Crash Dump Analysis Patterns (Part 100)
Forthcoming Webinar on Pattern-Driven Software Diagnostics
2012 - The Year of Software Trace Analysis
Accelerated Memory Dump Analysis Training
Sponsored link: Memory Dump Analysis Services
Debugging Experts Magazine Online
Debugging Today Daily Newspaper
In addition to hooking functions via code patching there is another function pre- and post-processing done via windows message hooking mechanism that I call Message Hooks pattern to differentiate it from Hooked Functions pattern. In some cases message hooking become sources of aberrant software behaviour including spikes, hangs and crashes. We can identify such residue looking at the problem thread raw stack:
0:000> !teb
TEB at 7ffde000
ExceptionList: 0012fcdc
StackBase: 00130000
StackLimit: 0011b000
SubSystemTib: 00000000
FiberData: 00001e00
ArbitraryUserPointer: 00000000
Self: 7ffde000
EnvironmentPointer: 00000000
ClientId: 0000050c . 000004b8
RpcHandle: 00000000
Tls Storage: 00000000
PEB Address: 7ffdf000
LastErrorValue: 0
LastStatusValue: c0000034
Count Owned Locks: 0
HardErrorMode: 0
0:000> dps 0011b000 00130000
[...]
0012fc78 7e4318d1 user32!DispatchHookA
0012fc7c 0012fcb8
0012fc80 7472467f
0012fc84 7e43e1ad user32!NtUserCallNextHookEx+0xc
0012fc88 7e43e18a user32!CallNextHookEx+0×6f
0012fc8c 00000003
0012fc90 00000011
0012fc94 001d0001
0012fc98 00000001
0012fc9c 00000003
0012fca0 00000000
0012fca4 001d0001
0012fca8 0012fcec
0012fcac 74730844DllA!ThreadKeyboardProc+0×77
0012fcb0 001e04f7
0012fcb4 00000003
0012fcb8 00000011
0012fcbc 001d0001
0012fcc0 00000003
0012fcc4 00020003
0012fcc8 001d0001
0012fccc 00000000
0012fcd0 001e04f7
0012fcd4 0012fcc0
0012fcd8 00000000
0012fcdc 0012fd4c
0012fce0 7475f1a6
0012fce4 74730850
0012fce8 ffffffff
0012fcec 0012fd20
0012fcf0 7e431923 user32!DispatchHookA+0×101
0012fcf4 00000003
0012fcf8 00000011
0012fcfc 001d0001
0012fd00 00000000
0012fd04 0012fe94
0012fd08 00000102
0012fd0c 7ffde000
0012fd10 00000000
0012fd14 00000001
0012fd18 00000003
0012fd1c 7e42b326 user32!CallHookWithSEH+0×44
0012fd20 0012fd5c
0012fd24 7e42b317 user32!CallHookWithSEH+0×21
0012fd28 00020003
0012fd2c 00000011
0012fd30 001d0001
0012fd34 747307c3
0012fd38 00000000
0012fd3c 0012fe94
0012fd40 00000102
[…]
0:000> ub 74730844
DllA!ThreadKeyboardProc+0×5e:
7473082b jne DllA!ThreadKeyboardProc+0×77 (74730844)
7473082d cmp dword ptr [ebp-1Ch],esi
74730830 je DllA!ThreadKeyboardProc+0×77 (74730844)
74730832 push dword ptr [ebp+10h]
74730835 push dword ptr [ebp+0Ch]
74730838 push dword ptr [ebp+8]
7473083b push dword ptr [ebp-1Ch]
7473083e call dword ptr [DllA!_imp__CallNextHookEx (74721248)]
Sometimes we can even reconstruct stack trace fragments that show message hooking call stack. When threads are spiking or blocked in a message hook procedure we can see a hooking module too:
0:000> kL
ChildEBP RetAddr
0012fc80 7e43e1ad ntdll!KiFastSystemCallRet
0012fca8 74730844 user32!NtUserCallNextHookEx+0xc
0012fcec 7e431923 DllA!ThreadKeyboardProc+0×77
0012fd20 7e42b317 user32!DispatchHookA+0×101
0012fd5c 7e430238 user32!CallHookWithSEH+0×21
0012fd80 7c90e473 user32!__fnHkINDWORD+0×24
0012fda4 7e4193e9 ntdll!KiUserCallbackDispatcher+0×13
0012fdd0 7e419402 user32!NtUserPeekMessage+0xc
0012fdfc 747528ee user32!PeekMessageW+0xbc
[…]
0012fff0 00000000 kernel32!BaseProcessStart+0×23
The next 2 posts will feature a case study and a modeling example.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
Sponsored link: Professional Software Debugging Services
/* Malware and Software Defects -> Victimware.org */
Copyright © 2006 - 2012. This is a non-profit research and scientific project.
_1125.png)
Citrix and Microsoft Customer Forum
Museum of Debugging and Memory Dumps
7/7/2011 - 8/8/2011 Annual Competition: Tell Your Windows Debugging Story
Crash and Hang Analysis Audit Service
CARE: Crash Analysis Report Environment
Crash Dump and Software Trace Analysis Training and Seminars
Access OpenTask Titles on Safari Books Online
DATA (Dump Analysis + Trace Analysis) Facebook group
Please join the community of memory (dump) and trace analysis engineers. This group promotes scientific methods and memory dump-based worldview.
Twitter @ DumpAnalysis You can now follow portal and blog news at DumpAnalysis on Twitter
LinkedIn Group Dr. Watson Enthusiasts All about Dr. Watson errors and more. Get news, excerpts and progress reports about the forthcoming book The Science of Dr. Watson: An Illustrated History of Debugging (ISBN 978-1906717070)
2010 (0x7DA) - The Year of Dump Analysis 2011 (0x7DB) - 2020 (0x7E4) The Debugging Decade
International Memory Analysts and Debuggers Day: 07.07 and/or 08.08 starting from The Year of Dump Analysis, 2010, 7DA
AnnouncementsComing Soon:
Fundamentals of Complete Crash and Hang Memory Dump Analysis
Management Bits: An Anthology from Reductionist Manager
Crash Dump Analysis for System Administrators and Support Engineers
New Magazines:
Debugged! MZ/PE: MagaZine for/from Practicing Engineers
New Books:
Introduction to Pattern-Driven Software Problem Solving
Memory Dump Analysis Anthology: Color Supplement for Volumes 4-5
Windows Debugging Notebook: Essential User Space WinDbg Commands
Memory Dump Analysis Anthology, Volume 5
Memory Dump Analysis Anthology, Volume 4
Memory Dump Analysis Anthology: Color Supplement for Volumes 1-3
Memory Dump Analysis Anthology, Volume 3
First Fault Software Problem Solving: A Guide for Engineers, Managers and Users
x64 Windows Debugging: Practical Foundations
Also available:
Windows Debugging: Practical Foundations
DLL List Landscape: The Art from Computer Memory Space
Dumps, Bugs and Debugging Forensics: The Adventures of Dr. Debugalov
WinDbg: A Reference Poster and Learning Cards
Memory Dump Analysis Anthology, Volume 2
Memory Dump Analysis Anthology, Volume 1
New Children's Book:
July 13th, 2010 at 3:56 pm
[…] we model Message Hooks pattern using MessageHistory tool. It uses window message hooking mechanism to intercept window […]
October 26th, 2010 at 9:22 pm
[…] the presence of the whole Pervasive System. It is not just a module that does function and / or message hooking but the whole system of modules from a single vendor that is context-aware (for example, […]