an exception or a breakpoint comes from wow64.dll.

byytj

浏览: 48568 次
来自: ...

最近访客更多访客>>

botao1995

vv404725784

hqq517

hagetis

博主相关

博客

微博

相册

留言

关于我

文章分类

全部博客 (63)

社区版块

存档分类

Sometimes we get a process dump from x64 Windows and when we load it into WinDbg we get the output telling us that an exception or a breakpoint comes from wow64.dll. For example:

Loading Dump File [X:\ppid2088.dmp] User Mini Dump File with Full Memory: Only application data is available

Comment: 'Userdump generated complete user-mode minidump with Exception Monitor function on SERVER01' Symbol search path is: srv*c:\mss*http://msdl.microsoft.com/download/symbols Executable search path is: Windows Server 2003 Version 3790 (Service Pack 2) MP (4 procs) Free x64 Product: Server, suite: TerminalServer Debug session time: Tue Sep 4 13:36:14.000 2007 (GMT+2) System Uptime: 6 days 3:32:26.081 Process Uptime: 0 days 0:01:54.000 WARNING: tsappcmp overlaps ws2_32 WARNING: msvcp60 overlaps oleacc WARNING: tapi32 overlaps rasapi32 WARNING: rtutils overlaps rasman WARNING: dnsapi overlaps rasapi32 WARNING: wldap32 overlaps dnsapi WARNING: ntshrui overlaps userenv WARNING: wtsapi32 overlaps dnsapi WARNING: winsta overlaps setupapi WARNING: activeds overlaps rtutils WARNING: activeds overlaps rasman WARNING: adsldpc overlaps activeds WARNING: drprov overlaps apphelp WARNING: netui1 overlaps netui0 WARNING: davclnt overlaps apphelp ... This dump file has an exception of interest stored in it. The stored exception information can be accessed via .ecxr. (2088.2fe4): Unknown exception - code 000006d9 (first/second chance not available) wow64!Wow64NotifyDebugger+0×9: 00000000`6b006369 b001 mov al,1

Analysis shows that some run-time exception was raised but the stack trace shows only WOW64 CPU simulation code in all process threads:

0:000> !analyze -v ********************************************************* * * * Exception Analysis * * * *********************************************************

FAULTING_IP: kernel32!RaiseException+53 00000000`7d4e2366 5e pop rsi

EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 000000007d4e2366 (kernel32!RaiseException+0x0000000000000053) ExceptionCode: 000006d9 ExceptionFlags: 00000001 NumberParameters: 0

DEFAULT_BUCKET_ID: STACK_CORRUPTION

PROCESS_NAME: App.exe

ERROR_CODE: (NTSTATUS) 0x6d9 - There are no more endpoints available from the endpoint mapper.

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

LAST_CONTROL_TRANSFER: from 000000006b0064f2 to 000000006b006369

FOLLOWUP_IP: wow64!Wow64NotifyDebugger+9 00000000`6b006369 b001 mov al,1

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: wow64!Wow64NotifyDebugger+9

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: wow64

IMAGE_NAME: wow64.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 45d6943d

FAULTING_THREAD: 0000000000002fe4

PRIMARY_PROBLEM_CLASS: STACK_CORRUPTION

BUGCHECK_STR: APPLICATION_FAULT_STACK_CORRUPTION

STACK_COMMAND: ~0s; .ecxr ; dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; kb

FAILURE_BUCKET_ID: X64_APPLICATION_FAULT_STACK_CORRUPTION_wow64!Wow64NotifyDebugger+9

