尝试使用WinDBG预览版Windows 11调试LoadLibraryExW

人气:982 发布:2022-10-16 标签: winapi windbg

问题描述

我想弄清楚为什么添加到路径AddDllDirectory()而不是退出进程路径不会让我加载VBA函数中使用的DLL。所以我想知道LoadLibraryExW()的第三个参数是什么。

第一个问题是我正确加载了符号。我的符号服务器缓存中全是PDB文件。但是,找不到kernelbase.dll的符号。

进程监视器显示堆栈跟踪,但不显示符号。

我在WinDbgPview中为kernelbase!LoadLibraryExW设置了断点,但我不确定如何读取堆栈跟踪。在本例中,这些十六进制值之一是否应该是第三个参数?或者,当我想要堆栈时,这是从寄存器中获得的吗?

 # Child-SP          RetAddr               : Args to Child                                                           : Call Site
00 00000051`184fe648 00007ffe`e30b5ae5     : 00007ffe`e3431380 00000000`00000060 00000051`184feac0 00000000`00000008 : KERNELBASE!LoadLibraryExW
01 00000051`184fe650 00007ffe`e30b5a45     : 00000051`184fe704 1103aa3e`00000001 00000000`00000008 00000000`00000007 : mso20win32client!Ordinal104+0x295
02 00000051`184fe690 00007ffe`e3090bb1     : 000001df`179f4860 00000000`02000000 00000000`00000008 00000000`00000000 : mso20win32client!Ordinal104+0x1f5
03 00000051`184fe6d0 00007ffe`e3091c11     : 00000051`184feb10 000001df`179f4860 00000000`00000000 00000051`184feaf0 : mso20win32client!Ordinal67+0x1f71
04 00000051`184fea50 00007ffe`d808e62a     : 000001df`179f4860 00007ffe`d9c34730 000001df`17f7b1c0 00000000`00000000 : mso20win32client!Ordinal1818+0x8c1
05 00000051`184fead0 00007ffe`d808f3c3     : 000001df`179f4860 00007ffe`d9c34730 000001df`17f7b1c0 00007ffe`d9c33a10 : mso!Ordinal2534+0x51a
06 00000051`184feb10 00007ffe`d808f347     : 000001df`182fb2c0 000001df`00000001 000001df`182fb2c0 00000000`00000000 : mso!Ordinal2534+0x12b3
07 00000051`184feb50 00007ffe`d8153c24     : 000001df`182fb2c0 00000000`00000000 000001df`17f7b1c0 000001df`17f7b1c0 : mso!Ordinal2534+0x1237
08 00000051`184feb80 00007ffe`d80b1c8e     : 00000051`184ff290 00000000`0001d4c0 000001df`17ed3700 00000051`184ff360 : mso!Ordinal1436+0x16b4
09 00000051`184ff0d0 00007ffe`d80b1925     : 000001df`12529600 00000000`00000000 000001df`17ca9430 000001df`12529600 : mso!Ordinal921+0xe6e
0a 00000051`184ff340 00007ffe`e2fe3c3c     : 00000051`184ff488 00000051`184ff440 00000000`00000000 00000000`00000000 : mso!Ordinal921+0xb05
0b 00000051`184ff3d0 00007ffe`e2fe413b     : 000001df`01849818 00000000`00000000 000001df`01849800 00000000`00000144 : mso20win32client!Ordinal1756+0xbc
0c 00000051`184ff460 00007ffe`e2fe3c3c     : 000001df`11d96b90 000001df`17823c68 000001df`17ca9430 00007fff`88aa7551 : mso20win32client!Ordinal1756+0x5bb
0d 00000051`184ff4f0 00007ffe`e311741d     : 000001df`1284a6a0 00000000`00000000 00000051`184ff790 00000000`00000000 : mso20win32client!Ordinal1756+0xbc
0e 00000051`184ff580 00007ffe`e3050e6e     : 000001df`1284a6a0 00000000`00000000 000001df`1284a601 000001df`01a18f80 : mso20win32client!Ordinal1700+0x28d
0f 00000051`184ff5b0 00007ffe`e3051ed5     : 00000051`184ff710 000001df`1284a6a0 000001df`01a18f80 000001df`1284a6a0 : mso20win32client!Ordinal347+0x23e
10 00000051`184ff610 00007ffe`e305c2d6     : 000001df`017c9470 00000000`00000000 000001df`017c9470 00000000`00000000 : mso20win32client!Ordinal1966+0x6e5
11 00000051`184ff770 00007fff`873854e0     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : mso20win32client!Ordinal2633+0x686
12 00000051`184ff7e0 00007fff`88a8485b     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x10
13 00000051`184ff810 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x2b

有没有办法获得kernlbase.pdb?它是否适用于较旧版本的Windows?我可以使用WinDbg命令来读取参数吗?

