주민등록증 분실신고를 위해 ( 어제 지갑을 잃어버려서… 아 놔 ) 관련 사이트에 접속하였습니다. 이때 아름답게 발생하는 Blue Screen 먼지 궁금해서 열어보니 조금 재미있는 BugCheck 이더군요.
1: kd> !analyze -v
*******************************
* *
* Bugcheck Analysis *
* *
*******************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it’s a trap of a kind
that the kernel isn’t allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
PEB is paged out (Peb.Ldr = 7ffda00c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffda00c). Type ".hh dbgerr001" for details
BUGCHECK_STR: 0x7f_d
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: BBBBBBBB.exe
LAST_CONTROL_TRANSFER: from f77ef498 to 804e322c
STACK_TEXT:
b4052b60 f77ef498 badb0d00 f771b560 80703d43 nt!KiSystemFatalException+0xf
WARNING: Stack unwind information not available. Following frames may be wrong.
b4052bf8 f77efb15 00000001 00000004 00000000 AAAAAA+0×498
b4052c14 f77f56e1 83668758 87d4cdc8 87e4f3c8 AAAAAA+0xb15
b4052c2c 804e33d9 fdede8f8 83668700 80703410 AAAAAA+0×66e1
b4052c50 8057287c 836687c8 87d4cdc8 83668758 nt!IopfCallDriver+0×31
b4052c64 805823d0 fdede8f8 83668758 87d4cdc8 nt!IopSynchronousServiceTail+0×70
b4052d00 8058a9d2 000000dc 00000000 00000000 nt!IopXxxControlFile+0×5ef
b4052d34 804df99f 000000dc 00000000 00000000 nt!NtDeviceIoControlFile+0×2a
b4052d34 7c93e4f4 000000dc 00000000 00000000 nt!KiFastCallEntry+0xfc
0012f75c 00000000 00000000 00000000 00000000 0×7c93e4f4
STACK_COMMAND: kb
FOLLOWUP_IP:
AAAAAA+498
f77ef498 0f22e0 mov cr4,eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: AAAAAA+498
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: AAAAAA
IMAGE_NAME: AAAAAA.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 49c71317
FAILURE_BUCKET_ID: 0×7f_d_AAAAAA+498
BUCKET_ID: 0×7f_d_AAAAAA+498
Followup: MachineOwner
———
EXCEPTION_GP_FAULT 가 발생했는데도 이상하게 .trap, .tss 을 보여주지 않습니다. EXCEPTION_GP_FAULT가 발생했을 때는 먼저 Trap Frame을 확보하는것이 가장 중요 합니다. 왜냐면 EXCEPTION_GP_FAULT이 발생하는 경우는 System Register와 관계 있는 경우 또는 Memory 처리 등과 관계되는 경우가 많기 때문에 Trap 이 발생한 정확한 위치 및 Register 값이 필요하기 때문입니다. 일단 Trap Frame을 확보하기 위해서 수동 Stack Trace를 해보겠습니다.
1: kd> !thread
THREAD 85466020 Cid 1348.0220 Teb: 7ffdf000 Win32Thread: ed351008 RUNNING on processor 1
IRP List:
83668758: (0006,0094) Flags: 00000070 Mdl: 00000000
Not impersonating
DeviceMap e1b187f0
Owning Process fd6cd5b8 Image: CKSetup32.exe
Attached Process N/A Image: N/A
Wait Start TickCount 1384396 Ticks: 0
Context Switch Count 427 LargeStack
UserTime 00:00:00.031
KernelTime 00:00:00.046
Win32 Start Address 0x0040990a
Start Address 0x7c8106f5
Stack Init b4053000 Current b4052bcc Base b4053000 Limit b404f000 Call 0
Priority 9 BasePriority 8 PriorityDecrement 0 DecrementCount 16
ChildEBP RetAddr Args to Child
b4052b60 f77ef498 badb0d00 f771b560 80703d43 nt!KiSystemFatalException+0xf (FPO: [0,0] TrapFrame @ b4052b60)
WARNING: Stack unwind information not available. Following frames may be wrong.
