-
-
[求助]关于windbg BA 条件断点的问题
-
发表于: 2010-8-8 01:13
-
问题是这样的。当我.process一个进程的时候ba e1 ws2_32!send函数。并且有条件判断。输出内容。请看如下：
kd> !process 0 0 msmsgs.exe
PROCESS 81d0c3e8 SessionId: 0 Cid: 03c4 Peb: 7ffd4000 ParentCid: 00a4
DirBase: 07e402a0 ObjectTable: e1afbab0 HandleCount: 232.
Image: msmsgs.exe
kd> .process /r /p 81d0c3e8
Implicit process is now 81d0c3e8
.cache forcedecodeuser done
Loading User Symbols
.............................................................
kd> ba e1 ws2_32!send ".if (poi(esp+0c)=0x00000013){.printf \"[1111]\";} .else {.printf \"[2222]\";}"
kd> g
[2222]WS2_32!send: //这里断下来是else 输出2222
001b:71a2428a 8bff mov edi,edi
kd> kb
ChildEBP RetAddr Args to Child
0007f118 0106eef4 000003e4 0007f184 00000012 WS2_32!send
0007f148 010fe924 00000012 0007f184 00000001 msmsgs!CNetConnection::SendData+0xa4
0007f164 010ff04e 00000012 0007f184 00000001 msmsgs!CVirtualConn::SendData+0x21
0007f99c 010f9c00 20524556 0000000c 0007f9c8 msmsgs!CMNSConnection::SendNetMsg+0xc8
0007f9e4 0106d9f4 00000004 00000007 0123d014 msmsgs!CMNSNet::OnVirtualStateChanged+0xf5
0007f9fc 0106db40 00000007 0123d014 0123d008 msmsgs!CNetConnection::ChangeState+0x1f
0007fd6c 0106f0b6 0123d014 0123d008 00000000 msmsgs!CNetConnection::OnSocketConnect+0x134
0007fd84 010fdac0 0000042a 00000000 00000000 msmsgs!CNetConnection::OnMessage+0x51
0007fda4 01075037 0000042a 00000000 00000000 msmsgs!CVirtualConn::OnMessage+0x54
0007fdb8 77d18724 00040196 0000042a 00000000 msmsgs!CMsgrWndBase::WndProc+0x2c
0007fde4 77d18806 0107500b 00040196 0000042a USER32!InternalCallWinProc+0x28
0007fe4c 77d189bd 00000000 0107500b 00040196 USER32!UserCallWinProcCheckWow+0x150
0007feac 77d18a00 0007fed4 00000000 0007fef0 USER32!DispatchMessageWorker+0x306
0007febc 01035516 0007fed4 00000000 00000000 USER32!DispatchMessageW+0xf
0007fef0 0103598d 7c80b6c1 00033f80 0007ff18 msmsgs!CMessengerModule::RunMessageLoop+0x4e
0007ff00 01035a69 00000000 0103fbe7 000a2338 msmsgs!ATL::CAtlExeModuleT<CMessengerModule>::Run+0x1e
0007ff08 0103fbe7 000a2338 00000001 0007ffc0 msmsgs!RunMessageLoop+0xc
0007ff18 010400aa 0105eea4 01000000 00000000 msmsgs!CMSBLApp::main+0x48
0007ff1c 0105eea4 01000000 00000000 000a2338 msmsgs!WinMain+0x19
0007ffc0 7c816ff7 00360033 00360036 7ffd4000 msmsgs!WinMainCRTStartup+0x174
kd> g
//下面也断下来了。很奇怪。我的.if条件好象没效果了。
Single step exception - code 80000004 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
WS2_32!send:
001b:71a2428a 8bff mov edi,edi
kd> kb
ChildEBP RetAddr Args to Child
0007f1b0 0106eef4 000003e4 0007f21c 00000051 WS2_32!send
0007f1e0 010fe924 00000051 0007f21c 00000001 msmsgs!CNetConnection::SendData+0xa4
0007f1fc 010ff04e 00000051 0007f21c 00000001 msmsgs!CVirtualConn::SendData+0x21
0007fa34 010fa1bc 20525643 0000004b 01235778 msmsgs!CMNSConnection::SendNetMsg+0xc8
0007fcb8 010fa221 01243e94 0007fcd8 01027dac msmsgs!CMNSNet::RequestVersion+0x166
0007fce4 010fc524 01243e94 0000000d 0123d008 msmsgs!CMNSNet::RequestClientVersion+0x44
0007fcfc 010fd49c 00000000 0000000d 012434fb msmsgs!CMNSNet::OnServerVER+0xd0
0007fd10 010ff25c 0000000b 01231a70 00000000 msmsgs!CMNSNet::OnNetMsg+0x720
0007fd38 010ff33d 00000001 0123d008 00000000 msmsgs!CMNSConnection::CheckForNetMsgs+0xf5
0007fd54 0106f05a 0123d014 0123d008 0007fd84 msmsgs!CMNSConnection::OnSocketRead+0x95
0007fd64 0106f0f3 000003e4 00000001 0123d014 msmsgs!CNetConnection::OnWinsockSelectMessage+0xa0
0007fd84 010fdac0 00000428 000003e4 00000001 msmsgs!CNetConnection::OnMessage+0x8e
0007fda4 01075037 00000428 000003e4 00000001 msmsgs!CVirtualConn::OnMessage+0x54
0007fdb8 77d18724 00040196 00000428 000003e4 msmsgs!CMsgrWndBase::WndProc+0x2c
0007fde4 77d18806 0107500b 00040196 00000428 USER32!InternalCallWinProc+0x28
0007fe4c 77d189bd 00000000 0107500b 00040196 USER32!UserCallWinProcCheckWow+0x150
0007feac 77d18a00 0007fed4 00000000 0007fef0 USER32!DispatchMessageWorker+0x306
0007febc 01035516 0007fed4 00000000 00000000 USER32!DispatchMessageW+0xf
0007fef0 0103598d 7c80b6c1 00033f80 0007ff18 msmsgs!CMessengerModule::RunMessageLoop+0x4e
0007ff00 01035a69 00000000 0103fbe7 000a2338 msmsgs!ATL::CAtlExeModuleT<CMessengerModule>::Run+0x1e
kd> g
//这里也没效果
Single step exception - code 80000004 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
WS2_32!send:
001b:71a2428a 8bff mov edi,edi
kd> kb
ChildEBP RetAddr Args to Child
0007f414 0106eef4 000003e4 0007f480 00000020 WS2_32!send
0007f444 010fe924 00000020 0007f480 00000001 msmsgs!CNetConnection::SendData+0xa4
0007f460 010ff04e 00000020 0007f480 00000001 msmsgs!CVirtualConn::SendData+0x21
0007fc98 010fa9bd 20525355 0000001a 01231b28 msmsgs!CMNSConnection::SendNetMsg+0xc8
0007fccc 010fb8ce 00000000 0000006e 0123d008 msmsgs!CMNSNet::StartAuthentication+0x91
0007fcfc 010fd51c 01231a9c 0000006e 0124355c msmsgs!CMNSNet::OnServerCVR+0x67
0007fd10 010ff25c 0000006c 01231a98 00000000 msmsgs!CMNSNet::OnNetMsg+0x7a0
0007fd38 010ff33d 00000001 0123d008 00000000 msmsgs!CMNSConnection::CheckForNetMsgs+0xf5
0007fd54 0106f05a 0123d014 0123d008 0007fd84 msmsgs!CMNSConnection::OnSocketRead+0x95
0007fd64 0106f0f3 000003e4 00000001 0123d014 msmsgs!CNetConnection::OnWinsockSelectMessage+0xa0
0007fd84 010fdac0 00000428 000003e4 00000001 msmsgs!CNetConnection::OnMessage+0x8e
0007fda4 01075037 00000428 000003e4 00000001 msmsgs!CVirtualConn::OnMessage+0x54
0007fdb8 77d18724 00040196 00000428 000003e4 msmsgs!CMsgrWndBase::WndProc+0x2c
0007fde4 77d18806 0107500b 00040196 00000428 USER32!InternalCallWinProc+0x28
0007fe4c 77d189bd 00000000 0107500b 00040196 USER32!UserCallWinProcCheckWow+0x150
