软件调试实战：windbg 内核调试（lkd kd ）

阳光穿透心脏的1/2处 2022-01-22 01:23 974阅读 0赞

[http://advdbg.org/books/swdbg/samples.aspx][http_advdbg.org_books_swdbg_samples.aspx]

一，本地内核调试( lkd )：

管理员权限启动windbg，ctrl + k --> Local

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70][]

二，查看进程数据结构

1. 启动计算器

2. !process 0 0 列出系统内的所有进程

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 1][]

3. dt \_EPROCESS 88270030 (查看calc.exe 的EPROCESS结构)

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 2][]

4.!process 88270030 (查看calc.exe 的关键信息)

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 3][]

5. !token b1430a38 (查看calc.exe 的token信息)

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 4][]

6.查看peb （内核模式下，先设置隐式进程）

.process 88270030 （设置calc.exe 为隐式进程）

![2019060419042856.png][]

dt \_PEB 7ffde000 （查看calc.exe peb）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 5][]

7.!handle （查看calce.exe 句柄表 在calce.exe 进程环境）

.![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 6][]

8. !process 4 0 （查看system进程）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 7][]

9. 查看 idle 进程

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 8][]

二 ，双机调试（kd） 环境配置：[https://blog.csdn.net/huanongying131/article/details/90740286][https_blog.csdn.net_huanongying131_article_details_90740286]

1.查看双重错误 任务门（软件调试 p301）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 9][]

2.查看当前任务门(tr)

![20190605112346140.png][]

3.产看中断描述表(idt)

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 10][]

三、UefSndThrd.exe练习（12章）

1.ctrl+e 打开执行文件

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 11][]

2.设置符号路径，源文件路径：

![20190606145250162.png][]

3.下bp断点

![20190606145336482.png][]

4.g 执行

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 12][]

5.继续：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 13][]

6.从中可以看出：

主函数插入了一层异常（\_XcptFilter）

四、dump练习

1.用everyting 搜.dmp 发现一堆 tim的dump OK *选一个来练习一下*

*2.ctrl+d*

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 14][]

3.随便选一个

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 15][]

4. .ecrx （显示异常环境记录，重要的是 该指令还会却换到发生异常的线程环境

比如（~ （线程号）s .process EPROCESS地址） 都是确换环境，有了环境 kn 这些指令才能根据环境获取信息）

![20190606155224614.png][]

5. kv 查看栈回溯

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 16][]

五、蓝屏dump练习

1.本系统C:\\Windows 目录下刚好有个MEMORY.dmp文件 直接用它

2.ctrl + d 打开dmp文件

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 17][]

2. BugCheck 7F （从 debugger.chm（windbg帮助文档）搜索 Bug Check 0x7F）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 18][]

3. \{8, 807ca750, 0, 0\}

第一个参数 8

![20190606163220270.png][]

4. 照着文档的流程 练习一下

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 19][]

5.**!analyze**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 20][]

6. kv （上面 可以知道 是哪个驱动导致的（Hooksys.sys） 看一下栈回溯 (分析一下驱动的哪一部分导致的））

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 21][]

7. .tss 0x28 查看任务状态段 （由上图可知是一个 tass gate 中断）

![20190606165916996.png][]

8. kv (上图 可以看出蓝屏是 nt!MiAllocatePoolPages+0x12 看一下哪一部分调到这里的）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 22][]

9. .thread !thread （查看线程信息， 蓝屏环境是 当前线程 当前进程）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 23][]

10. .process !process （查看当前进程）

![20190606171844666.png][]

11. **!analyze -v（一步到位）**（1--8 很繁琐 但刚开始分析 需要 理解原理 分析过程）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 24][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 25][]

FAILURE\_BUCKET\_ID: 0x7f\_8\_Hooksys+1b2f6 BUGCHECK\_STR: 0x7f\_8

UNEXPECTED\_KERNEL\_MODE\_TRAP (7f) Arg1: 00000008, EXCEPTION\_DOUBLE\_FAULT

12. ln ( 查看最后跳转 LAST\_CONTROL\_TRANSFER: from 83cabafe to 83d3247a）

![20190606173808297.png][]

ExpAllocateBigPool ---> MiAllocatePoolPages

六. TEB （24章）

打开计算器calc.exe，windbg F6 -->附加到calc.exe

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 26][]

1.dt ntdll!\_NT\_TIB

![20190611110121566.png][]

2. u ntdll!NtCurrentTeb

![20190611105036121.png][]

3.dd fs:\[18\] l1

![20190611110240869.png][]