推荐答案

这本来是一个评论,但在回答时变得越来越多

有时您下载了一半的PDB或中止了下载 在这种情况下,可能很明显没有下载符号文件

中止的下载具有.error扩展名

检查您是否有此类文件并将其删除以正确重新下载PDB。

   f:symbols>set _NT_
    _NT_SYMBOL_PATH=srv*f:symbols*https://msdl.microsoft.com/download/symbols
    
    f:symbols>dir /s /b *.error
    f:symbolswindows.ui.xaml.pdb7349BE8DF456ACFBEE7774E6197449541downloadDA83A900E9B74A20B6A95465B35021C5.error

如果您的平台是x64,如上文所述 前四个参数通过Windows上的RCX、RDX、R8和R9传递

任意二进制文件上的LoadLibraryExW中断

0:000> k4
Child-SP          RetAddr           Call Site
000000a4`6013eda8 00007ffb`f5df62f1 KERNELBASE!LoadLibraryExW
000000a4`6013edb0 00007ffb`f5df6449 ucrtbase!try_get_function+0xa9
000000a4`6013ee00 00007ffb`f5df5e80 ucrtbase!_vcrt_FlsAlloc+0x25
000000a4`6013ee30 00007ffb`f5df5cb9 ucrtbase!_vcrt_initialize_ptd+0x10
0:000> r rcx,rdx,r8,r9
rcx=00007ffbf5e778a0 rdx=0000000000000000 r8=0000000000000800 r9=00007ffbf5e75a70
0:000> du @rcx
00007ffb`f5e778a0  "api-ms-win-core-fibers-l1-1-1"
0:000> ? @r8
Evaluate expression: 2048 = 00000000`00000800
0:000> .shell -ci ".echo looking for 0x800" pss LOAD_.*0x00000800 "c:Program Files (x86)Windows Kits10Include10.0.17763.0umlibloaderapi.h"
c:Program Files (x86)Windows Kits10Include10.0.17763.0umlibloaderapi.h:409:#define LOAD_LIBRARY_SEARCH_SYSTEM32        0x00000800
.shell: Process exited
0:000>  

编辑

LoadLibrary Api采用多种格式的输入字符串

内核之类的裸名 扩展名为kernel.dll的名称 相对路径和绝对路径 像foo.dll和BAR.Dll这样的小写和大写

因此,与内置脚本和$spat运算符相比,字符串是一个皮塔

尝试编写如下所示的脚本以缓解痛苦(仅测试一次)

/// <reference path="JSProvider.d.ts" />
"use strict";
var prevlibs =[];
function libname() {    
    var addr = host.currentThread.Registers.User.rcx;
    var libstr = host.memory.readWideString(addr).toLowerCase()
    var cond = libstr.includes("imm32.dll");
    if (cond) {
        host.diagnostics.debugLog("breaking
");
    }
    else {
        prevlibs.push(libstr);
        host.namespace.Debugger.Utility.Control.ExecuteCommand("gc");
    }
    return prevlibs;
}

用法和结果如下:imm32用于显示大小写和abs路径输入

0:000> .scriptload f:wdscrlibname.js
JavaScript script successfully loaded from 'f:wdscrlibname.js'
0:000> bp KERNELBASE!LoadLibraryExW "dx @$scriptContents.libname()"
0:000> g
KERNELBASE!LoadLibraryExW:
00007ffb`f60ee840 4055            push    rbp
0:000> du @rcx
0000006d`3f56e8f0  "C:WINDOWSsystem32IMM32.DLL"
0:000> dx @$scriptContents.libname()
breaking
@$scriptContents.libname() : api-ms-win-core-synch-l1-2-0,api-ms-win-core-fibers-l1-1-1,api-ms-win-core-fibers-l1-1-1,api-ms-win-core-synch-l1-2-0,api-ms-win-core-localization-l1-2-1,kernel32,api-ms-win-core-string-l1-1-0,api-ms-win-core-datetime-l1-1-1,api-ms-win-core-localization-obsolete-l1-2-0,api-ms-win-core-file-l1-2-1.dll,api-ms-win-eventing-provider-l1-1-0.dll,ole32.dll
    length           : 0xc
    [0x0]            : api-ms-win-core-synch-l1-2-0
    [0x1]            : api-ms-win-core-fibers-l1-1-1
    [0x2]            : api-ms-win-core-fibers-l1-1-1
    [0x3]            : api-ms-win-core-synch-l1-2-0
    [0x4]            : api-ms-win-core-localization-l1-2-1
    [0x5]            : kernel32
    [0x6]            : api-ms-win-core-string-l1-1-0
    [0x7]            : api-ms-win-core-datetime-l1-1-1
    [0x8]            : api-ms-win-core-localization-obsolete-l1-2-0
    [0x9]            : api-ms-win-core-file-l1-2-1.dll
    [0xa]            : api-ms-win-eventing-provider-l1-1-0.dll
    [0xb]            : ole32.dll
0:000>  

340