0007feac 77d18a00 0007fed4 00000000 0007fef0 USER32!DispatchMessageWorker+0x306
0007febc 01035516 0007fed4 00000000 00000000 USER32!DispatchMessageW+0xf
0007fef0 0103598d 7c80b6c1 00033f80 0007ff18 msmsgs!CMessengerModule::RunMessageLoop+0x4e
0007ff00 01035a69 00000000 0103fbe7 000a2338 msmsgs!ATL::CAtlExeModuleT<CMessengerModule>::Run+0x1e
0007ff08 0103fbe7 000a2338 00000001 0007ffc0 msmsgs!RunMessageLoop+0xc
kd> g
//同样没效果
Single step exception - code 80000004 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
WS2_32!send:
001b:71a2428a 8bff mov edi,edi
kd> g
Single step exception - code 80000004 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
WS2_32!send:
001b:71a2428a 8bff mov edi,edi
kd> g
Single step exception - code 80000004 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
WS2_32!send:
001b:71a2428a 8bff mov edi,edi
kd> g
//而这里就有效果了。
[2222]WS2_32!send:
001b:71a2428a 8bff mov edi,edi
kd> kb
ChildEBP RetAddr Args to Child
01f1fbe4 766a8192 00000410 7670cb8c 00000001 WS2_32!send
01f1fc00 766a8153 0010ecf0 000b0b48 000493e0 WININET!ICAsyncThread::InterruptSelect+0x3a
01f1fc14 766a8107 000b0b48 01f1fc40 7668d434 WININET!ICAsyncThread::QueueSocketWorkItem+0x3a
01f1fc20 7668d434 000b0b48 000004b0 0010ecf0 WININET!QueueSocketWorkItem+0x28
01f1fc40 7668d202 000b0b48 01f1fc64 7668cb44 WININET!ICSocket::Connect_Start+0x2bc
01f1fc4c 7668cb44 000b0b48 00000000 00000000 WININET!CFsm_SocketConnect::RunSM+0x42
01f1fc64 7668caf2 00105a10 00000000 00000000 WININET!CFsm::Run+0x39
01f1fc7c 7668d1d7 000b0b48 00110ea0 01f1fcac WININET!DoFsm+0x25
01f1fc8c 766d2e46 000493e0 00000005 00000060 WININET!ICSocket::Connect+0x32
01f1fcac 766d2ef3 00110ea0 01f1fcd0 7668cb44 WININET!ICSecureSocket::Connect_Fsm+0x43
01f1fcb8 7668cb44 00110ea0 00110c98 00000000 WININET!CFsm_SecureConnect::RunSM+0x2e
01f1fcd0 7668caf2 00105a10 00000000 00000000 WININET!CFsm::Run+0x39
01f1fce8 766d2f74 00110ea0 00108500 01f1fd38 WININET!DoFsm+0x25
01f1fcf8 7668d6b2 000493e0 00000005 00000060 WININET!ICSecureSocket::Connect+0x32
01f1fd38 7668d477 00110c98 01f1fd5c 7668cb44 WININET!HTTP_REQUEST_HANDLE_OBJECT::OpenConnection_Fsm+0x391
01f1fd44 7668cb44 00110c98 00000000 00000000 WININET!CFsm_OpenConnection::RunSM+0x33
01f1fd5c 7668caf2 00105a10 00000000 00000000 WININET!CFsm::Run+0x39
01f1fd74 7668d9b0 00110c98 00108500 01f1fdac WININET!DoFsm+0x25
01f1fd84 7668d948 00000000 00000000 00105a10 WININET!HTTP_REQUEST_HANDLE_OBJECT::OpenConnection+0x2f
01f1fdac 7668d8c1 00108bb0 01f1fdd0 7668cb44 WININET!HTTP_REQUEST_HANDLE_OBJECT::MakeConnection_Fsm+0x87
由于刚刚开始使用windbg。不太熟悉。猜测是不是ba对于某个线程下的断点？
请大虾们指教。如果不是。那么为什么.if没有效果呢？
kd> !process 0 0 msmsgs.exe
PROCESS 81d0c3e8 SessionId: 0 Cid: 03c4 Peb: 7ffd4000 ParentCid: 00a4
DirBase: 07e402a0 ObjectTable: e1afbab0 HandleCount: 232.