BUCKET_ID: X64_APPLICATION_FAULT_STACK_CORRUPTION_wow64!Wow64NotifyDebugger+9

Followup: MachineOwner ---------

0:000> ~*k

. 0 Id: 2088.2fe4 Suspend: 1 Teb: 00000000`7efdb000 Unfrozen Child-SP RetAddr Call Site 00000000`0016e190 00000000`6b0064f2 wow64!Wow64NotifyDebugger+0x9 00000000`0016e1c0 00000000`6b006866 wow64!Wow64KiRaiseException+0x172 00000000`0016e530 00000000`78b83c7d wow64!Wow64SystemServiceEx+0xd6 00000000`0016edf0 00000000`6b006a5a wow64cpu!ServiceNoTurbo+0x28 00000000`0016ee80 00000000`6b005e0d wow64!RunCpuSimulation+0xa 00000000`0016eeb0 00000000`77ed8030 wow64!Wow64LdrpInitialize+0x2ed 00000000`0016f3f0 00000000`77ed582f ntdll!LdrpInitializeProcess+0x1538 00000000`0016f6f0 00000000`77ef30a5 ntdll!LdrpInitialize+0x18f 00000000`0016f7d0 00000000`7d4d1510 ntdll!KiUserApcDispatcher+0x15 00000000`0016fcc8 00000000`00000000 kernel32!BaseProcessStartThunk 00000000`0016fcd0 00000000`00000000 0x0 00000000`0016fcd8 00000000`00000000 0x0 00000000`0016fce0 00000000`00000000 0x0 00000000`0016fce8 00000000`00000000 0x0 00000000`0016fcf0 00000000`00000000 0x0 00000000`0016fcf8 00000000`00000000 0x0 00000000`0016fd00 00010007`00000000 0x0 00000000`0016fd08 00000000`00000000 0x10007`00000000 00000000`0016fd10 00000000`00000000 0x0 00000000`0016fd18 00000000`00000000 0x0

1 Id: 2088.280c Suspend: 1 Teb: 00000000`7efd8000 Unfrozen Child-SP RetAddr Call Site 00000000`0200f0d8 00000000`6b006a5a wow64cpu!WaitForMultipleObjects32+0x3a 00000000`0200f180 00000000`6b005e0d wow64!RunCpuSimulation+0xa 00000000`0200f1b0 00000000`77f109f0 wow64!Wow64LdrpInitialize+0x2ed 00000000`0200f6f0 00000000`77ef30a5 ntdll!LdrpInitialize+0x2aa 00000000`0200f7d0 00000000`7d4d1504 ntdll!KiUserApcDispatcher+0x15 00000000`0200fcc8 00000000`00000000 kernel32!BaseThreadStartThunk 00000000`0200fcd0 00000000`00000000 0x0 00000000`0200fcd8 00000000`00000000 0x0 00000000`0200fce0 00000000`00000000 0x0 00000000`0200fce8 00000000`00000000 0x0 00000000`0200fcf0 00000000`00000000 0x0 00000000`0200fcf8 00000000`00000000 0x0 00000000`0200fd00 0001002f`00000000 0x0 00000000`0200fd08 00000000`00000000 0x1002f`00000000 00000000`0200fd10 00000000`00000000 0x0 00000000`0200fd18 00000000`00000000 0x0 00000000`0200fd20 00000000`00000000 0x0 00000000`0200fd28 00000000`00000000 0x0 00000000`0200fd30 00000000`00000000 0x0 00000000`0200fd38 00000000`00000000 0x0

2 Id: 2088.1160 Suspend: 1 Teb: 00000000`7efd5000 Unfrozen Child-SP RetAddr Call Site 00000000`0272e7c8 00000000`6b29c464 wow64win!ZwUserGetMessage+0xa 00000000`0272e7d0 00000000`6b006866 wow64win!whNtUserGetMessage+0x34 00000000`0272e830 00000000`78b83c7d wow64!Wow64SystemServiceEx+0xd6 00000000`0272f0f0 00000000`6b006a5a wow64cpu!ServiceNoTurbo+0x28 00000000`0272f180 00000000`6b005e0d wow64!RunCpuSimulation+0xa 00000000`0272f1b0 00000000`77f109f0 wow64!Wow64LdrpInitialize+0x2ed 00000000`0272f6f0 00000000`77ef30a5 ntdll!LdrpInitialize+0x2aa 00000000`0272f7d0 00000000`7d4d1504 ntdll!KiUserApcDispatcher+0x15 00000000`0272fcc8 00000000`00000000 kernel32!BaseThreadStartThunk 00000000`0272fcd0 00000000`00000000 0x0 00000000`0272fcd8 00000000`00000000 0x0 00000000`0272fce0 00000000`00000000 0x0 00000000`0272fce8 00000000`00000000 0x0 00000000`0272fcf0 00000000`00000000 0x0 00000000`0272fcf8 00000000`00000000 0x0 00000000`0272fd00 00010003`00000000 0x0 00000000`0272fd08 00000000`00000000 0x10003`00000000 00000000`0272fd10 00000000`00000000 0x0 00000000`0272fd18 00000000`00000000 0x0 00000000`0272fd20 00000000`00000000 0x0

