栈溢出，这个词无需多解释，大家都知道，很难定位。

这个问题，分析一两个星期了，有所获有所惑。

直接开始分析：

9: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050033
Arg3: 00000000000006f8
Arg4: fffffa6006fbf8dd

Debugging Details:
------------------

BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

PROCESS_NAME:  mmc.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800020a31ae to fffff800020a3410

STACK_TEXT:  
fffffa60`01c77a68 fffff800`020a31ae : 00000000`0000007f 00000000`00000008 00000000`80050033 00000000`000006f8 : nt!KeBugCheckEx
fffffa60`01c77a70 fffff800`020a19f8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x6e
fffffa60`01c77bb0 fffffa60`06fbf8dd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb8
fffffa60`0db4de80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX //此处忽略。一下也忽略。

......
......
......

注意上面的两个地方：
UNEXPECTED_KERNEL_MODE_TRAP (7f)
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT

9: kd> r
rax=fffffa6001c77b70 rbx=fffffa800a416f50 rcx=000000000000007f
rdx=0000000000000008 rsi=0000000000000043 rdi=fffffa800d196b90
rip=fffff800020a3410 rsp=fffffa6001c77a68 rbp=fffffa6001c77c30
r8=0000000080050033  r9=00000000000006f8 r10=fffffa6006fbf8dd
r11=fffffa80124bf010 r12=fffffa800a416eb0 r13=fffffa800a416ef0
r14=fffff8800c766800 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000282
nt!KeBugCheckEx:
fffff800`020a3410 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffffa60`01c77a70=000000000000007f

9: kd> !thread
GetPointerFromAddress: unable to read from fffff80002277000
THREAD fffffa801576e7e0  Cid 1d54.0cd8  Teb: 000007fffffdc000 Win32Thread: fffff900c01de010 RUNNING on processor 9
IRP List:
    Unable to read nt!_IRP @ fffffa80142f69d0
Not impersonating
GetUlongFromAddress: unable to read from fffff800021f5be0
Owning Process            fffffa801570f040       Image:         mmc.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      4315021      
Context Switch Count      1216                 LargeStack
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x00000000ff162550
Stack Init fffffa600db58db0 Current fffffa600db56760
Base fffffa600db59000 Limit fffffa600db4e000 Call 0
Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffffa60`01c77a68 fffff800`020a31ae : 00000000`0000007f 00000000`00000008 00000000`80050033 00000000`000006f8 : nt!KeBugCheckEx
fffffa60`01c77a70 fffff800`020a19f8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x6e
fffffa60`01c77bb0 fffffa60`06fbf8dd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb8 (TrapFrame @ fffffa60`01c77bb0)
fffffa60`0db4de80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

以上分析可以看出：rsp=fffffa6001c77a68 超出了 Base fffffa600db59000 Limit fffffa600db4e000
从而确定为是栈溢出。下面的指令又进一步的证实了。

9: kd> kf
  Memory  Child-SP          RetAddr           Call Site
          fffffa60`01c77a68 fffff800`020a31ae nt!KeBugCheckEx
        8 fffffa60`01c77a70 fffff800`020a19f8 nt!KiBugCheckDispatch+0x6e
      140 fffffa60`01c77bb0 fffffa60`06fbf8dd nt!KiDoubleFaultAbort+0xb8
  bed62d0 fffffa60`0db4de80 00000000`00000000 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

为何bed62d0，这个数这么大？x64的栈大小不是24kb吗？不解，求解释。

应该证实为是栈溢出了，如何解决呢？我暂定几个内存复制函数。因为函数里面大的变量的定义都删除了，也没有递归等调用。
下面如何呢？请看客继续。因为我知道网上的高手多的是。

参考资料：

Stop 7F, 0x00000008 (double-fault) error occurs because of a single-bit error in the ESP register
http://support.microsoft.com/kb/842465/en-us
http://support.microsoft.com/kb/842465/zh-tw
http://support.microsoft.com/kb/842465/zh-cn
其实里面就俩个命令，检查esp超出范围不。

"STOP 0x0000007F"错误的常见原因
http://support.microsoft.com/kb/137539

Part 1: Got Stack? No. We ran out of Kernel Mode Stack and kv won’t tell me why!
http://blogs.msdn.com/b/ntdebugging/archive/2009/11/25/got-stack-no-we-ran-out-of-kernel-mode-stack-and-kv-won-t-tell-me-why-part-1.aspx

Kernel Stack Overflows
http://blogs.msdn.com/b/ntdebugging/archive/2008/02/01/kernel-stack-overflows.aspx

如何避免驱动程序用光内核模式堆栈？
http://msdn.microsoft.com/zh-cn/library/windows/hardware/gg463190.aspx

windbg调试实例（3）——崩溃蓝屏之内核堆栈溢出
http://blog.chinaunix.net/uid-20706775-id-2940273.html
http://www.ourren.com/blog/example-3-windbg-debugging.html

内核中的缓冲区溢出，栈溢出
http://www.kernelchina.org/node/88

请教win7蓝屏问题
http://social.technet.microsoft.com/Forums/zh-CN/window7betacn/thread/f4de0583-2141-48b9-9793-453e8273e402/

Bug Check 0x7F: UNEXPECTED_KERNEL_MODE_TRAP(windbg的帮助文件里面。)
http://msdn.microsoft.com/en-us/library/windows/hardware/ff559244(v=vs.85).aspx

等等。

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)