Image: msmsgs.exe
kd> .process /r /p 81d0c3e8
Implicit process is now 81d0c3e8
.cache forcedecodeuser done
Loading User Symbols
.............................................................
kd> ba e1 ws2_32!send ".if (poi(esp+0c)=0x00000013){.printf \"[1111]\";} .else {.printf \"[2222]\";}"
kd> g
[2222]WS2_32!send: //这里断下来是else 输出2222
001b:71a2428a 8bff mov edi,edi
kd> kb
ChildEBP RetAddr Args to Child
0007f118 0106eef4 000003e4 0007f184 00000012 WS2_32!send
0007f148 010fe924 00000012 0007f184 00000001 msmsgs!CNetConnection::SendData+0xa4
0007f164 010ff04e 00000012 0007f184 00000001 msmsgs!CVirtualConn::SendData+0x21
0007f99c 010f9c00 20524556 0000000c 0007f9c8 msmsgs!CMNSConnection::SendNetMsg+0xc8
0007f9e4 0106d9f4 00000004 00000007 0123d014 msmsgs!CMNSNet::OnVirtualStateChanged+0xf5
0007f9fc 0106db40 00000007 0123d014 0123d008 msmsgs!CNetConnection::ChangeState+0x1f
0007fd6c 0106f0b6 0123d014 0123d008 00000000 msmsgs!CNetConnection::OnSocketConnect+0x134
0007fd84 010fdac0 0000042a 00000000 00000000 msmsgs!CNetConnection::OnMessage+0x51
0007fda4 01075037 0000042a 00000000 00000000 msmsgs!CVirtualConn::OnMessage+0x54
0007fdb8 77d18724 00040196 0000042a 00000000 msmsgs!CMsgrWndBase::WndProc+0x2c
0007fde4 77d18806 0107500b 00040196 0000042a USER32!InternalCallWinProc+0x28
0007fe4c 77d189bd 00000000 0107500b 00040196 USER32!UserCallWinProcCheckWow+0x150
0007feac 77d18a00 0007fed4 00000000 0007fef0 USER32!DispatchMessageWorker+0x306
0007febc 01035516 0007fed4 00000000 00000000 USER32!DispatchMessageW+0xf
0007fef0 0103598d 7c80b6c1 00033f80 0007ff18 msmsgs!CMessengerModule::RunMessageLoop+0x4e
0007ff00 01035a69 00000000 0103fbe7 000a2338 msmsgs!ATL::CAtlExeModuleT<CMessengerModule>::Run+0x1e
0007ff08 0103fbe7 000a2338 00000001 0007ffc0 msmsgs!RunMessageLoop+0xc
0007ff18 010400aa 0105eea4 01000000 00000000 msmsgs!CMSBLApp::main+0x48
0007ff1c 0105eea4 01000000 00000000 000a2338 msmsgs!WinMain+0x19
0007ffc0 7c816ff7 00360033 00360036 7ffd4000 msmsgs!WinMainCRTStartup+0x174
kd> g
//下面也断下来了。很奇怪。我的.if条件好象没效果了。
Single step exception - code 80000004 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
WS2_32!send:
001b:71a2428a 8bff mov edi,edi
kd> kb
ChildEBP RetAddr Args to Child
0007f1b0 0106eef4 000003e4 0007f21c 00000051 WS2_32!send
0007f1e0 010fe924 00000051 0007f21c 00000001 msmsgs!CNetConnection::SendData+0xa4
0007f1fc 010ff04e 00000051 0007f21c 00000001 msmsgs!CVirtualConn::SendData+0x21
0007fa34 010fa1bc 20525643 0000004b 01235778 msmsgs!CMNSConnection::SendNetMsg+0xc8
0007fcb8 010fa221 01243e94 0007fcd8 01027dac msmsgs!CMNSNet::RequestVersion+0x166
0007fce4 010fc524 01243e94 0000000d 0123d008 msmsgs!CMNSNet::RequestClientVersion+0x44
