调试环境：WIN7 32bit SP1
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MANUALLY_INITIATED_CRASH (e2)
The user manually initiated this crash dump.
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: MANUALLY_INITIATED_CRASH
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 6
LAST_CONTROL_TRANSFER: from 945df160 to 83318f20
STACK_TEXT:
83362c0c 945df160 000000e2 00000000 00000000 nt!KeBugCheckEx+0x1e
83362c3c 945df768 00105d30 000000c6 00000000 i8042prt!I8xProcessCrashDump+0x251
83362c88 832747ad 88ab4a00 86105c78 83362cb4 i8042prt!I8042KeyboardInterruptService+0x2ce
83362c88 832b1e1a 88ab4a00 86105c78 83362cb4 nt!KiInterruptDispatch+0x6d
83362d24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x1a
0: kd> !locks
**** DUMP OF ALL RESOURCE OBJECTS ****
KD: Scanning for held
locks........................................................................................................................................................
.......................................................................................................
8159 total locks
0: kd> !stacks
Proc.Thread .Thread Ticks ThreadState Blocker
[85404020 System]
4.00001c 85429850 0000923 Blocked nt!AlpcpSignalAndWait+0x7b
4.000028 85424020 0000923 Blocked nt!AlpcpSignalAndWait+0x7b
4.000034 85424798 0001178 Blocked nt!AlpcpSignalAndWait+0x7b
4.000044 85423a70 0000923 Blocked nt!AlpcpSignalAndWait+0x7b
4.00005c 8542a5f8 0000031 Blocked nt!MiModifiedPageWriter+0x39
4.000074 85427a28 0000001 Blocked nt!CcQueueLazyWriteScanThread+0x4a
4.000080 8541f5a8 0003751 Blocked nt!AlpcpReceiveMessagePort+0x245
4.000084 85435d48 0000041 Blocked nt!EtwpLogger+0xd0
4.000088 854357b0 0000001 Blocked nt!EtwpLogger+0xd0
4.00008c 85449d48 0000001 Blocked nt!EtwpLogger+0xd0
4.000090 854497b0 0000001 Blocked nt!EtwpLogger+0xd0
4.000098 85c94540 0000001 Blocked nt!EtwpLogger+0xd0
......
[88ab53d0 svchost.exe]
48c.000490 a27caa88 00038c4 Blocked nt!KiFastCallEntry+0x12a
48c.0004a8 a27e43b0 000017f Blocked nt!ObpWaitForMultipleObjects+0x262
48c.0004b0 a27e7868 00031e0 Blocked nt!KiAcquireFastMutex+0x56
48c.0004c0 a15fdd48 00004ce Blocked nt!ObpWaitForMultipleObjects+0x262
48c.0004f8 a27f07e0 0000804 Blocked nt!ObpWaitForMultipleObjects+0x262
48c.0004fc a27fd030 0003797 Blocked nt!ObpWaitForMultipleObjects+0x262
48c.000500 a27ffc18 0003817 Blocked nt!ObpWaitForMultipleObjects+0x262
48c.000548 a2d8d548 00038d2 Blocked nt!IoRemoveIoCompletion+0x23
48c.000560 a2d96388 0003081 Blocked nt!KiAcquireFastMutex+0x56
48c.0005b8 a2d89a10 00036fc Blocked nt!KiAcquireFastMutex+0x56
48c.0005d4 a2db6380 0002db7 Blocked nt!KiAcquireFastMutex+0x56
48c.000674 a2df87b8 0003e84 Blocked nt!ObpWaitForMultipleObjects+0x262
48c.000ff8 b6c4dc50 0003675 Blocked nt!KiAcquireFastMutex+0x56
48c.000858 b6cc0910 00031e0 Blocked nt!KiAcquireFastMutex+0x56
48c.000728 85542030 0003534 Blocked nt!KiAcquireFastMutex+0x56
48c.0002dc 854a75f8 0003cab Blocked nt!ObpWaitForMultipleObjects+0x262
48c.000744 854a7a60 0003cb0 Blocked nt!IoRemoveIoCompletion+0x23
48c.000554 8554d4c0 00038c3 Blocked nt!ObpWaitForMultipleObjects+0x262
48c.001004 a15e6690 0003014 Blocked nt!KiAcquireFastMutex+0x56
48c.00105c 85639a08 0002ee7 Blocked nt!KiAcquireFastMutex+0x56
48c.001060 85639720 0002ee7 Blocked nt!KiAcquireFastMutex+0x56
48c.0010a8 a15e6358 0002e8e Blocked nt!KiAcquireFastMutex+0x56
48c.0010ac 855a9030 0002e57 Blocked nt!KiAcquireFastMutex+0x56
48c.0010b8 8560c568 0002dc6 Blocked nt!KiAcquireFastMutex+0x56
48c.0010c0 85568880 0002a4f Blocked nt!KiAcquireFastMutex+0x56
48c.0010fc 855b5030 0002a4f Blocked nt!KiAcquireFastMutex+0x56
48c.001100 855b5d48 0001274 Blocked nt!AlpcpSignalAndWait+0x7b
48c.001194 85585030 000017f Blocked nt!IoRemoveIoCompletion+0x23
48c.0011a8 85584a60 000017f Blocked nt!IoRemoveIoCompletion+0x23
......
[855a4d40 explorer.exe]
71c.0008b4 855c3030 00035ee Blocked nt!KiAcquireFastMutex+0x56
71c.000adc b6cd7d48 0003069 Blocked nt!ObpWaitForMultipleObjects+0x262
71c.000cb0 b6cdc920 00037c0 Blocked nt!KiFastCallEntry+0x12a
71c.000480 854a4ad8 00034bc Blocked nt!KiFastCallEntry+0x12a
71c.00056c 8556ed48 000282e Blocked nt!KiFastCallEntry+0x12a
71c.000c80 854f14f0 0002889 Blocked nt!KiAcquireFastMutex+0x56
71c.000cfc 854e1ad8 00036f9 Blocked nt!KiAcquireFastMutex+0x56
71c.000070 85667030 0003790 Blocked nt!ObpWaitForMultipleObjects+0x262
71c.0001a4 8543dd48 000372c Blocked nt!ObpWaitForMultipleObjects+0x262
71c.000128 8560f030 00034a9 Blocked nt!KiAcquireFastMutex+0x56
71c.000de0 8560e970 0003719 Blocked nt!ObpWaitForMultipleObjects+0x262
71c.000e60 855c05f8 00036fc Blocked nt!ExfAcquirePushLockExclusive+0x100
71c.000ae8 85626030 0003743 Blocked nt!ObpWaitForMultipleObjects+0x262
71c.000a00 854fbbe0 0002800 Blocked nt!KiFastCallEntry+0x12a
71c.0009e4 856267f0 00034ac Blocked nt!KiFastCallEntry+0x12a
71c.000830 855bad48 000372c Blocked win32k!xxxRealSleepThread+0x1d7
71c.00099c 854fa380 0000a18 Blocked win32k!xxxRealSleepThread+0x1d7
71c.000814 8562f838 00036fc Blocked nt!KiAcquireFastMutex+0x56
71c.000568 8556f030 0003700 Blocked nt!KiFastCallEntry+0x12a
71c.000cdc 85632d48 0003069 Blocked nt!ExfAcquirePushLockExclusive+0x100
......
[8562cd40 dllhost.exe]
d00.000d0c 85633030 00036fc Blocked nt!KiAcquireFastMutex+0x56
[856166a0 IMSCMIG.EXE]
bf8.0001b0 8564b640 00064ea ???? nt!KiThreadStartup
0: kd> !thread 85633030
THREAD 85633030 Cid 0d00.0d0c Teb: 7ffdf000 Win32Thread: fe52c7e0 WAIT: (WrFastMutex) KernelMode Non-Alertable
86e15014 SynchronizationEvent
Not impersonating
DeviceMap c14ef898
Owning Process 8562cd40 Image: dllhost.exe
Attached Process N/A Image: N/A
Wait Start TickCount 11758 Ticks: 14076 (0:00:03:39.587)
Context Switch Count 16
UserTime 00:00:00.000
KernelTime 00:00:00.015
Win32 Start Address 0x00661609
Stack Init b5e47fd0 Current b5e47198 Base b5e48000 Limit b5e45000 Call 0
Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr Args to Child
b5e471b0 832b869d 85633030 00000000 83365d20 nt!KiSwapContext+0x26 (FPO: [Uses EBP] [0,0,4])
b5e471e8 832b74f7 856330f0 85633030 86e15014 nt!KiSwapThread+0x266
b5e47210 832b10cf 85633030 856330f0 00000000 nt!KiCommitThreadWait+0x1df
b5e47288 8326b08e 86e15014 00000022 00000000 nt!KeWaitForSingleObject+0x393
b5e472b0 832ce55b 85633030 8e015390 8ece16c7 nt!KiAcquireFastMutex+0x56
b5e472bc 8ece16c7 8615c440 00000000 b5e47304 nt!ExAcquireFastMutex+0x1e (FPO: [0,0,2])
WARNING: Stack unwind information not available. Following frames may be wrong.
