LiveDump - 本机动态生成完整内核 dump 文件-软件逆向-看雪-安全社区|安全招聘|kanxue.com

LiveDump - 本机动态生成完整内核 dump 文件

发表于: 2008-4-13 21:44 12542

LiveDump - 本机动态生成完整内核 dump 文件

小喂

2008-4-13 21:44

12542

LiveDump by 小喂

模仿 livekd 写的一个工具，可以在本机上动态生成完整内核 dump 文件，方便本机内核调试，或者事后调试，可能对于保存当前系统状态也有点用。和 livekd 不同，livedump 生成的是一个完整 dump 文件，而没有采用文件过滤驱动的方式。当前支持 xp 以后的 32 位系统，但我只在 32 位 xpsp2 和 vista 系统上测试通过，使用过程产生的任何问题请自己负责。

D:\WinDBG>livedump d:\DmpFiles\live_vista.dmp

LiveDump v1.0 - Generate full kernel mode dump file on a live system
xiaoweitech - http://hi.baidu.com/xiaoweitech
Copyright (C) 2008 xiaowei
Usage: livedump [dump file name]

start dump ... successed!

D:\WinDBG>kd -z d:\DmpFiles\live_vista.dmp

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [d:\DmpFiles\live_vista.dmp]
Kernel Complete Dump File: Full address space is available

Comment: 'This dump file is generated by LiveDump (http://hi.baidu.com/xiaoweitech)'
Symbol search path is: srv*E:\WebSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x82000000 PsLoadedModuleList = 0x82111e10
Debug session time: Sun Apr 13 21:13:58.005 2008 (GMT+8)
System Uptime: 49336 days 0:17:26.005
Loading Kernel Symbols
........................................................................................................................
.....................................
Loading User Symbols

Loading unloaded module list
..........
*******************************************************************************
*                                                                            *
*                      Bugcheck Analysis                                  *
*                                                                            *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {80000003, df9734b0, 0, 0}

*** ERROR: Module load completed but symbols could not be loaded for LDumpDrv.sys

Probably caused by : Unknown_Image ( LDumpDrv+4b0 )

Followup: MachineOwner
---------

16.0: kd> vertarget
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x82000000 PsLoadedModuleList = 0x82111e10
Debug session time: Sun Apr 13 21:13:58.005 2008 (GMT+8)
System Uptime: 49336 days 0:17:26.005

16.0: kd> !process 0 0 explorer.exe
PROCESS 862b4d90  SessionId: 1  Cid: 0374 Peb: 7ffd8000  ParentCid: 021c
DirBase: 685ed360  ObjectTable: 9d1817c0  HandleCount: 810.
Image: explorer.exe

16.0: kd> !pcr
KPCR for Processor 0 at 820f4700:
Major 1 Minor 1
      NtTib.ExceptionList: ffffffff
         NtTib.StackBase: 00000000
         NtTib.StackLimit: 00000000
      NtTib.SubSystemTib: 8014f000
            NtTib.Version: 03dc94a2
      NtTib.UserPointer: 00000001
            NtTib.SelfTib: 00000000

                  SelfPcr: 820f4700
                     Prcb: 820f4820
                     Irql: 00000002
                     IRR: 00000000
                     IDR: ffffffff
            InterruptMode: 00000000
                     IDT: 81c7f400
                     GDT: 81c7f000
                     TSS: 8014f000

            CurrentThread: 820f8300
               NextThread: 00000000
               IdleThread: 820f8300

               DpcQueue:
16.0: kd> !object \Driver
Object: 88a68958  Type: (84057d40) Directory
ObjectHeader: 88a68940 (old version)
HandleCount: 0  PointerCount: 103
Directory Object: 88a07488  Name: Driver

