查看 Windbg 中挂起进程的 eax 寄存器中入口点的地址

Question

对于32位系统上的32位进程， EAX寄存器保存入口点的地址。 但是对于这个线程，windbg 总是显示0 。

创建处于挂起状态的进程并执行

 .thread <thread_address>
 r

显示

eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=828b0c26 esp=8fe0ba04 ebp=8fe0ba48 iopl=0         nv up di pl nz na po nc
cs=0008  ss=0010  ds=0000  es=0000  fs=0000  gs=0000             efl=00000000
nt!KiSwapContext+0x26:
828b0c26 8b2c24          mov     ebp,dword ptr [esp]  ss:0010:8fe0ba04=8fe0ba48

在使用GetThreadContext()检查时，我得到EAX的当前值。

if (!CreateProcess("test.exe", nullptr, nullptr, nullptr, false, CREATE_SUSPENDED, nullptr, nullptr, &StartupInfo, &ProcessInfo))
{
    std::cout << "Failed to create process " << GetLastError();
    return 1;
}

CONTEXT Ctx;
Ctx.ContextFlags = CONTEXT_FULL;
GetThreadContext(ProcessInfo.hThread, &Ctx);
std::cout << Ctx.Eax << "\n"; //ImageBase + AddressOfEntryPoint

为什么windbg显示0而不是入口点的地址。

Answer 1

假设您在目标（虚拟机/物理机）中创建了如下所示的暂停进程
并且您使用内核调试器连接到该机器
并且您有适当的二进制文件的私有 pdb，您可以简单地要求 windbg 使用 ?? c ++表达式评估器

测试代码

#include <windows.h>
#include <stdio.h>

int main (void) 
{
    printf("lets Create a suspended process and look at it in kd\n");
    STARTUPINFO si ={0};
    PROCESS_INFORMATION pi ={0};
    si.cb = sizeof(si);
    char *cmdln = "c:\\windows\\system32\\calc.exe\0";
    if( !CreateProcess( NULL,cmdln,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&si,&pi ))
    {
        printf( "CreateProcess failed (%x).\n", GetLastError() );
        return 0;
    }
    CONTEXT ctx ={0};
    ctx.ContextFlags = CONTEXT_FULL;
    GetThreadContext(pi.hThread, &ctx);
    printf("Eax = %x\n",ctx.Eax);

    int ans = 'n';
    while (ans != 'y') 
    {
        Sleep(5000);
        ans = getchar();        
    }
    printf("resuming the process\n");
    ResumeThread(pi.hThread);    
    WaitForSingleObject( pi.hProcess, INFINITE );
    printf("wait returned closing handles\n");
    CloseHandle( pi.hProcess );
    CloseHandle( pi.hThread );
}

编译了一个链接

cl /Zi /W4 /analyze /Od /EHsc cpsusp.cpp /link /release

将编译后的可执行文件复制到运行 32 位 win7sp1 的虚拟机并双击它执行打印 eax 并等待按键

在连接到这个 vm 的 kd 中，你可以找到 eax 的这个实际值

kd> !process 0 2 cpsusp.exe  <<< find the DirectoryBase and Threads of Process one is interested in 

PROCESS 841cad40  SessionId: 1  Cid: 0110    Peb: 7ffd5000  ParentCid: 008c
    DirBase: 0f90a000  ObjectTable: 95d5d210  HandleCount:  12.
    Image: cpsusp.exe

        THREAD 841b8d48  Cid 0110.0644  Teb: 7ffdf000 Win32Thread: 00000000 WAIT:
 (WrLpcReply) UserMode Non-Alertable
            841b8f7c  Semaphore Limit 0x1

kd> .thread /p /r /P 841b8d48    << setting the thread context (just .thread isn't enough
Implicit thread is now 841b8d48    Implicit process is now 841cad40
.cache forcedecodeptes done
kd> kb
  *** Stack trace for last set context - .thread/.cxr resets it
 # ChildEBP RetAddr  Args to Child              
00 8ce3bae8 8285bd75 841b8d48 82925f08 82922d20 nt!KiSwapContext+0x26
XXXXXXXXXXXXXXXXXX snipped off irrelevent stack 
16 0015f8e0 013d13d4 00000001 002cfe60 002d0bd8 cpsusp!main+0x114 [e:\code\cpsusp\cpsusp.cpp @ 25] 
YYYYYYYYYYYYY  snipped of iirelevent stack 
1b 0015f98c 00000000 013d14b9 7ffd5000 00000000 ntdll!_RtlUserThreadStart+0x1b

kd> .frame /r /c 0x16   <<<< seeting the frame and forcing to retrieve the actual volatile registers
16 0015f8e0 013d13d4 cpsusp!main+0x114 [e:\code\cpsusp\cpsusp.cpp @ 25]
cpsusp!main+0x114:
001b:013d1114 89852cfdffff    mov     dword ptr [ebp-2D4h],eax
kd> dv
            ctx = struct _CONTEXT   <<<<<<<<<
          cmdln = 0x014101d8 "c:\windows\system32\calc.exe"
             pi = struct _PROCESS_INFORMATION
            ans = 0n110
             si = struct _STARTUPINFOA
kd> ?? ctx.Eax  <<<<<<
unsigned long 0x212d6c   <<<< this is the value you got printed in the remote machine