Crash Dump Analysis

Workaround Patterns (Part 3)

Forthcoming Webinar on Pattern-Driven Software Diagnostics

2012 - The Year of Software Trace Analysis

Accelerated Memory Dump Analysis Training

Sponsored link: Memory Dump Analysis Services

What happens when Hidden Output and Frozen Process patterns don’t help with annoying popup windows? The former can’t prevent windows from reappearing afresh and the latter could block other coupled processes that might exchange window messages with our suspended process or simply use any IPC mechanism. Here Axed Code pattern can help as demonstrated below. One process was frequently and briefly showing network disconnection message box or dialog. The problem is that it was also bringing its main window into foreground disrupting work in other windows because they were loosing focus. Next time the dialog appeared we found its process ID in Task Manager and attached WinDbg to it. We wasn’t sure what dialog function to intercept so we put a general breakpoint on all “Dialog” functions for all threads:

0:000:x86> bm *Dialog* [...] 6: 73a8ba81 @!"MFC80!CDialog::~CDialog" 7: 73ac25e2 @!"MFC80!CPageSetupDialog::~CPageSetupDialog" 8: 73a94b6b @!"MFC80!CDHtmlDialog::_AfxSimpleScanf" 9: 73a8fbe9 @!"MFC80!CFileDialog::OnTypeChange" 10: 73a90b17 @!"MFC80!CColorDialog::GetRuntimeClass" 11: 73a8bb4a @!"MFC80!CDialog::CreateIndirect" [...] 360: 73a93750 @!"MFC80!CDHtmlDialog::OnNavigateComplete" 361: 73a8f1f3 @!"MFC80!CCommonDialog::OnOK" 362: 73a95d9f @!"MFC80!CDHtmlDialog::GetDropTarget" 363: 73a90266 @!"MFC80!CPrintDialog::GetDevMode" 364: 73ac1514 @!"MFC80!COleInsertDialog::COleInsertDialog" 365: 73ac27c7 @!"MFC80!COlePropertiesDialog::COlePropertiesDialog" 366: 73a75282 @!"MFC80!CWnd::UpdateDialogControls" 367: 73a7fd86 @!"MFC80!CDialogBar::SetOccDialogInfo"

0:000:x86> g Breakpoint 314 hit MFC80!_AfxPostInitDialog: 73a7134e 55 push ebp

0:000:x86> kL 100 ChildEBP RetAddr Args to Child 0027ed2c 73a7180a MFC80!_AfxPostInitDialog 0027ed90 75628817 MFC80!_AfxActivationWndProc+0x90 0027edbc 7562898e USER32!InternalCallWinProc+0x23 0027ee34 7562c306 USER32!UserCallWinProcCheckWow+0x109 0027ee78 756375a2 USER32!SendMessageWorker+0x55b 0027ef4c 7563787a USER32!InternalCreateDialog+0xb64 0027ef70 75649b65 USER32!CreateDialogIndirectParamAorW+0x33 0027ef9c 75225192 USER32!CreateDialogParamA+0x4a WARNING: Stack unwind information not available. Following frames may be wrong. 0027efc8 010c3bf1 DllA!WarningPopup+0×152 0027effc 73a71812 ProcessA+0×9fa1 00000000 00000000 MFC80!_AfxActivationWndProc+0×98

Now we cleared all breakpoints and put the new breakpoint on WarningPopup function:

0:000:x86> bc *

0:000:x86> bp DllA!WarningPopup

0:000:x86> g Breakpoint 0 hit DllA!WarningPopup: 75225040 51 push ecx

Then we assumed that the calling convention was the default one used by C or C++ code like _cdecl and took the bold step to replace push ecx with ret instruction:

0:000:x86> a 75225040 75225040 ret ret 75225041

0:000:x86> g Breakpoint 0 hit DllA!WarningPopup: 75225040 c3 ret

0:000:x86> bc *

0:000:x86> g

Result: no warning popups anymore.

I originally intended to name the pattern Patched Code but then realized that code axing can also be done at the source code level as a quick temporal fix.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Sponsored link: Professional Software Debugging Services

/* Malware and Software Defects -> Victimware.org */

Citrix and Microsoft Customer Forum

Museum of Debugging and Memory Dumps

7/7/2011 - 8/8/2011 Annual Competition: Tell Your Windows Debugging Story

Crash and Hang Analysis Audit Service

CARE: Crash Analysis Report Environment

Crash Dump and Software Trace Analysis Training and Seminars

Access OpenTask Titles on Safari Books Online

DATA (Dump Analysis + Trace Analysis) Facebook group
Please join the community of memory (dump) and trace analysis engineers. This group promotes scientific methods and memory dump-based worldview.

Twitter @ DumpAnalysis
You can now follow portal and blog news at DumpAnalysis on Twitter

LinkedIn Group Dr. Watson Enthusiasts
All about Dr. Watson errors and more. Get news, excerpts and progress reports about the forthcoming book The Science of Dr. Watson: An Illustrated History of Debugging (ISBN 978-1906717070)

2010 (0x7DA) - The Year of Dump Analysis
2011 (0x7DB) - 2020 (0x7E4) The Debugging Decade

International Memory Analysts and Debuggers Day:
07.07 and/or 08.08 starting from The Year of Dump Analysis, 2010, 7DA

Announcements

Coming Soon:

Resume and CV: As a Book