3 Id: 2088.2d04 Suspend: 1 Teb: 00000000`7efad000 Unfrozen Child-SP RetAddr Call Site 00000000`0289f108 00000000`78b84191 wow64cpu!CpupSyscallStub+0x9 00000000`0289f110 00000000`6b006a5a wow64cpu!Thunk2ArgNSpNSpReloadState+0x21 00000000`0289f180 00000000`6b005e0d wow64!RunCpuSimulation+0xa 00000000`0289f1b0 00000000`77f109f0 wow64!Wow64LdrpInitialize+0x2ed 00000000`0289f6f0 00000000`77ef30a5 ntdll!LdrpInitialize+0x2aa 00000000`0289f7d0 00000000`7d4d1504 ntdll!KiUserApcDispatcher+0x15 00000000`0289fcc8 00000000`00000000 kernel32!BaseThreadStartThunk 00000000`0289fcd0 00000000`00000000 0x0 00000000`0289fcd8 00000000`00000000 0x0 00000000`0289fce0 00000000`00000000 0x0 00000000`0289fce8 00000000`00000000 0x0 00000000`0289fcf0 00000000`00000000 0x0 00000000`0289fcf8 00000000`00000000 0x0 00000000`0289fd00 0001002f`00000000 0x0 00000000`0289fd08 00000000`00000000 0x1002f`00000000 00000000`0289fd10 00000000`00000000 0x0 00000000`0289fd18 00000000`00000000 0x0 00000000`0289fd20 00000000`00000000 0x0 00000000`0289fd28 00000000`00000000 0x0 00000000`0289fd30 00000000`00000000 0x0

4 Id: 2088.15c4 Suspend: 1 Teb: 00000000`7efa4000 Unfrozen Child-SP RetAddr Call Site 00000000`02def0a8 00000000`6b006a5a wow64cpu!RemoveIoCompletionFault+0x41 00000000`02def180 00000000`6b005e0d wow64!RunCpuSimulation+0xa 00000000`02def1b0 00000000`77f109f0 wow64!Wow64LdrpInitialize+0x2ed 00000000`02def6f0 00000000`77ef30a5 ntdll!LdrpInitialize+0x2aa 00000000`02def7d0 00000000`7d4d1504 ntdll!KiUserApcDispatcher+0x15 00000000`02defcc8 00000000`00000000 kernel32!BaseThreadStartThunk 00000000`02defcd0 00000000`00000000 0x0 00000000`02defcd8 00000000`00000000 0x0 00000000`02defce0 00000000`00000000 0x0 00000000`02defce8 00000000`00000000 0x0 00000000`02defcf0 00000000`00000000 0x0 00000000`02defcf8 00000000`00000000 0x0 00000000`02defd00 0001002f`00000000 0x0 00000000`02defd08 00000000`00000000 0x1002f`00000000 00000000`02defd10 00000000`00000000 0x0 00000000`02defd18 00000000`00000000 0x0 00000000`02defd20 00000000`00000000 0x0 00000000`02defd28 00000000`00000000 0x0 00000000`02defd30 00000000`00000000 0x0 00000000`02defd38 00000000`00000000 0x0

