Crash Dump Analysis

Crash Dump Analysis Patterns (Part 38b)

Sponsored link: Memory Dump Analysis Services

This is a variation of Hooked Functions pattern for kernel space. In addition to trampoline patching we also see a modified service table:

0: kd> !chkimg -lo 50 -d !nt -v Searching for module with expression: !nt Will apply relocation fixups to file used for comparison Will ignore NOP/LOCK errors Will ignore patched instructions Image specific ignores will be applied Comparison image path: c:\symdownstream\ntkrnlmp.exe\4B7A8E62280000\ntkrnlmp.exe No range specified

Scanning section: .text Size: 625257 Range to scan: 80801000-80899a69 808373e3-808373e9 7 bytes - nt!KeAcquireQueuedSpinLockAtDpcLevel+1b [ f7 41 04 01 00 00 00:e9 00 0d b2 76 cc cc ] 8083e6c8-8083e6cb 4 bytes - nt!KiServiceTable+440 (+0×72e5) [ 98 4e 98 80:d0 66 e9 f4 ] 80840605-8084060a 6 bytes - nt!KxFlushEntireTb+9 (+0×1f3d) [ ff 15 1c 10 80 80:e9 a5 7a b1 76 cc ] Total bytes compared: 625257(100%) Number of errors: 17

Scanning section: MISYSPTE Size: 1906 Range to scan: 8089a000-8089a772 Total bytes compared: 1906(100%) Number of errors: 0

Scanning section: POOLMI Size: 7868 Range to scan: 8089b000-8089cebc Total bytes compared: 7868(100%) Number of errors: 0

Scanning section: POOLCODE Size: 7754 Range to scan: 8089d000-8089ee4a Total bytes compared: 7754(100%) Number of errors: 0

Scanning section: PAGE Size: 1097281 Range to scan: 808bc000-809c7e41 Total bytes compared: 1097281(100%) Number of errors: 0

Scanning section: PAGELK Size: 63633 Range to scan: 809c8000-809d7891 Total bytes compared: 63633(100%) Number of errors: 0

Scanning section: PAGEWMI Size: 7095 Range to scan: 809ef000-809f0bb7 Total bytes compared: 7095(100%) Number of errors: 0

Scanning section: PAGEKD Size: 16760 Range to scan: 809f1000-809f5178 Total bytes compared: 16760(100%) Number of errors: 0

Scanning section: PAGEHDLS Size: 7508 Range to scan: 809f7000-809f8d54 Total bytes compared: 7508(100%) Number of errors: 0 17 errors : !nt (808373e3-8084060a)

0: kd> dds 8083e6c8 8083e6c8 f4e966d0 DriverA+0×20d8 8083e6cc 80983436 nt!NtUnloadKey2 8083e6d0 809837b5 nt!NtUnloadKeyEx 8083e6d4 8091cec8 nt!NtUnlockFile 8083e6d8 80805d80 nt!NtUnlockVirtualMemory 8083e6dc 80937630 nt!NtUnmapViewOfSection 8083e6e0 808e7154 nt!NtVdmControl 8083e6e4 809c6ba3 nt!NtWaitForDebugEvent 8083e6e8 8092dc24 nt!NtWaitForMultipleObjects 8083e6ec 8092ccf4 nt!NtWaitForSingleObject 8083e6f0 809c132f nt!NtWaitHighEventPair 8083e6f4 809c12c3 nt!NtWaitLowEventPair 8083e6f8 80925c8d nt!NtWriteFile 8083e6fc 80901790 nt!NtWriteFileGather 8083e700 8091214c nt!NtWriteRequestData 8083e704 8093e63b nt!NtWriteVirtualMemory 8083e708 80822751 nt!NtYieldExecution 8083e70c 808c7c46 nt!NtCreateKeyedEvent 8083e710 8093eee3 nt!NtOpenKeyedEvent 8083e714 809c1ee8 nt!NtReleaseKeyedEvent 8083e718 809c2183 nt!NtWaitForKeyedEvent 8083e71c 809a610b nt!NtQueryPortInformationProcess 8083e720 809a6123 nt!NtGetCurrentProcessorNumber 8083e724 809a1849 nt!NtWaitForMultipleObjects32 8083e728 90909090 8083e72c 1c0d3b90 8083e730 0f8089f1 8083e734 037aaa85 8083e738 00c1f700 8083e73c 0fffff00 8083e740 037a9e85 8083e744 9090c300

0: kd> u 808373e3 nt!KeAcquireQueuedSpinLockAtDpcLevel+0×1b: 808373e3 jmp DriverB+0×10e8 (f73580e8) 808373e8 int 3 808373e9 int 3 808373ea je nt!KeAcquireQueuedSpinLockAtDpcLevel+0×12 (808373da) 808373ec pause 808373ee jmp nt!KeAcquireQueuedSpinLockAtDpcLevel+0×1b (808373e3) nt!KeReleaseInStackQueuedSpinLockFromDpcLevel: 808373f0 lea ecx,[ecx] nt!KeReleaseQueuedSpinLockFromDpcLevel: 808373f2 mov eax,ecx

0: kd> u 80840605 nt!KxFlushEntireTb+0×9: 80840605 jmp DriverB+0×10af (f73580af) 8084060a int 3 8084060b mov byte ptr [ebp-1],al 8084060e mov ebx,offset nt!KiTbFlushTimeStamp (808a7100) 80840613 mov ecx,dword ptr [nt!KiTbFlushTimeStamp (808a7100)] 80840619 test cl,1 8084061c jne nt!KxFlushEntireTb+0×19 (8082cd8d) 80840622 mov eax,ecx

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Museum of Debugging and Memory Dumps

7/7/2010 - 8/8/2010 Annual Competition: Tell Your Windows Debugging Story

Crash and Hang Analysis Audit Service

CARE: Crash Analysis Report Environment

Crash Dump and Software Trace Analysis Training and Seminars

Access OpenTask Titles on Safari Books Online

DATA (Dump Analysis + Trace Analysis) Facebook group
Please join the community of memory (dump) and trace analysis engineers. This group promotes scientific methods and memory dump-based worldview.

Twitter @ DumpAnalysis
You can now follow portal and blog news at DumpAnalysis on Twitter

LinkedIn Group Dr. Watson Enthusiasts
All about Dr. Watson errors and more. Get news, excerpts and progress reports about the forthcoming book The Science of Dr. Watson: An Illustrated History of Debugging (ISBN 978-1906717070)

2010 (0x7DA) - The Year of Dump Analysis
2011 (0x7DB) - 2020 (0x7E4) The Debugging Decade

International Memory Analysts and Debuggers Day:
07.07 and/or 08.08 starting from The Year of Dump Analysis, 2010, 7DA

Announcements

Coming Soon:

Management Bits: An Anthology from Reductionist Manager