0007fcfc 010fd49c 00000000 0000000d 012434fb msmsgs!CMNSNet::OnServerVER+0xd0
0007fd10 010ff25c 0000000b 01231a70 00000000 msmsgs!CMNSNet::OnNetMsg+0x720
0007fd38 010ff33d 00000001 0123d008 00000000 msmsgs!CMNSConnection::CheckForNetMsgs+0xf5
0007fd54 0106f05a 0123d014 0123d008 0007fd84 msmsgs!CMNSConnection::OnSocketRead+0x95
0007fd64 0106f0f3 000003e4 00000001 0123d014 msmsgs!CNetConnection::OnWinsockSelectMessage+0xa0
0007fd84 010fdac0 00000428 000003e4 00000001 msmsgs!CNetConnection::OnMessage+0x8e
0007fda4 01075037 00000428 000003e4 00000001 msmsgs!CVirtualConn::OnMessage+0x54
0007fdb8 77d18724 00040196 00000428 000003e4 msmsgs!CMsgrWndBase::WndProc+0x2c
0007fde4 77d18806 0107500b 00040196 00000428 USER32!InternalCallWinProc+0x28
0007fe4c 77d189bd 00000000 0107500b 00040196 USER32!UserCallWinProcCheckWow+0x150
0007feac 77d18a00 0007fed4 00000000 0007fef0 USER32!DispatchMessageWorker+0x306
0007febc 01035516 0007fed4 00000000 00000000 USER32!DispatchMessageW+0xf
0007fef0 0103598d 7c80b6c1 00033f80 0007ff18 msmsgs!CMessengerModule::RunMessageLoop+0x4e
0007ff00 01035a69 00000000 0103fbe7 000a2338 msmsgs!ATL::CAtlExeModuleT<CMessengerModule>::Run+0x1e
kd> g
//这里也没效果
Single step exception - code 80000004 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
WS2_32!send:
001b:71a2428a 8bff mov edi,edi
kd> kb
ChildEBP RetAddr Args to Child
0007f414 0106eef4 000003e4 0007f480 00000020 WS2_32!send
0007f444 010fe924 00000020 0007f480 00000001 msmsgs!CNetConnection::SendData+0xa4
0007f460 010ff04e 00000020 0007f480 00000001 msmsgs!CVirtualConn::SendData+0x21
0007fc98 010fa9bd 20525355 0000001a 01231b28 msmsgs!CMNSConnection::SendNetMsg+0xc8
0007fccc 010fb8ce 00000000 0000006e 0123d008 msmsgs!CMNSNet::StartAuthentication+0x91
0007fcfc 010fd51c 01231a9c 0000006e 0124355c msmsgs!CMNSNet::OnServerCVR+0x67
0007fd10 010ff25c 0000006c 01231a98 00000000 msmsgs!CMNSNet::OnNetMsg+0x7a0
0007fd38 010ff33d 00000001 0123d008 00000000 msmsgs!CMNSConnection::CheckForNetMsgs+0xf5
0007fd54 0106f05a 0123d014 0123d008 0007fd84 msmsgs!CMNSConnection::OnSocketRead+0x95
0007fd64 0106f0f3 000003e4 00000001 0123d014 msmsgs!CNetConnection::OnWinsockSelectMessage+0xa0
0007fd84 010fdac0 00000428 000003e4 00000001 msmsgs!CNetConnection::OnMessage+0x8e
0007fda4 01075037 00000428 000003e4 00000001 msmsgs!CVirtualConn::OnMessage+0x54
0007fdb8 77d18724 00040196 00000428 000003e4 msmsgs!CMsgrWndBase::WndProc+0x2c
0007fde4 77d18806 0107500b 00040196 00000428 USER32!InternalCallWinProc+0x28
0007fe4c 77d189bd 00000000 0107500b 00040196 USER32!UserCallWinProcCheckWow+0x150
0007feac 77d18a00 0007fed4 00000000 0007fef0 USER32!DispatchMessageWorker+0x306
