Crash Dump Analysis

Reading Notebook: 03-August-10

Tuesday, August 10th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Scatter/gather (p. 566) - you can find examples of scatter/gather I/O residues left on a thread raw stack in Hardware Activity pattern and corresponding case study:

http://www.dumpanalysis.org/blog/index.php/2010/05/08/crash-dump-analysis-patterns-part-98/

and

http://www.dumpanalysis.org/blog/index.php/2010/06/07/irp-distribution-anomaly-inconsistent-dump-execution-residue-hardware-activity-coincidental-symbolic-information-not-my-version-virtualized-system-pattern-cooperation/

IRP (pp. 566 - 567) - here is an expanded IRP structure from x64 W2K8:

0: kd> dt -r1 _IRP ntdll!_IRP +0x000 Type : Int2B +0x002 Size : Uint2B +0x008 MdlAddress : Ptr64 _MDL +0x000 Next : Ptr64 _MDL +0x008 Size : Int2B +0x00a MdlFlags : Int2B +0x010 Process : Ptr64 _EPROCESS +0x018 MappedSystemVa : Ptr64 Void +0x020 StartVa : Ptr64 Void +0x028 ByteCount : Uint4B +0x02c ByteOffset : Uint4B +0x010 Flags : Uint4B +0x018 AssociatedIrp : <unnamed-tag> +0x000 MasterIrp : Ptr64 _IRP +0x000 IrpCount : Int4B +0x000 SystemBuffer : Ptr64 Void +0x020 ThreadListEntry : _LIST_ENTRY +0x000 Flink : Ptr64 _LIST_ENTRY +0x008 Blink : Ptr64 _LIST_ENTRY +0x030 IoStatus : _IO_STATUS_BLOCK +0x000 Status : Int4B +0x000 Pointer : Ptr64 Void +0x008 Information : Uint8B +0x040 RequestorMode : Char +0x041 PendingReturned : UChar +0x042 StackCount : Char +0x043 CurrentLocation : Char +0x044 Cancel : UChar +0x045 CancelIrql : UChar +0x046 ApcEnvironment : Char +0x047 AllocationFlags : UChar +0x048 UserIosb : Ptr64 _IO_STATUS_BLOCK +0x000 Status : Int4B +0x000 Pointer : Ptr64 Void +0x008 Information : Uint8B +0x050 UserEvent : Ptr64 _KEVENT +0x000 Header : _DISPATCHER_HEADER +0x058 Overlay : <unnamed-tag> +0x000 AsynchronousParameters : <unnamed-tag> +0x000 AllocationSize : _LARGE_INTEGER +0x068 CancelRoutine : Ptr64 void +0x070 UserBuffer : Ptr64 Void +0x078 Tail : <unnamed-tag> +0x000 Overlay : <unnamed-tag> +0x000 Apc : _KAPC +0x000 CompletionKey : Ptr64 Void

IRP stack locations (pp. 568 - 569) - here is a corresponding structure from x64 W2K8:

0: kd> dt _IO_STACK_LOCATION ntdll!_IO_STACK_LOCATION +0x000 MajorFunction : UChar +0x001 MinorFunction : UChar +0x002 Flags : UChar +0x003 Control : UChar +0x008 Parameters : <unnamed-tag> +0x028 DeviceObject : Ptr64 _DEVICE_OBJECT +0x030 FileObject : Ptr64 _FILE_OBJECT +0x038 CompletionRoutine : Ptr64 long +0x040 Context : Ptr64 Void

Buffered I/O (p. 570) - this part of IRP references a buffer (user input data is copied there and device output is copied there):

+0x018 AssociatedIrp : <unnamed-tag> +0x000 MasterIrp : Ptr64 _IRP +0x000 IrpCount : Int4B +0×000 SystemBuffer : Ptr64 Void

These parts of I/O stack location structure handle buffer lengths:

+0x000 DeviceIoControl : <unnamed-tag> +0×000 OutputBufferLength : Uint4B +0×008 InputBufferLength : Uint4B +0×010 IoControlCode : Uint4B +0×018 Type3InputBuffer : Ptr64 Void

+0x000 Read : <unnamed-tag> +0×000 Length : Uint4B +0×008 Key : Uint4B +0×010 ByteOffset : _LARGE_INTEGER