This is a clear indication that the process was in fact 32-bit but the dump is 64-bit. This situation is depicted in one of my earlier posts last year:

Dumps, Debuggers and Virtualization

and we need a debugger plugin to understand virtualized CPU architecture:

Dumps, Debuggers and Virtualization refined

This crash dump pattern can be called Virtualized Process. In our case we need to load wow64exts.dll WinDbg extension and set the target processor mode to x86 by using .effmach command

0:000> .load wow64exts 0:000> .effmach x86 Effective machine: x86 compatible (x86)

Then analysis gives us more meaningful results:

0:000:x86> !analyze -v ********************************************************* * * * Exception Analysis * * * *********************************************************

FAULTING_IP: kernel32!RaiseException+53 00000000`7d4e2366 5e pop esi

BUGCHECK_STR: 6d9

DEFAULT_BUCKET_ID: APPLICATION_FAULT

PROCESS_NAME: App.exe

ERROR_CODE: (NTSTATUS) 0x6d9 - There are no more endpoints available from the endpoint mapper.

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

LAST_CONTROL_TRANSFER: from 000000007da4a631 to 000000007d4e2366

STACK_TEXT: 0012d98c 7da4a631 000006d9 00000001 00000000 kernel32!RaiseException+0x53 0012d9a4 7da4a5f7 000006d9 0012ddc4 0012dda0 rpcrt4!RpcpRaiseException+0x24 0012d9b4 7dac0140 0012da00 00000018 0024a860 rpcrt4!NdrGetBuffer+0x46 0012dda0 5f2a2fba 5f2777b8 5f2771e2 0012ddc4 rpcrt4!NdrClientCall2+0x197 0012ddbc 5f29c6a6 0024a860 00000370 00000000 hnetcfg!FwOpenDynamicFwPort+0x1d 0012de68 7db4291f 0024a860 00000370 00000002 hnetcfg!IcfOpenDynamicFwPort+0x6a 0012df00 71c043db 00000370 0012df4c 00000010 mswsock!WSPBind+0x2e3 WARNING: Frame IP not in any known module. Following frames may be wrong. 0012df24 76ed91c8 00000370 0012df4c 00000010 ws2_32+0x43db 0012df6c 76ed9128 00000370 00000002 00000000 rasapi32+0x491c8 0012df98 76ed997c 00000002 00000002 00000000 rasapi32+0x49128 0012dfc0 76ed8ac2 00000002 02c225f8 02c22688 rasapi32+0x4997c 0012dfd4 76ed89cd 02c225f8 02c22ce8 02c22f38 rasapi32+0x48ac2 0012dff0 76ed82e5 02c226b2 02c22f38 00000000 rasapi32+0x489cd 0012e010 76ed827f 02c225f8 02c22ce8 02c22f38 rasapi32+0x482e5 0012e044 76ed8bf0 02c225f8 00000000 00000000 rasapi32+0x4827f 0012e0c8 76ed844d 02c225f8 00000000 04000000 rasapi32+0x48bf0 0012e170 76ed74b5 04000000 0000232b 02c21f58 rasapi32+0x4844d 0012e200 76ed544f 02c21f58 00000000 02c21f58 rasapi32+0x474b5 0012e22c 76ed944d 00000001 00000000 02c21f58 rasapi32+0x4544f 0012e24c 76ed93a4 00000000 00000000 00000000 rasapi32+0x4944d 0012e298 76ed505f 02c22c9c 00000001 04000000 rasapi32+0x493a4 0012e2bc 7db442bf 02c22c9c 00000001 04000000 rasapi32+0x4505f 0012e2ec 7db4418b 