b4052bf8 f77efb15 00000001 00000004 00000000 AAAAAA+0×498
b4052c14 f77f56e1 83668758 87d4cdc8 87e4f3c8 AAAAAA+0xb15
b4052c2c 804e33d9 fdede8f8 83668700 80703410 AAAAAA+0×66e1
b4052c50 8057287c 836687c8 87d4cdc8 83668758 nt!IopfCallDriver+0×31 (FPO: [0,0,0])
b4052c64 805823d0 fdede8f8 83668758 87d4cdc8 nt!IopSynchronousServiceTail+0×70 (FPO: [7,0,4])
b4052d00 8058a9d2 000000dc 00000000 00000000 nt!IopXxxControlFile+0×5ef (FPO: [Non-Fpo])
b4052d34 804df99f 000000dc 00000000 00000000 nt!NtDeviceIoControlFile+0×2a (FPO: [10,0,0])
b4052d34 7c93e4f4 000000dc 00000000 00000000 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b4052d64)
0012f75c 00000000 00000000 00000000 00000000 0×7c93e4f4
dps b404f000 b4053000
... 생략
b4052b40 b4052b60
b4052b44 804e322c nt!KiSystemFatalException+0xf
b4052b48 0000007f
b4052b4c 0000000d
b4052b50 00000000
b4052b54 00000000
b4052b58 00000000
b4052b5c b4052b60
b4052b60 b4052bf8
b4052b64 f77ef498 AAAAAA+0×498
b4052b68 badb0d00
b4052b6c f771b560
b4052b70 80703d43 hal!HalpDispatchInterrupt+0xbb
b4052b74 b4052bf4
b4052b78 0000002c
b4052b7c 4e2fb5e7
b4052b80 5a6d154c
b4052b84 538c8da2
b4052b88 00000064
b4052b8c 804e3442 nt!KiInsertTimerTable+0×1b
b4052b90 fffe0000
b4052b94 ffff0023
b4052b98 5d330023
b4052b9c f771b560
b4052ba0 00000000
b4052ba4 000006d1
b4052ba8 804dbe25 nt!KiIpiSend+0×27
b4052bac b4052cf0
b4052bb0 00000030
b4052bb4 8a1bca8c
b4052bb8 00000093
b4052bbc f77f2800 AAAAAA+0×3800
b4052bc0 b4052bf8
… 생략
0023을 이용해서 Trap Frame을 발견했습니다. Trap Frame Search 를 위해서 0023을 사용하는 이유는 http://www.insidewindows.kr/?p=69 게시물을 참조하시면 됩니다.
1: kd> .trap b4052b98-0x38
ErrCode = 00000000
eax=000006d1 ebx=f77f2800 ecx=00000000 edx=f771b560 esi=00000093 edi=8a1bca8c
eip=f77ef498 esp=b4052bd4 ebp=b4052bf8 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
AAAAAA+0x498:
f77ef498 0f22e0 mov cr4,eax
1: kd> uf f77ef490
AAAAAA+0x490:
f77ef490 0f20e0 mov eax,cr4
f77ef493 25f7070000 and eax,7F7h
f77ef498 0f22e0 mov cr4,eax
f77ef49b b800040000 mov eax,400h
f77ef4a0 0f23f8 mov dr7,eax
f77ef4a3 b800000000 mov eax,0
f77ef4a8 0f23d8 mov dr3,eax
f77ef4ab 0f23d0 mov dr2,eax
f77ef4ae c3 ret
대략 CR4 Register의 Debugging Extensions를 Disable 해주는 보안 코드인것으로 생각 됩니다.
1: kd> .formats cr4
Hex: 000026d9
Decimal: 9945
Octal: 00000023331
Binary: 00000000 00000000 00100110 11011001
Chars: ..&.
Time: Thu Jan 01 11:45:45 1970
Float: low 1.39359e-041 high 0
Double: 4.91348e-320
1: kd> .formats eax
Evaluate expression:
Hex: 000006d1
Decimal: 1745
Octal: 00000003321
Binary: 00000000 00000000 00000110 11010001
Chars: ….
Time: Thu Jan 01 09:29:05 1970
Float: low 2.44527e-042 high 0
Double: 8.62145e-321
현재 CR4 Register의 값을 EAX의 값으로 변경하고자 하내요 그렇다면 변경되는 Flag를 체크해봐야 합니다.
00000000 00000000 00100110 11011001
00000000 00000000 00000110 11010001
두개의 Flag를 비교하면 2개의 Bit가 변경되는 것을 알수 있습니다. 3번 Bit는 변경을 원하는 DE( Debugging Extensions ) bit 이고 13번 Bit인 VME( Virtual-8086 Mode Extensions ) bit 입니다. 3번 Bit 이외에 변경 되는 13번 Bit를 유심히보면 이 Bugcheck의 해답이 보입니다.
VME bit에 관한 자료를 찾아 보면 VME Bit에 대해 자세히 알 수 있습니다. 간략히 설명하면 VME를 사용하고 있는 도중에 관련 Bit를 변경하게 되면 General Protection Fault가 발생하게 되는 거죠.
Enjoy Debugging
최근 답글