%wZ\n", uStr2);

	RtlInitAnsiString(&aStr1, "Ansi string");
	DbgPrint("aStr1=%Z\n", aStr1);

	RtlCopyUnicodeString(&uStr3, &uStr1);
	DbgPrint("uStr3=%wZ\n", uStr3);

	RtlAppendUnicodeToString(&uStr1, L"world");
	DbgPrint("uStr1=%wZ\n", uStr1);

	RtlAppendUnicodeStringToString(&uStr1, &uStr2);
	DbgPrint("uStr1=%wZ\n", uStr1);


	if (RtlCompareUnicodeString(&uStr1, &uStr2, TRUE) == 0)//TRUE:case sensible
	{
		DbgPrint("%wZ == %wZ\n", uStr1, uStr2);
	}
	else
	{
		DbgPrint("%wZ != %wZ\n", uStr1, uStr2);
	}

	RtlAnsiStringToUnicodeString(&uStr3, &aStr1, TRUE);//TRUE: memory allocation for uStr1 and should be freed by RtlFreeUnicodeString
	DbgPrint("%wZ\n", uStr3);
	RtlFreeUnicodeString(&uStr3);

	uStr4.Buffer = ExAllocatePoolWithTag(PagedPool, wcslen(L"Nice to meet u")+sizeof(WCHAR), 'POCU');
	if (uStr4.Buffer == NULL)
	{
		return;
	}
	RtlZeroMemory(uStr4.Buffer, wcslen(L"Nice to meet u")+sizeof(WCHAR));
	uStr4.Length = 0;
	uStr4.MaximumLength = wcslen(L"Nice to meet u")+sizeof(WCHAR);

	RtlInitUnicodeString(&uStr4, L"Nice to meet u");
	DbgPrint("%wZ\n", &uStr4);

	ExFreePool(uStr4.Buffer);

}

就可以分析，一般造成蓝屏原因比如

关闭了无效handle

在没有ObReferenceObject（pFileObject）下ObDereferenceObject（pFileObject)

引用NULL指针

内存访问越界 BAD POOL HEADER

高中断访问了缺页内存 DRIVER_IRQL_NOT_LESS_OR_EQUAL

另外可以参考微软文档

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2