0:046> g
Breakpoint 0 hit
eax=00000000 ebx=00000000 ecx=0179fe9c edx=7c92e4f4 esi=7c92de50 edi=00000000
eip=7c943bb8 esp=0179fea8 ebp=0179ff98 iopl=0 nv up ei ng nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000286
当前断点EIP=7c943bb8,是ntdll!LdrShutdownProcess的第一行
0:002> k
ChildEBP RetAddr
0179fea4 0135be96 ntdll!LdrShutdownProcess
WARNING: Frame IP not in any known module. Following frames may be wrong.
0179ffb4 7c80b713 0x135be96
0179ffe0 7c80b71f kernel32!BaseThreadStart+0x37
0179ffe4 00000000 kernel32!BaseThreadStart+0x43
根据堆栈往上回溯,发现7c80b713处是kernel32!BaseThreadStart函数
kernel32!BaseThreadStart:
7c80b6dc 6a10 push 10h
7c80b6de 6820b7807c push offset kernel32!`string'+0x88 (7c80b720)
7c80b6e3 e8ee6dffff call kernel32!_SEH_prolog (7c8024d6)
7c80b6e8 8365fc00 and dword ptr [ebp-4],0
7c80b6ec 64a118000000 mov eax,dword ptr fs:[00000018h]
7c80b6f2 8945e0 mov dword ptr [ebp-20h],eax
7c80b6f5 817810001e0000 cmp dword ptr [eax+10h],1E00h
7c80b6fc 750f jne kernel32!BaseThreadStart+0x31 (7c80b70d)
7c80b6fe 803d0850887c00 cmp byte ptr [kernel32!BaseRunningInServerProcess (7c885008)],0
7c80b705 7506 jne kernel32!BaseThreadStart+0x31 (7c80b70d)
7c80b707 ff15f412807c call dword ptr [kernel32!_imp__CsrNewThread (7c8012f4)]
7c80b70d ff750c push dword ptr [ebp+0Ch]
7c80b710 ff5508 call dword ptr [ebp+8]
7c80b713 50 push eax
7c80b714 e8cf090000 call kernel32!ExitThread (7c80c0e8)
最后于 2023-3-15 21:12
被happyRR编辑
,原因: