问题描述
我想弄清楚为什么添加到路径AddDllDirectory()
而不是退出进程路径不会让我加载VBA函数中使用的DLL。所以我想知道LoadLibraryExW()
的第三个参数是什么。
第一个问题是我正确加载了符号。我的符号服务器缓存中全是PDB文件。但是,找不到kernelbase.dll的符号。
进程监视器显示堆栈跟踪,但不显示符号。
我在WinDbgPview中为kernelbase!LoadLibraryExW
设置了断点,但我不确定如何读取堆栈跟踪。在本例中,这些十六进制值之一是否应该是第三个参数?或者,当我想要堆栈时,这是从寄存器中获得的吗?
# Child-SP RetAddr : Args to Child : Call Site
00 00000051`184fe648 00007ffe`e30b5ae5 : 00007ffe`e3431380 00000000`00000060 00000051`184feac0 00000000`00000008 : KERNELBASE!LoadLibraryExW
01 00000051`184fe650 00007ffe`e30b5a45 : 00000051`184fe704 1103aa3e`00000001 00000000`00000008 00000000`00000007 : mso20win32client!Ordinal104+0x295
02 00000051`184fe690 00007ffe`e3090bb1 : 000001df`179f4860 00000000`02000000 00000000`00000008 00000000`00000000 : mso20win32client!Ordinal104+0x1f5
03 00000051`184fe6d0 00007ffe`e3091c11 : 00000051`184feb10 000001df`179f4860 00000000`00000000 00000051`184feaf0 : mso20win32client!Ordinal67+0x1f71
04 00000051`184fea50 00007ffe`d808e62a : 000001df`179f4860 00007ffe`d9c34730 000001df`17f7b1c0 00000000`00000000 : mso20win32client!Ordinal1818+0x8c1
05 00000051`184fead0 00007ffe`d808f3c3 : 000001df`179f4860 00007ffe`d9c34730 000001df`17f7b1c0 00007ffe`d9c33a10 : mso!Ordinal2534+0x51a
06 00000051`184feb10 00007ffe`d808f347 : 000001df`182fb2c0 000001df`00000001 000001df`182fb2c0 00000000`00000000 : mso!Ordinal2534+0x12b3
07 00000051`184feb50 00007ffe`d8153c24 : 000001df`182fb2c0 00000000`00000000 000001df`17f7b1c0 000001df`17f7b1c0 : mso!Ordinal2534+0x1237
08 00000051`184feb80 00007ffe`d80b1c8e : 00000051`184ff290 00000000`0001d4c0 000001df`17ed3700 00000051`184ff360 : mso!Ordinal1436+0x16b4
09 00000051`184ff0d0 00007ffe`d80b1925 : 000001df`12529600 00000000`00000000 000001df`17ca9430 000001df`12529600 : mso!Ordinal921+0xe6e
0a 00000051`184ff340 00007ffe`e2fe3c3c : 00000051`184ff488 00000051`184ff440 00000000`00000000 00000000`00000000 : mso!Ordinal921+0xb05
0b 00000051`184ff3d0 00007ffe`e2fe413b : 000001df`01849818 00000000`00000000 000001df`01849800 00000000`00000144 : mso20win32client!Ordinal1756+0xbc
0c 00000051`184ff460 00007ffe`e2fe3c3c : 000001df`11d96b90 000001df`17823c68 000001df`17ca9430 00007fff`88aa7551 : mso20win32client!Ordinal1756+0x5bb
0d 00000051`184ff4f0 00007ffe`e311741d : 000001df`1284a6a0 00000000`00000000 00000051`184ff790 00000000`00000000 : mso20win32client!Ordinal1756+0xbc
0e 00000051`184ff580 00007ffe`e3050e6e : 000001df`1284a6a0 00000000`00000000 000001df`1284a601 000001df`01a18f80 : mso20win32client!Ordinal1700+0x28d
0f 00000051`184ff5b0 00007ffe`e3051ed5 : 00000051`184ff710 000001df`1284a6a0 000001df`01a18f80 000001df`1284a6a0 : mso20win32client!Ordinal347+0x23e
10 00000051`184ff610 00007ffe`e305c2d6 : 000001df`017c9470 00000000`00000000 000001df`017c9470 00000000`00000000 : mso20win32client!Ordinal1966+0x6e5
11 00000051`184ff770 00007fff`873854e0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : mso20win32client!Ordinal2633+0x686
12 00000051`184ff7e0 00007fff`88a8485b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x10
13 00000051`184ff810 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x2b
有没有办法获得kernlbase.pdb?它是否适用于较旧版本的Windows?我可以使用WinDbg命令来读取参数吗?
