CString内部的内存访问冲突

Question

I am using one Windows application which parses certain binary file. The app is crashing (Read access violation) every time at a certain location.

I am trying to find out the root cause of the crash.

(f74.fac): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=02b74141 ebx=00000000 ecx=02760000 edx=00414141 esi=00000000 edi=01426fe4
eip=7c91081e esp=0012eb64 ebp=0012eb8c iopl=0         nv up ei ng nz na pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00010287
ntdll!RtlpImageNtHeader+0x35:
7c91081e 813850450000    cmp     dword ptr [eax],4550h ds:0023:02b74141=????????

At Crash Point:

0:000> u eip
ntdll!RtlpImageNtHeader+0x35:
7c91081e 813850450000    cmp     dword ptr [eax],4550h
7c910824 0f858b830200    jne     ntdll!RtlpImageNtHeader+0x3d (7c938bb5)
7c91082a 834dfcff        or      dword ptr [ebp-4],0FFFFFFFFh
7c91082e e8cfe5ffff      call    ntdll!_SEH_epilog (7c90ee02)
7c910833 c20400          ret     4
7c910836 90              nop
7c910837 90              nop
7c910838 ff              ???

Stack Trace :

0:000> kb
ChildEBP RetAddr  Args to Child              
0012eb8c 7c91708f 02760000 00000216 0012f3d0 ntdll!RtlpImageNtHeader+0x35
0012ee40 7c916042 02734da8 0012eeb8 00000000 ntdll!LdrpCheckForLoadedDll+0x4cd
0012f0fc 7c9162da 00000000 02734da8 0012f3f0 ntdll!LdrpLoadDll+0x1ba
0012f3a4 7c801bb9 02734da8 0012f3f0 0012f3d0 ntdll!LdrLoadDll+0x230
0012f40c 7c801d6e 7ffdec00 00000000 00000001 kernel32!LoadLibraryExW+0x18e
*** WARNING: Unable to verify checksum for image00400000
*** ERROR: Module load completed but symbols could not be loaded for image00400000
0012f420 00407b8c 017f3ed8 00000000 00000001 kernel32!LoadLibraryExA+0x1f
WARNING: Stack unwind information not available. Following frames may be wrong.
0012f4a4 7c80c710 73eae590 0012f49c 0012f558 image00400000+0x7b8c
0012f4c8 73dd4381 017f3ed8 017f3db8 00000047 kernel32!lstrlenA+0x3b
0012f528 73dd2263 0012f628 00000000 0012f4f0 MFC42!CString::CString+0x47
0012f538 73dd2725 017ef0ac 0012f628 00407846 MFC42!CFixedAlloc::Free+0x28
0012f544 00407846 0012f628 00000000 017ef158 MFC42!CString::~CString+0x1c
00000000 00000000 00000000 00000000 00000000 image00400000+0x7846

Not sure,But I'm guessing its a problem related to heap as CString uses heap allocation. So please suggest the possible cause for this crash. Please let me know if more information is needed.

Thanks in Advance,

Answer 1

Parsing binary file does not have valid MZ/PE headers. Binary base in ecx=02760000 is valid, in edx=00414141 must be an offset to the IMAGE_NT_HEADERS structure in bytes istead of 414141 'AAA'. You may see 00414141 using dd 02760000+3c L1 command. RtlpImageNtHeader adds 414141 to you Base and this is mast be PE signature. Show output from !address 02760000 , !dh 02760000 , !address 02b74141 I may assume that 02b74141 is not mapped at all.