0007febc 01035516 0007fed4 00000000 00000000 USER32!DispatchMessageW+0xf
0007fef0 0103598d 7c80b6c1 00033f80 0007ff18 msmsgs!CMessengerModule::RunMessageLoop+0x4e
0007ff00 01035a69 00000000 0103fbe7 000a2338 msmsgs!ATL::CAtlExeModuleT<CMessengerModule>::Run+0x1e
0007ff08 0103fbe7 000a2338 00000001 0007ffc0 msmsgs!RunMessageLoop+0xc
kd> g
//同样没效果
Single step exception - code 80000004 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
WS2_32!send:
001b:71a2428a 8bff mov edi,edi
kd> g
Single step exception - code 80000004 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
WS2_32!send:
001b:71a2428a 8bff mov edi,edi
kd> g
Single step exception - code 80000004 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
WS2_32!send:
001b:71a2428a 8bff mov edi,edi
kd> g
//而这里就有效果了。
[2222]WS2_32!send:
001b:71a2428a 8bff mov edi,edi
kd> kb
ChildEBP RetAddr Args to Child
01f1fbe4 766a8192 00000410 7670cb8c 00000001 WS2_32!send
01f1fc00 766a8153 0010ecf0 000b0b48 000493e0 WININET!ICAsyncThread::InterruptSelect+0x3a
01f1fc14 766a8107 000b0b48 01f1fc40 7668d434 WININET!ICAsyncThread::QueueSocketWorkItem+0x3a
01f1fc20 7668d434 000b0b48 000004b0 0010ecf0 WININET!QueueSocketWorkItem+0x28
01f1fc40 7668d202 000b0b48 01f1fc64 7668cb44 WININET!ICSocket::Connect_Start+0x2bc
01f1fc4c 7668cb44 000b0b48 00000000 00000000 WININET!CFsm_SocketConnect::RunSM+0x42
01f1fc64 7668caf2 00105a10 00000000 00000000 WININET!CFsm::Run+0x39
01f1fc7c 7668d1d7 000b0b48 00110ea0 01f1fcac WININET!DoFsm+0x25
01f1fc8c 766d2e46 000493e0 00000005 00000060 WININET!ICSocket::Connect+0x32
01f1fcac 766d2ef3 00110ea0 01f1fcd0 7668cb44 WININET!ICSecureSocket::Connect_Fsm+0x43
01f1fcb8 7668cb44 00110ea0 00110c98 00000000 WININET!CFsm_SecureConnect::RunSM+0x2e
01f1fcd0 7668caf2 00105a10 00000000 00000000 WININET!CFsm::Run+0x39
01f1fce8 766d2f74 00110ea0 00108500 01f1fd38 WININET!DoFsm+0x25
01f1fcf8 7668d6b2 000493e0 00000005 00000060 WININET!ICSecureSocket::Connect+0x32
01f1fd38 7668d477 00110c98 01f1fd5c 7668cb44 WININET!HTTP_REQUEST_HANDLE_OBJECT::OpenConnection_Fsm+0x391
01f1fd44 7668cb44 00110c98 00000000 00000000 WININET!CFsm_OpenConnection::RunSM+0x33
01f1fd5c 7668caf2 00105a10 00000000 00000000 WININET!CFsm::Run+0x39
01f1fd74 7668d9b0 00110c98 00108500 01f1fdac WININET!DoFsm+0x25
01f1fd84 7668d948 00000000 00000000 00105a10 WININET!HTTP_REQUEST_HANDLE_OBJECT::OpenConnection+0x2f
01f1fdac 7668d8c1 00108bb0 01f1fdd0 7668cb44 WININET!HTTP_REQUEST_HANDLE_OBJECT::MakeConnection_Fsm+0x87
由于刚刚开始使用windbg。不太熟悉。猜测是不是ba对于某个线程下的断点？
请大虾们指教。如果不是。那么为什么.if没有效果呢？
[招生]系统0day安全班，企业级设备固件漏洞挖掘，Linux平台漏洞挖掘！
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