4. dt ntdll!\_NT\_TIB 7ffd9000

![2019061111000184.png][]

5. dt \_EXCEPTION\_REGISTRATION\_RECORD 0x0348f8c4

![20190611110536555.png][]

6. !exchain

![20190611111217425.png][]

7. u ntdll!RtlpGetRegistrationHead

![20190611111401747.png][]

[http_advdbg.org_books_swdbg_samples.aspx]: http://advdbg.org/books/swdbg/samples.aspx
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70]: /images/20220122/2b6012164be740e6be759b9d88a2b409.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 1]: /images/20220122/496b440359c54209a624200c271f0a26.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 2]: /images/20220122/794127ef63e84f97a022040efbbd452b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 3]: /images/20220122/b7e269e3d0a343cbb926a27702c1e395.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 4]: /images/20220122/65dda09f8d3841768b2091634a0bcae9.png
[2019060419042856.png]: /images/20220122/d70f349d7f1646e1a70ff4b267d33ac0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 5]: /images/20220122/ce02d761f4b54edfad2d18f2693b8a5f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 6]: /images/20220122/8771b651b7364e33ab8f55796d9c96de.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 7]: /images/20220122/e29ed7ae5bca48a688d8f8051db1a472.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 8]: /images/20220122/336d43fddd2b49a6a479b707ea448e09.png
[https_blog.csdn.net_huanongying131_article_details_90740286]: https://blog.csdn.net/huanongying131/article/details/90740286
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 9]: /images/20220122/8f06b85d41af43bb9eb2c0c3af8e8a71.png
[20190605112346140.png]: /images/20220122/cd60e7f302864bd29681961d1e5d5135.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 10]: /images/20220122/577a1867ceeb47e6b9335e9072511a3c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 11]: /images/20220122/9e0b8aef2cab41e99a17147b1c6f9a07.png
[20190606145250162.png]: /images/20220122/7ca2f05aa606453aa0b489acf99417d0.png
[20190606145336482.png]: /images/20220122/248dbbd3154240ceb05d764d61617421.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 12]: /images/20220122/a6792cd7ef1a4656a4892b66b8b0900c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 13]: /images/20220122/231c0ea121644c7ea011dacc41894744.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 14]: /images/20220122/514ee9abcc284de891e3956ae602e5c1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 15]: /images/20220122/dea4f7ec601141a3a722b631ae21daa5.png
[20190606155224614.png]: /images/20220122/b06175fb769c486091571892ffe29a67.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 16]: /images/20220122/0882f41071064164b5155920ef32c3f0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 17]: /images/20220122/9c92e02936744041a10dc669e9621ae4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 18]: /images/20220122/2878940e54b8495382d4b231adef3012.png
[20190606163220270.png]: /images/20220122/f1f1d35ac2534e29aabaad72e6aff6b6.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 19]: /images/20220122/6498054ffc234f5f9589463c510a74bd.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 20]: /images/20220122/e04c5e69e73e4a088908418ea287e931.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 21]: /images/20220122/38f24affd27e4ccd93c19c320bc41e53.png
[20190606165916996.png]: /images/20220122/80fe84fc0a904a8a8f6cfd0d96a72abf.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 22]: /images/20220122/133d84d510a141d6a6e3bcc32e1bb724.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 23]: /images/20220122/e48ea41452c64423ac112f353eb233dd.png
[20190606171844666.png]: /images/20220122/78e3aa99cbb64f90adbbdc76619473ab.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 24]: /images/20220122/e3889c6e29c44194925c12ef5767b6fb.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 25]: /images/20220122/66184f3e86ea4a9fa1f873c6efed0091.png
[20190606173808297.png]: /images/20220122/f671f8ac396b403cbbc0569c34146e53.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 26]: /images/20220122/310ad3c398d94a0fa4c8be0b6d73f70a.png
[20190611110121566.png]: /images/20220122/38c0374d4c154f8595f018294c23caad.png
[20190611105036121.png]: /images/20220122/a2f6e1585dc74e0fa42b8de453afdb60.png
[20190611110240869.png]: /images/20220122/0772b4dc24e84aaea5050d81f34e7d98.png
[2019061111000184.png]: /images/20220122/11cc63ac2e8e45d9b0aea386984e0756.png
[20190611110536555.png]: /images/20220122/8a6506eba6dc4fc0a6f5aed37415b767.png
[20190611111217425.png]: /images/20220122/126b1528e0d44451b67a441b35af1ef6.png
[20190611111401747.png]: /images/20220122/018f9b4d2a184b4fade0ba6607f5c91e.png