Hash Address  Type       Name
---- -------  ----       ----
   00  86191880 Driver       Beep
      85ce0570 Driver       al3uov8c
      8541eac8 Driver       KSecDD
      84f0d768 Driver       NDIS
   01  85d15c28 Driver       mouclass
   02  86ab0b08 Driver       CMB8100
   03  847280d8 Driver       LDumpDrv
      85e81778 Driver       kbdclass
      856240d0 Driver       IntcAzAudAddService
   04  86191e30 Driver       VgaSave
      8604f528 Driver       NDProxy
      84e32dd8 Driver       msisadrv
      867221b8 Driver       monitor
   05  84f07d78 Driver       Ecache
      84e3f760 Driver       MountMgr
   06  85ca7438 Driver       ohci1394
      86376d38 Driver       CMBProtector
   08  84eb65b8 Driver       atapi
      861604b8 Driver       PEAUTH
   09  84eb5ef0 Driver       JRAID
      84eb6908 Driver       volmgrx
      8405bd28 Driver       PCI_NTPNP9580
   10  84a10030 Driver       USBSTOR
      862adcd8 Driver       PSched
      861e5158 Driver       RasAcd
      85dad318 Driver       VMnetAdapter
      85c7cec8 Driver       tunmp
      84dbc368 Driver       sptd
   11  85ca5f38 Driver       usbuhci
      8641bb28 Driver       mouhid
      865e5860 Driver       Win32k
      86cabb68 Driver       VMnetuserif
   12  869c0bf8 Driver       VMnetBridge
      85de4d30 Driver       usbhub
      85d14f38 Driver       swenum
      85d1dcd0 Driver       rdpdr
      85b93ad0 Driver       tunnel
   13  861ec740 Driver       RDPCDD
      85ce6ac0 Driver       RasPppoe
      86a378b0 Driver       HTTP
   14  85d94030 Driver       TermDD
      85be6880 Driver       MTsensor
   15  85ceac48 Driver       Rasl2tp
      84f01c78 Driver       JGOGO
   17  84b5c150 Driver       WUDFRd
      85cf1f38 Driver       umbus
      85ce5f38 Driver       VPCNetS2
   18  862c9cb8 Driver       Smb
      861a7f38 Driver       WlanUIG
      85d1df38 Driver       PptpMiniport
      85cf6760 Driver       Serenum
      85b0cb68 Driver       crcdisk
      84f0b750 Driver       CLFS
      840a3960 Driver       WMIxWDM
      840a3f38 Driver       ACPI_HAL
      86b0c680 Driver       secdrv
   19  84fda390 Driver       spldr
      869557b0 Driver       hcmon
   21  8695fe20 Driver       NativeWifiP
      862c9838 Driver       netbt
      85c449e0 Driver       AtcL001
      86b5ed40 Driver       tcpipreg
   22  861a8b50 Driver       RDPENCDD
      85c990d0 Driver       cdrom
      85d14e40 Driver       mssmbios
      85cea8d8 Driver       iScsiPrt
      84e3f668 Driver       pciide
   23  869d8830 Driver       rspndr
      863392e8 Driver       tdx
   24  84f6ff38 Driver       fvevol
      861e5998 Driver       Tcpip
      8694ce90 Driver       mpsdrv
   25  84fbbab8 Driver       volsnap
      862ab030 Driver       nsiproxy
      84ebbdd8 Driver       volmgr
   26  85c7dcb0 Driver       intelppm
   27  869d2030 Driver       lltdio
      8645f580 Driver       ZSMC301b
      86329578 Driver       Wanarpv6
   28  86158150 Driver       Null
      85be0758 Driver       usbehci
   29  8541e2a0 Driver       disk
      862d7200 Driver       CSC
      84ebb380 Driver       pci
   30  84fda498 Driver       partmgr
      85cdc8c8 Driver       Serial
      85d1d030 Driver       NdisTapi
      85d92ec0 Driver       NdisWan
   31  862e3568 Driver       vmm
      85c429e0 Driver       HDAudBus
      85c85f38 Driver       DXGKrnl
   32  840513e0 Driver       ACPI
      84dd6710 Driver       Wdf01000
      869d4030 Driver       vmx86
   33  840a2300 Driver       PnpManager
   34  8470c9a0 Driver       PROCEXP111
      869da840 Driver       Ndisuio
      8633f890 Driver       AFD
      85be29e0 Driver       nvlddmkm
   35  86409b88 Driver       HidUsb
      868aa768 Driver       vstor2
   36  85cdcca0 Driver       i8042prt
16.0: kd>

下面给出 dump 文件头格式给大家参考：

typedef struct _DUMP_HEADER32 /* sizeof = 0x1000 */
{
/* 000 */ ULONG    ulSignature;
/* 004 */ ULONG    ulValidDump;
/* 008 */ ULONG    ulMajorVersion;
/* 00C */ ULONG    ulMinorVersion;
/* 010 */ ULONG    ulDirectoryTableBase;
/* 014 */ ULONG    ulPfnDataBase;
/* 018 */ PLIST_ENTRY PsLoadedModuleList;
/* 01C */ PLIST_ENTRY PsActiveProcessHead;
/* 020 */ ULONG    ulMachineImageType;
/* 024 */ ULONG    ulNumberProcessors;
/* 028 */ ULONG    ulBugCheckCode;
/* 02C */ ULONG    ulBugCheckParameter1;
/* 030 */ ULONG    ulBugCheckParameter2;
/* 034 */ ULONG    ulBugCheckParameter3;
/* 038 */ ULONG    ulBugCheckParameter4;
/* 03C */ char       szVersionUser[32];
/* 05C */ BOOLEAN    bPaeEnabled;
/* 05D */ UCHAR    uchKdSecondaryVersion;
/* 05E */ char       chUnused1[2];
/* 060 */ ULONG    ulKdDebuggerDataBlock;
/* 064 */ PHYSICAL_MEMORY_DESCRIPTOR  stPhysMemDesc;
/* 074 */ char       chUnused2[684];
/* 320 */ CONTEXT    stContext;
/* 5EC */ char       chUnused3[484];
/* 7D0 */ EXCEPTION_RECORD32  stExceptionRecord;
/* 820 */ char       szComment[1896];
/* F88 */ ULONG    ulDumpType;
/* F8C */ ULONG    ulMiniDumpFields;
/* F90 */ ULONG    ulSecondaryDataState;
/* F94 */ ULONG    ulProductType;
/* F98 */ ULONG    ulSuiteMask;
/* F9C */ ULONG    ulWriterStatus;
/* FA0 */ ULONG64    ulFileSize;
/* FA8 */ char       chUnused4[16];
/* FB8 */ ULONG64    ulSystemUptime;
/* FC0 */ ULONG64    ulDebugSessionTime;
/* FC8 */ char       chUnused5[56];
} DUMP_HEADER32, *PDUMP_HEADER32;