b5e47b0c 834a939c a1583d40 00000d00 b5e47b5c HOOKHELP!RisingInlineUnHook+0x1467
b5e47b34 8349127f a1583d40 00000d00 8337cb88 nt!PsCallImageNotifyRoutines+0x62
b5e47be8 83481d4a a1581ca0 8562cd40 b5e47ce4 nt!MiMapViewOfImageSection+0x670
b5e47c58 83481e3a 8562cd40 b5e47ce4 00000000 nt!MiMapViewOfSection+0x22e
b5e47c88 83482599 c4cb0360 8562cd40 b5e47ce4 nt!MmMapViewOfSection+0x2a
b5e47d04 832781ea 0000005c ffffffff 0007f4b0 nt!NtMapViewOfSection+0x204
b5e47d04 779970b4 0000005c ffffffff 0007f4b0 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ b5e47d34)
0007f41c 00000000 00000000 00000000 00000000 0x779970b4
0: kd> dd nt!PspLoadImageNotifyRoutine
8337cb80 8a334e77 8a36505f 8e015393 bb0a1e4f
8337cb90 00000000 00000000 00000000 00000000
8337cba0 00000004 00000000 00000000 00000000
8337cbb0 00000000 00000000 00000000 00000000
8337cbc0 8a38fa63 bb0f0ca7 00000000 00000000
8337cbd0 00000000 00000000 00000000 00000000
8337cbe0 00000000 00000000 00000000 00000000
8337cbf0 00000000 00000000 00000000 00000000
0: kd> dd 8e015390
8e015390 00000010 8ece1690 00000000 7d52504c
8e0153a0 06700203 6666744e 00f00702 01000a48
8e0153b0 00005756 00010000 00000000 00000001
8e0153c0 00000000 00000000 8e01565c 8e01565c
8e0153d0 8e0154e0 8e0154e0 00000000 be89a9b8
8e0153e0 86bf70d8 86d28690 86d28714 429eb9ca
8e0153f0 01ca040f 42a105b0 01ca040f 13e98a58
8e015400 01caa6ba 429eb9ca 01ca040f 00009000
0: kd> u 8ece1690
HOOKHELP!RisingInlineUnHook+0x1430:
8ece1690 55 push ebp
8ece1691 8bec mov ebp,esp
8ece1693 81ec48080000 sub esp,848h
8ece1699 c745f800000000 mov dword ptr [ebp-8],0
8ece16a0 837d1000 cmp dword ptr [ebp+10h],0
8ece16a4 0f849e030000 je HOOKHELP!RisingInlineUnHook+0x17e8 (8ece1a48)
8ece16aa 8b4510 mov eax,dword ptr [ebp+10h]
8ece16ad 8b08 mov ecx,dword ptr [eax]
0: kd> u 8ece1690
HOOKHELP!RisingInlineUnHook+0x1430:
8ece1690 55 push ebp
8ece1691 8bec mov ebp,esp
8ece1693 81ec48080000 sub esp,848h
8ece1699 c745f800000000 mov dword ptr [ebp-8],0
8ece16a0 837d1000 cmp dword ptr [ebp+10h],0
8ece16a4 0f849e030000 je HOOKHELP!RisingInlineUnHook+0x17e8 (8ece1a48)
8ece16aa 8b4510 mov eax,dword ptr [ebp+10h]
8ece16ad 8b08 mov ecx,dword ptr [eax]
0: kd> u
HOOKHELP!RisingInlineUnHook+0x144f:
8ece16af c1e908 shr ecx,8
8ece16b2 83e101 and ecx,1
8ece16b5 0f858d030000 jne HOOKHELP!RisingInlineUnHook+0x17e8 (8ece1a48)
8ece16bb 8b0d1845ce8e mov ecx,dword ptr [HOOKHELP!RisingInlineUnHook+0x42b8 (8ece4518)]
8ece16c1 ff150453ce8e call dword ptr [HOOKHELP!RisingInlineUnHook+0x50a4 (8ece5304)]
8ece16c7 8d550c lea edx,[ebp+0Ch]
8ece16ca 52 push edx
8ece16cb 8b0d1845ce8e mov ecx,dword ptr [HOOKHELP!RisingInlineUnHook+0x42b8 (8ece4518)]
0: kd> dds 8ece5304
8ece5304 832ce53d nt!ExAcquireFastMutex
8ece5308 00000000
...（省略无关部分）
0: kd> dd 8ece4518
8ece4518 86e15008 00000000 cf396c68 6952c38e
8ece4528 676e6973 6b6f6f48 00007845 4b2ea300
8ece4538 00000083 00000000 00000000 00000000
8ece4548 00000000 00000000 00000000 00000000
8ece4558 00000000 00000000 00000000 00000000
8ece4568 00000000 00000000 00000000 00000000
8ece4578 00000000 00000000 00000000 00000000
8ece4588 00000000 00000000 00000000 00000000
0: kd> dt _FAST_MUTEX 86e15008
hal!_FAST_MUTEX
+0x000 Count : 0n1200
+0x004 Owner : 0x855c05f8 _KTHREAD
+0x008 Contention : 0x4f5
+0x00c Event : _KEVENT
+0x01c OldIrql : 0
0: kd> !thread 855c05f8
THREAD 855c05f8 Cid 071c.0e60 Teb: 7ffd3000 Win32Thread: fe53e170 WAIT: (WrPushLock) KernelMode Non-Alertable
bd82e310 SynchronizationEvent
Not impersonating
DeviceMap c14ef898
Owning Process 855a4d40 Image: explorer.exe
Attached Process N/A Image: N/A
Wait Start TickCount 11758 Ticks: 14076 (0:00:03:39.587)
Context Switch Count 124
UserTime 00:00:00.015
KernelTime 00:00:00.062
Win32 Start Address 0x75bc42ed
Stack Init bd82ffd0 Current bd82e1e0 Base bd830000 Limit bd82d000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr Args to Child
bd82e1f8 832b869d 855c05f8 00000000 807c6120 nt!KiSwapContext+0x26 (FPO: [Uses EBP] [0,0,4])
bd82e230 832b74f7 855c06b8 855c05f8 bd82e310 nt!KiSwapThread+0x266
bd82e258 832b10cf 855c05f8 855c06b8 00000000 nt!KiCommitThreadWait+0x1df
bd82e2d4 832ccc8d bd82e310 0000001c 00000000 nt!KeWaitForSingleObject+0x393
bd82e344 83466cdc 984ad368 bd82e44c bd82e4dc nt!ExfAcquirePushLockExclusive+0x100
bd82e42c 832781ea ffffffff bd82e514 00000000 nt!NtAllocateVirtualMemory+0x127a
bd82e42c 832758e1 ffffffff bd82e514 00000000 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ bd82e44c)
bd82e4bc 8ece0d4a ffffffff bd82e514 00000000 nt!ZwAllocateVirtualMemory+0x11 (FPO: [6,0,0])
WARNING: Stack unwind information not available. Following frames may be wrong.
bd82e650 8ece1011 00000bf8 bd82ee98 00000208 HOOKHELP!RisingInlineUnHook+0xaea
bd82f0c0 834a276c 0000071c 00000bf8 00000001 HOOKHELP!RisingInlineUnHook+0xdb1
bd82f178 834aa799 8564b640 016166a0 bd82f1d4 nt!PspInsertThread+0x5c0
bd82f884 8eceebf4 0463e6dc 0463e6b8 02000000 nt!NtCreateUserProcess+0x742
bd82fd00 832781ea 0463e6dc 0463e6b8 02000000 Hooksys+0x7bf4
bd82fd00 779970b4 0463e6dc 0463e6b8 02000000 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ bd82fd34)
0463e9fc 00000000 00000000 00000000 00000000 0x779970b4
0: kd> dd nt!PspCreateProcessNotifyRoutine
8337cce0 8a204bb7 8a24116f 8b2020df 8a31a2ff
8337ccf0 8a332a67 8a306e27 8a3219d6 b9a9c077
8337cd00 9972f5af 00000000 00000000 00000000
8337cd10 00000000 00000000 00000000 00000000
8337cd20 00000000 00000000 00000000 00000000
8337cd30 00000000 00000000 00000000 00000000
8337cd40 00000000 00000000 00000000 00000000
8337cd50 00000000 00000000 00000000 00000000
...（一个一个EX_CALLBACK结构地看）...
0: kd> dd 8a3219d0
8a3219d0 00000010 8ece0f50 00000000 8b200078
8a3219e0 06080203 6646744e 0024005c 00780045
8a3219f0 00650074 0064006e 0024005c 006d0052
8a321a00 0065004d 00610074 00610064 00610074
8a321a10 0024005c 00780054 004c0066 0067006f
8a321a20 06060208 69446350 8e0f3520 8787377c
8a321a30 6994ad04 11d093ef a000cca3 963122c9
8a321a40 010e010c 8eaa50d8 885e05e8 01000000
0: kd> u 8ece0f50
HOOKHELP!RisingInlineUnHook+0xcf0:
8ece0f50 55 push ebp
8ece0f51 8bec mov ebp,esp
8ece0f53 81ec580a0000 sub esp,0A58h
8ece0f59 57 push edi
8ece0f5a 8b4508 mov eax,dword ptr [ebp+8]
8ece0f5d 8945e8 mov dword ptr [ebp-18h],eax
8ece0f60 8b4d0c mov ecx,dword ptr [ebp+0Ch]
8ece0f63 894dec mov dword ptr [ebp-14h],ecx
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