推荐答案
这本来是一个评论,但在回答时变得越来越多
有时您下载了一半的PDB或中止了下载 在这种情况下,可能很明显没有下载符号文件中止的下载具有.error扩展名
检查您是否有此类文件并将其删除以正确重新下载PDB。
f:symbols>set _NT_
_NT_SYMBOL_PATH=srv*f:symbols*https://msdl.microsoft.com/download/symbols
f:symbols>dir /s /b *.error
f:symbolswindows.ui.xaml.pdb7349BE8DF456ACFBEE7774E6197449541downloadDA83A900E9B74A20B6A95465B35021C5.error
如果您的平台是x64,如上文所述 前四个参数通过Windows上的RCX、RDX、R8和R9传递
任意二进制文件上的LoadLibraryExW中断
0:000> k4
Child-SP RetAddr Call Site
000000a4`6013eda8 00007ffb`f5df62f1 KERNELBASE!LoadLibraryExW
000000a4`6013edb0 00007ffb`f5df6449 ucrtbase!try_get_function+0xa9
000000a4`6013ee00 00007ffb`f5df5e80 ucrtbase!_vcrt_FlsAlloc+0x25
000000a4`6013ee30 00007ffb`f5df5cb9 ucrtbase!_vcrt_initialize_ptd+0x10
0:000> r rcx,rdx,r8,r9
rcx=00007ffbf5e778a0 rdx=0000000000000000 r8=0000000000000800 r9=00007ffbf5e75a70
0:000> du @rcx
00007ffb`f5e778a0 "api-ms-win-core-fibers-l1-1-1"
0:000> ? @r8
Evaluate expression: 2048 = 00000000`00000800
0:000> .shell -ci ".echo looking for 0x800" pss LOAD_.*0x00000800 "c:Program Files (x86)Windows Kits10Include10.0.17763.0umlibloaderapi.h"
c:Program Files (x86)Windows Kits10Include10.0.17763.0umlibloaderapi.h:409:#define LOAD_LIBRARY_SEARCH_SYSTEM32 0x00000800
.shell: Process exited
0:000>
编辑
LoadLibrary Api采用多种格式的输入字符串
内核之类的裸名 扩展名为kernel.dll的名称 相对路径和绝对路径 像foo.dll和BAR.Dll这样的小写和大写因此,与内置脚本和$spat运算符相比,字符串是一个皮塔
尝试编写如下所示的脚本以缓解痛苦(仅测试一次)
/// <reference path="JSProvider.d.ts" />
"use strict";
var prevlibs =[];
function libname() {
var addr = host.currentThread.Registers.User.rcx;
var libstr = host.memory.readWideString(addr).toLowerCase()
var cond = libstr.includes("imm32.dll");
if (cond) {
host.diagnostics.debugLog("breaking
");
}
else {
prevlibs.push(libstr);
host.namespace.Debugger.Utility.Control.ExecuteCommand("gc");
}
return prevlibs;
}
用法和结果如下:imm32用于显示大小写和abs路径输入
0:000> .scriptload f:wdscrlibname.js
JavaScript script successfully loaded from 'f:wdscrlibname.js'
0:000> bp KERNELBASE!LoadLibraryExW "dx @$scriptContents.libname()"
0:000> g
KERNELBASE!LoadLibraryExW:
00007ffb`f60ee840 4055 push rbp
0:000> du @rcx
0000006d`3f56e8f0 "C:WINDOWSsystem32IMM32.DLL"
0:000> dx @$scriptContents.libname()
breaking
@$scriptContents.libname() : api-ms-win-core-synch-l1-2-0,api-ms-win-core-fibers-l1-1-1,api-ms-win-core-fibers-l1-1-1,api-ms-win-core-synch-l1-2-0,api-ms-win-core-localization-l1-2-1,kernel32,api-ms-win-core-string-l1-1-0,api-ms-win-core-datetime-l1-1-1,api-ms-win-core-localization-obsolete-l1-2-0,api-ms-win-core-file-l1-2-1.dll,api-ms-win-eventing-provider-l1-1-0.dll,ole32.dll
length : 0xc
[0x0] : api-ms-win-core-synch-l1-2-0
[0x1] : api-ms-win-core-fibers-l1-1-1
[0x2] : api-ms-win-core-fibers-l1-1-1
[0x3] : api-ms-win-core-synch-l1-2-0
[0x4] : api-ms-win-core-localization-l1-2-1
[0x5] : kernel32
[0x6] : api-ms-win-core-string-l1-1-0
[0x7] : api-ms-win-core-datetime-l1-1-1
[0x8] : api-ms-win-core-localization-obsolete-l1-2-0
[0x9] : api-ms-win-core-file-l1-2-1.dll
[0xa] : api-ms-win-eventing-provider-l1-1-0.dll
[0xb] : ole32.dll
0:000>