这里还有一篇文章介绍了 dump 文件格式：

http://wasm.ru/article.php?article=dmp_format

登录后可查看完整内容

[招生]科锐逆向工程师培训(2025年3月11日实地，远程教学同时开班, 第52期)！

#调试逆向

上传的附件：

LiveDump.zip （33.93kb，167次下载）

收藏・4

免费・7

支持

赞赏记录

参与人

雪币

留言

时间

Youlor

为你点赞~

2024-1-3 02:37

伟叔叔

为你点赞~

2023-10-20 00:02

PLEBFE

为你点赞~

2023-7-27 01:03

QinBeast

为你点赞~

2023-7-26 00:21

shinratensei

为你点赞~

2023-7-3 01:15

心游尘世外

为你点赞~

2023-6-24 00:11

飘零丶

为你点赞~

2023-6-15 00:00

最新回复 (10)

NetRoc

雪币： 108

活跃值： (141)

能力值：

( LV9，RANK：490 )

在线值：

发帖

回帖

108

粉丝

关注

私信

NetRoc 12: 2 楼

强，支持小喂多发好东西

2008-4-13 22:05

火翼[CCG]

雪币： 435

活跃值： (172)

能力值：

( LV13，RANK：280 )

在线值：

发帖

回帖

252

粉丝

关注

私信

火翼[CCG] 6: 3 楼

最近很高产啊

2008-4-13 23:05

NetRoc

雪币： 108

活跃值： (141)

能力值：

( LV9，RANK：490 )

在线值：

发帖

回帖

108

粉丝

关注

私信

NetRoc 12: 4 楼

[QUOTE='火翼[CCG];440731']最近很高产啊[/QUOTE]

你也产点三，哈哈

2008-4-13 23:21

amour

雪币： 250

活跃值： (16)

能力值：

( LV2，RANK：10 )

在线值：

发帖

回帖

102

粉丝

关注

私信

amour: 5 楼

学习下.支持.

2008-4-13 23:31

zhucheba

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

回帖

375

粉丝

关注

私信

zhucheba: 6 楼

支持小喂多发好东西

2008-4-14 10:09

Aker

雪币： 2134

活跃值： (14)

能力值： (RANK：170 )

在线值：

发帖

回帖

773

粉丝

关注

私信

Aker 4: 7 楼

高产，这个结构帅气

下面给出 dump 文件头格式给大家参考：
 
typedef struct _DUMP_HEADER32 /* sizeof = 0x1000 */
{
/* 000 */   ULONG       ulSignature;
/* 004 */   ULONG       ulValidDump;
/* 008 */   ULONG       ulMajorVersion;
/* 00C */   ULONG       ulMinorVersion;
/* 010 */   ULONG       ulDirectoryTableBase;
/* 014 */   ULONG       ulPfnDataBase;
/* 018 */   PLIST_ENTRY PsLoadedModuleList;
/* 01C */   PLIST_ENTRY PsActiveProcessHead;
/* 020 */   ULONG       ulMachineImageType;
/* 024 */   ULONG       ulNumberProcessors;
/* 028 */   ULONG       ulBugCheckCode;
/* 02C */   ULONG       ulBugCheckParameter1;
/* 030 */   ULONG       ulBugCheckParameter2;
/* 034 */   ULONG       ulBugCheckParameter3;
/* 038 */   ULONG       ulBugCheckParameter4;
/* 03C */   char        szVersionUser[32];
/* 05C */   BOOLEAN     bPaeEnabled;
/* 05D */   UCHAR       uchKdSecondaryVersion;
/* 05E */   char        chUnused1[2];
/* 060 */   ULONG       ulKdDebuggerDataBlock;
/* 064 */   PHYSICAL_MEMORY_DESCRIPTOR  stPhysMemDesc;
/* 074 */   char        chUnused2[684];
/* 320 */   CONTEXT     stContext;
/* 5EC */   char        chUnused3[484];
/* 7D0 */   EXCEPTION_RECORD32  stExceptionRecord;
/* 820 */   char        szComment[1896];
/* F88 */   ULONG       ulDumpType;
/* F8C */   ULONG       ulMiniDumpFields;
/* F90 */   ULONG       ulSecondaryDataState;
/* F94 */   ULONG       ulProductType;
/* F98 */   ULONG       ulSuiteMask;
/* F9C */   ULONG       ulWriterStatus;
/* FA0 */   ULONG64     ulFileSize;
/* FA8 */   char        chUnused4[16];
/* FB8 */   ULONG64     ulSystemUptime;
/* FC0 */   ULONG64     ulDebugSessionTime;
/* FC8 */   char        chUnused5[56];
} DUMP_HEADER32, *PDUMP_HEADER32;