WinDbg: find probable CONTEXT records
This script finds and pretty prints all probable CONTEXT
struct instances throughout x64 process address space:
0:000> .foreach ( CxrPtr { s -[w1]b 0x00000000000000000 L?FFFFFFFFFFFFFFFF 2b 00 2b 00 53 00 2b 00 } ) { .cxr ${CxrPtr}-@@(#FIELD_OFFSET(ntdll!_CONTEXT, SegDs)) } rax=000000000f2907e0 rbx=00000001420b70f0 rcx=0000000010c3d130 rdx=0000000010c3cad8 rsi=00000001420b7d08 rdi=000000013fda9cb0 rip=000007fe99e71cc9 rsp=0000000010c3e850 rbp=0000000010c3e870 r8=0000000010c2a000 r9=000000000f2907e0 r10=000007fef6bd6738 r11=0000000000000001 r12=0000000140e4fb00 r13=000000033fcc69f8 r14=0000000010c3f098 r15=0000000000000004 iopl=0 nv up ei pl nz na pe nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202 000007fe`99e71cc9 8a4510 mov al,byte ptr [rbp+10h] ss:00000000`10c3e880=00 ... rax=000000004685a478 rbx=0000000241d02878 rcx=0000000000000000 rdx=0000000000000000 rsi=0000000241c9d708 rdi=0000000241d02838 rip=000007fe9d9d39f4 rsp=000000004685a450 rbp=000000004685a4a0 r8=0000000441b49850 r9=0000000000000000 r10=000007fe9b1e1ac0 r11=0000000441b49870 r12=0000000241c90e88 r13=000007fe9b299448 r14=00000001406cc858 r15=0000000441b24af0 iopl=0 nv up ei pl nz na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 000007fe`9d9d39f4 803900 cmp byte ptr [rcx],0 ds:00000000`00000000=??
Then you would normally use RIP and RSP registers to find relevant code and thread context:
0:000> !IP2MD 000007fe99e71cc9 MethodDesc: 000007fe98e229c0 Method Name: Replay.Core.Implementation.AutomaticUpdate.PatchDetector.IsPatched(System.Diagnostics.FileVersionInfo) Class: 000007fe98dec4a0 MethodTable: 000007fe98e22a70 mdToken: 0000000006000463 Module: 000007fe988acb20 IsJitted: yes CodeAddr: 000007fe99e71c50 Transparency: Critical 0:000> !IP2MD 000007fefde1940d Failed to request MethodData, not in JIT code range 0:000> ln 000007fefde1940d (000007fe`fde193d0) KERNELBASE!RaiseException+0x39 | (000007fe`fde19420) KERNELBASE!CreateMutexExW 0:000> !address 000000004685a450 Mapping file section regions... Mapping module regions... Mapping PEB regions... Mapping TEB and stack regions... Mapping heap regions... Mapping page heap regions... Mapping other regions... Mapping stack trace database regions... Mapping activation context regions... Usage: Stack Base Address: 00000000`46852000 End Address: 00000000`46860000 Region Size: 00000000`0000e000 State: 00001000 MEM_COMMIT Protect: 00000004 PAGE_READWRITE Type: 00020000 MEM_PRIVATE Allocation Base: 00000000`46460000 Allocation Protect: 00000004 PAGE_READWRITE More info: ~88k 0:000> ~88k Child-SP RetAddr Call Site 00000000`4685ed48 000007fe`fde110dc ntdll!NtWaitForSingleObject+0xa 00000000`4685ed50 000007fe`f7e89622 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`4685edf0 000007fe`f7e89841 clr!CLRSemaphore::Wait+0x8a 00000000`4685eeb0 000007fe`f7e897ec clr!ThreadpoolMgr::UnfairSemaphore::Wait+0x134 00000000`4685eef0 000007fe`f7d733de clr!ThreadpoolMgr::WorkerThreadStart+0x204 00000000`4685efb0 00000000`77a959ed clr!Thread::intermediateThreadProc+0x7d 00000000`4685fb70 00000000`77ccc541 kernel32!BaseThreadInitThunk+0xd 00000000`4685fba0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
1 коммент.:
nova legacy mod apk
Отправить комментарий