02c22c9c 00000001 04000000 mswsock!SaBlob_Query+0x2d 0012e330 7db4407c 00000000 020243f0 020243d8 mswsock!Rnr_DoDnsLookup+0xf0 0012e5c8 71c06dc0 02c22c38 00000000 0012e680 mswsock!Dns_NSPLookupServiceNext+0x24b 0012e5e0 71c06da0 02024498 02c22c38 00000000 ws2_32+0x6dc0 0012e5fc 71c06d6a 02024560 00000000 0012e680 ws2_32+0x6da0 0012e628 71c06d08 020243f0 00000000 0012e680 ws2_32+0x6d6a 0012e648 71c08282 020243d8 00000000 0012e680 ws2_32+0x6d08 0012ef00 71c07f68 02024c98 00000002 0012ef74 ws2_32+0x8282 0012ef34 71c08433 02024c98 00000001 0012ef74 ws2_32+0x7f68 0012efa0 71c03236 02024c98 00000000 00000000 ws2_32+0x8433 0012f094 71c03340 02024c98 00000000 0012f148 ws2_32+0x3236 0012f0bc 7dab22fb 0012f0d4 00000000 0012f148 ws2_32+0x3340 0012f11c 7dab3a0e 0012f184 0026fff0 0026836c rpcrt4!IP_ADDRESS_RESOLVER::NextAddress+0x13e 0012f238 7dab3c11 0026836c 00272f38 00000402 rpcrt4!TCPOrHTTP_Open+0xdb 0012f270 7da44c85 0026836c 00271d38 00272f38 rpcrt4!TCP_Open+0x55 0012f2b8 7da44b53 00000000 00271d38 00272f38 rpcrt4!OSF_CCONNECTION::TransOpen+0x5e 0012f31c 7da447d7 0026fff0 000dbba0 00000000 rpcrt4!OSF_CCONNECTION::OpenConnectionAndBind+0xbe 0012f360 7da44720 00000000 0012f414 00000000 rpcrt4!OSF_CCALL::BindToServer+0xfa 0012f378 7da3a9df 00000000 00000000 00000000 rpcrt4!OSF_BINDING_HANDLE::InitCCallWithAssociation+0x63 0012f3f4 7da3a8dd 0012f414 0012f480 00270028 rpcrt4!OSF_BINDING_HANDLE::AllocateCCall+0x49d 0012f428 7da37a1c 0012f480 0012f4ac 00000001 rpcrt4!OSF_BINDING_HANDLE::NegotiateTransferSyntax+0x2e 0012f440 7da3642c 0012f480 00000000 0012f460 rpcrt4!I_RpcGetBufferWithObject+0x5b 0012f450 7da37bff 0012f480 0012f86c 0012f84c rpcrt4!I_RpcGetBuffer+0xf 0012f460 7dac0140 0012f4ac 0000006c 0026fff0 rpcrt4!NdrGetBuffer+0x2e 0012f84c 766f41f1 766f24e8 766f423a 0012f86c rpcrt4!NdrClientCall2+0x197 0012f864 766f40b8 0026fff0 0012f904 0012f8e4 ntdsapi!_IDL_DRSBind+0x1c 0012f930 7d8ecaa2 002788bc 00278908 00000000 ntdsapi!DsBindWithSpnExW+0x223 0012f9b0 7d8ed028 00000000 02264f90 00000000 secur32!SecpTranslateName+0x1f3 0012f9d0 00434aa0 02264f90 00000000 00000002 secur32!TranslateNameW+0x2d 0012fab4 00419a7f 022a85e4 0012fc94 afec94eb App+0x34aa0 0012fb0c 0041a61b afec9443 ffffffff 00463fb8 App+0x19a7f 0012fbc0 0045a293 ffffffff 0043682f 004188f3 App+0x1a61b 0012fbc8 0043682f 004188f3 afec93eb ffffffff App+0x5a293 0012fbcc 004188f3 afec93eb ffffffff 00463fb0 App+0x3682f 0043682f 00000000 7459c085 7000c707 c3004645 App+0x188f3

STACK_COMMAND: kb

FOLLOWUP_IP: hnetcfg!FwOpenDynamicFwPort+1d 00000000`5f2a2fba 83c40c add esp,0Ch

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: hnetcfg!FwOpenDynamicFwPort+1d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hnetcfg

