对于32
位系统上的32
位进程,EAX
寄存器保存入口点的地址。但是 windbg 始终为该线程显示 0
。
在挂起状态下创建进程并执行
.thread <thread_address>
r
表演
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=828b0c26 esp=8fe0ba04 ebp=8fe0ba48 iopl=0 nv up di pl nz na po nc
cs=0008 ss=0010 ds=0000 es=0000 fs=0000 gs=0000 efl=00000000
nt!KiSwapContext+0x26:
828b0c26 8b2c24 mov ebp,dword ptr [esp] ss:0010:8fe0ba04=8fe0ba48
在使用 GetThreadContext()
检查时,我在 EAX
中获得了当前值。
if (!CreateProcess("test.exe", nullptr, nullptr, nullptr, false, CREATE_SUSPENDED, nullptr, nullptr, &StartupInfo, &ProcessInfo))
{
std::cout << "Failed to create process " << GetLastError();
return 1;
}
CONTEXT Ctx;
Ctx.ContextFlags = CONTEXT_FULL;
GetThreadContext(ProcessInfo.hThread, &Ctx);
std::cout << Ctx.Eax << "\n"; //ImageBase + AddressOfEntryPoint
为什么windbg
显示0
而不是入口点地址。
最佳答案
假设您在目标(虚拟机/物理机)中创建了如下所示的暂停进程
并且您已使用内核调试器连接到该机器
并且您有适合二进制文件的私有(private) pdb,您可以简单地要求 windbg 使用 ?? 为您提供 Context.Eax C++ 表达式求值器
测试代码
#include <windows.h>
#include <stdio.h>
int main (void)
{
printf("lets Create a suspended process and look at it in kd\n");
STARTUPINFO si ={0};
PROCESS_INFORMATION pi ={0};
si.cb = sizeof(si);
char *cmdln = "c:\\windows\\system32\\calc.exe\0";
if( !CreateProcess( NULL,cmdln,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&si,&pi ))
{
printf( "CreateProcess failed (%x).\n", GetLastError() );
return 0;
}
CONTEXT ctx ={0};
ctx.ContextFlags = CONTEXT_FULL;
GetThreadContext(pi.hThread, &ctx);
printf("Eax = %x\n",ctx.Eax);
int ans = 'n';
while (ans != 'y')
{
Sleep(5000);
ans = getchar();
}
printf("resuming the process\n");
ResumeThread(pi.hThread);
WaitForSingleObject( pi.hProcess, INFINITE );
printf("wait returned closing handles\n");
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
}
编译链接
cl /Zi /W4 /analyze /Od /EHsc cpsusp.cpp /link /release
将编译后的可执行文件复制到运行 32 位 win7sp1 的虚拟机中并双击它 它执行打印 eax 并等待按键
并且在连接到该虚拟机的 kd 中,您可以找到 eax 的实际值
kd> !process 0 2 cpsusp.exe <<< find the DirectoryBase and Threads of Process one is interested in
PROCESS 841cad40 SessionId: 1 Cid: 0110 Peb: 7ffd5000 ParentCid: 008c
DirBase: 0f90a000 ObjectTable: 95d5d210 HandleCount: 12.
Image: cpsusp.exe
THREAD 841b8d48 Cid 0110.0644 Teb: 7ffdf000 Win32Thread: 00000000 WAIT:
(WrLpcReply) UserMode Non-Alertable
841b8f7c Semaphore Limit 0x1
kd> .thread /p /r /P 841b8d48 << setting the thread context (just .thread isn't enough
Implicit thread is now 841b8d48 Implicit process is now 841cad40
.cache forcedecodeptes done
kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
# ChildEBP RetAddr Args to Child
00 8ce3bae8 8285bd75 841b8d48 82925f08 82922d20 nt!KiSwapContext+0x26
XXXXXXXXXXXXXXXXXX snipped off irrelevent stack
16 0015f8e0 013d13d4 00000001 002cfe60 002d0bd8 cpsusp!main+0x114 [e:\code\cpsusp\cpsusp.cpp @ 25]
YYYYYYYYYYYYY snipped of iirelevent stack
1b 0015f98c 00000000 013d14b9 7ffd5000 00000000 ntdll!_RtlUserThreadStart+0x1b
kd> .frame /r /c 0x16 <<<< seeting the frame and forcing to retrieve the actual volatile registers
16 0015f8e0 013d13d4 cpsusp!main+0x114 [e:\code\cpsusp\cpsusp.cpp @ 25]
cpsusp!main+0x114:
001b:013d1114 89852cfdffff mov dword ptr [ebp-2D4h],eax
kd> dv
ctx = struct _CONTEXT <<<<<<<<<
cmdln = 0x014101d8 "c:\windows\system32\calc.exe"
pi = struct _PROCESS_INFORMATION
ans = 0n110
si = struct _STARTUPINFOA
kd> ?? ctx.Eax <<<<<<
unsigned long 0x212d6c <<<< this is the value you got printed in the remote machine
关于c++ - 在 windbg 中查看挂起进程的 eax 寄存器中的入口点地址,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/57341183/