IMAGE_NAME: hnetcfg.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 45d6cc2a

FAULTING_THREAD: 0000000000002fe4

FAILURE_BUCKET_ID: X64_6d9_hnetcfg!FwOpenDynamicFwPort+1d

BUCKET_ID: X64_6d9_hnetcfg!FwOpenDynamicFwPort+1d

Followup: MachineOwner ---------

0:000:x86> ~*k

. 0 Id: 2088.2fe4 Suspend: 1 Teb: 00000000`7efdb000 Unfrozen ChildEBP RetAddr 0012d98c 7da4a631 kernel32!RaiseException+0x53 0012d9a4 7da4a5f7 rpcrt4!RpcpRaiseException+0x24 0012d9b4 7dac0140 rpcrt4!NdrGetBuffer+0x46 0012dda0 5f2a2fba rpcrt4!NdrClientCall2+0x197 0012ddbc 5f29c6a6 hnetcfg!FwOpenDynamicFwPort+0x1d 0012de68 7db4291f hnetcfg!IcfOpenDynamicFwPort+0x6a 0012df00 71c043db mswsock!WSPBind+0x2e3 WARNING: Frame IP not in any known module. Following frames may be wrong. 0012df24 76ed91c8 ws2_32+0x43db 0012df6c 76ed9128 rasapi32+0x491c8 0012df98 76ed997c rasapi32+0x49128 0012dfc0 76ed8ac2 rasapi32+0x4997c 0012dfd4 76ed89cd rasapi32+0x48ac2 0012dff0 76ed82e5 rasapi32+0x489cd 0012e010 76ed827f rasapi32+0x482e5 0012e044 76ed8bf0 rasapi32+0x4827f 0012e0c8 76ed844d rasapi32+0x48bf0 0012e170 76ed74b5 rasapi32+0x4844d 0012e200 76ed544f rasapi32+0x474b5 0012e22c 76ed944d rasapi32+0x4544f 0012e24c 76ed93a4 rasapi32+0x4944d

1 Id: 2088.280c Suspend: 1 Teb: 00000000`7efd8000 Unfrozen ChildEBP RetAddr 01fcfea4 7d63f501 ntdll_7d600000!NtWaitForMultipleObjects+0x15 01fcff48 7d63f988 ntdll_7d600000!EtwpWaitForMultipleObjectsEx+0xf7 01fcffb8 7d4dfe21 ntdll_7d600000!EtwpEventPump+0x27f 01fcffec 00000000 kernel32!BaseThreadStart+0x34

2 Id: 2088.1160 Suspend: 1 Teb: 00000000`7efd5000 Unfrozen ChildEBP RetAddr 026eff50 0042f13b user32!NtUserGetMessage+0x15 WARNING: Stack unwind information not available. Following frames may be wrong. 026effb8 7d4dfe21 App+0x2f13b 026effec 00000000 kernel32!BaseThreadStart+0x34

3 Id: 2088.2d04 Suspend: 1 Teb: 00000000`7efad000 Unfrozen ChildEBP RetAddr 0285ffa0 7d634d69 ntdll_7d600000!ZwDelayExecution+0x15 0285ffb8 7d4dfe21 ntdll_7d600000!RtlpTimerThread+0x47 0285ffec 00000000 kernel32!BaseThreadStart+0x34

4 Id: 2088.15c4 Suspend: 1 Teb: 00000000`7efa4000 Unfrozen ChildEBP RetAddr 02daff80 7db4b6c6 ntdll_7d600000!NtRemoveIoCompletion+0x15 02daffb8 7d4dfe21 mswsock!SockAsyncThread+0x69 02daffec 00000000 kernel32!BaseThreadStart+0x34

- Dmitry Vostokov @ DumpAnalysis.org -

Sponsored link: Professional Software Debugging Services

/* Malware and Software Defects -> Victimware.org */

分享到：