+0x000 Write : <unnamed-tag> +0×000 Length : Uint4B +0×008 Key : Uint4B +0×010 ByteOffset : _LARGE_INTEGER

Direct I/O (p. 570) - these parts of IRP handle IOCTL input data (SystemBuffer, via buffering) and IOCTL output/Read/Write data (MdlAddress):

+0x008 MdlAddress : Ptr64 _MDL +0x000 Next : Ptr64 _MDL +0x008 Size : Int2B +0x00a MdlFlags : Int2B +0x010 Process : Ptr64 _EPROCESS +0x018 MappedSystemVa : Ptr64 Void +0x020 StartVa : Ptr64 Void +0x028 ByteCount : Uint4B +0x02c ByteOffset : Uint4B

+0x018 AssociatedIrp : <unnamed-tag> +0x000 MasterIrp : Ptr64 _IRP +0x000 IrpCount : Int4B +0x000 SystemBuffer : Ptr64 Void

Neither I/O (p. 571) - these parts handle input data (IO_STACK_LOCATION.Parameters.DeviceIoControl.Type3InputBuffer) and output data (IRP.UserBuffer):

+0x000 DeviceIoControl : <unnamed-tag> +0x000 OutputBufferLength : Uint4B +0x008 InputBufferLength : Uint4B +0x010 IoControlCode : Uint4B +0×018 Type3InputBuffer : Ptr64 Void

+0×070 UserBuffer : Ptr64 Void

I/O status block and kernel APC (pp. 575 - 577) - this is a part of IRP structure:

+0x030 IoStatus : _IO_STATUS_BLOCK +0x000 Status : Int4B +0x000 Pointer : Ptr64 Void +0x008 Information : Uint8B

KeSynchronizeExecution (p. 578) - here is a stack trace fragment showing it in action:

[...] b9ada518 8088d661 SCSIPORT!SpStartIoSynchronized+0x14f b9ada550 80a60147 nt!KeSynchronizeExecution+0×21 b9ada57c f72523a6 hal!HalBuildScatterGatherList+0×1c7 b9ada5c8 8081cfa2 SCSIPORT!ScsiPortStartIo+0×36a b9ada5ec f725262f nt!IoStartPacket+0×82 b9ada620 f7252146 SCSIPORT!ScsiPortFdoDispatch+0×270 b9ada63c f7251dc3 SCSIPORT!SpDispatchRequest+0×68 b9ada658 f7251299 SCSIPORT!ScsiPortPdoScsi+0×129 b9ada66c 8081df85 SCSIPORT!ScsiPortGlobalDispatch+0×1d b9ada680 f723e607 nt!IofCallDriver+0×45 b9ada690 f723e2b2 CLASSPNP!SubmitTransferPacket+0xbb b9ada6c4 f723e533 CLASSPNP!ServiceTransferRequest+0×1e4 b9ada6e8 8081df85 CLASSPNP!ClassReadWrite+0×159 b9ada6fc f74c80cf nt!IofCallDriver+0×45 b9ada70c 8081df85 PartMgr!PmReadWrite+0×95 b9ada720 f7317053 nt!IofCallDriver+0×45 b9ada73c 8081df85 ftdisk!FtDiskReadWrite+0×1a9 b9ada750 f72bf8bc nt!IofCallDriver+0×45 b9ada768 8081df85 volsnap!VolSnapRead+0×52 b9ada77c f7163a62 nt!IofCallDriver+0×45 b9ada788 f71638d9 Ntfs!NtfsSingleAsync+0×91 b9ada960 f7164156 Ntfs!NtfsNonCachedIo+0×2db b9adaa4c f7164079 Ntfs!NtfsCommonRead+0xaf5 b9adabf8 8081df85 Ntfs!NtfsFsdRead+0×113 b9adac0c f721cc45 nt!IofCallDriver+0×45 b9adac34 8081df85 fltmgr!FltpDispatch+0×6f b9adac48 bafd5373 nt!IofCallDriver+0×45 […]

IRP and layered drivers (pp. 578 - 586) - here’s a UML-style diagram (#3) for IRP flow:

http://www.dumpanalysis.org/blog/index.php/2006/10/08/uml-and-device-drivers/

Associated IRP (pp. 585 - 586) - this is a part of IRP structure:

+0x018 AssociatedIrp : <unnamed-tag> +0x000 MasterIrp : Ptr64 _IRP

File object vs. thread IRP association (p. 587)

Thread Termination and pending IRP (pp. 589 - 590) - this pattern uses I/O cancellation as an example:

http://www.dumpanalysis.org/blog/index.php/2007/12/14/crash-dump-analysis-patterns-part-42a/

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 19-July-10

Thursday, July 22nd, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Viewing the loaded driver list (pp. 546 - 547) - if we don’t see company information in lmv command output we can examine raw driver data like in this pattern: http://www.dumpanalysis.org/blog/index.php/2007/08/16/crash-dump-analysis-patterns-part-22/

DriverEntry (p. 548) - consider this as similar to main (console) or WinMain (Win32). For example, if you are writing a Windows service you have to register certain functions with SCM.

Dispatch routines (p. 548) - if you know C++ consider them as class functions for a device object where DeviceObject is a this parameter (C++ class function implementation in C where an implicit this becomes the first function argument):

NTSTATUS (*PDRIVER_DISPATCH) (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);

and a driver object can be seen as a container for a virtual function table (vtable) for a device object (purely from implementation perspective): devObj->DriverObject->MajorFunction[IRP_MJ_XXX]

Relationship between device and driver objects (pp. 553 - 554) - long time ago when I was preparing a presentation about Windows drivers for escalation engineers I created some UML diagrams you can see in the following blog post: http://www.dumpanalysis.org/blog/index.php/2006/10/08/uml-and-device-drivers/

AttachedDevice vs. AttachedTo (p.554)

File object structure and extension (pp. 556 - 557) - Here are driver, device and file object structures from x64 W2K8:

0: kd> dt _DRIVER_OBJECT ntdll!_DRIVER_OBJECT +0x000 Type : Int2B +0x002 Size : Int2B +0x008 DeviceObject : Ptr64 _DEVICE_OBJECT +0x010 Flags : Uint4B +0x018 DriverStart : Ptr64 Void +0x020 DriverSize : Uint4B +0x028 DriverSection : Ptr64 Void +0x030 DriverExtension : Ptr64 _DRIVER_EXTENSION +0x038 DriverName : _UNICODE_STRING +0x048 HardwareDatabase : Ptr64 _UNICODE_STRING +0x050 FastIoDispatch : Ptr64 _FAST_IO_DISPATCH +0x058 DriverInit : Ptr64 long +0x060 DriverStartIo : Ptr64 void +0x068 DriverUnload : Ptr64 void +0x070 MajorFunction : [28] Ptr64 long

0: kd> dt _DEVICE_OBJECT ntdll!_DEVICE_OBJECT +0x000 Type : Int2B +0x002 Size : Uint2B +0x004 ReferenceCount : Int4B +0x008 DriverObject : Ptr64 _DRIVER_OBJECT +0x010 NextDevice : Ptr64 _DEVICE_OBJECT +0x018 AttachedDevice : Ptr64 _DEVICE_OBJECT +0x020 CurrentIrp : Ptr64 _IRP +0x028 Timer : Ptr64 _IO_TIMER +0x030 Flags : Uint4B +0x034 Characteristics : Uint4B +0x038 Vpb : Ptr64 _VPB +0x040 DeviceExtension : Ptr64 Void +0x048 DeviceType : Uint4B +0x04c StackSize : Char +0x050 Queue : <unnamed-tag> +0x098 AlignmentRequirement : Uint4B +0x0a0 DeviceQueue : _KDEVICE_QUEUE +0x0c8 Dpc : _KDPC +0x108 ActiveThreadCount : Uint4B +0x110 SecurityDescriptor : Ptr64 Void +0x118 DeviceLock : _KEVENT +0x130 SectorSize : Uint2B +0x132 Spare1 : Uint2B +0x138 DeviceObjectExtension : Ptr64 _DEVOBJ_EXTENSION +0x140 Reserved : Ptr64 Void

0: kd> dt _FILE_OBJECT ntdll!_FILE_OBJECT +0x000 Type : Int2B +0x002 Size : Int2B +0x008 DeviceObject : Ptr64 _DEVICE_OBJECT +0x010 Vpb : Ptr64 _VPB +0x018 FsContext : Ptr64 Void +0x020 FsContext2 : Ptr64 Void +0x028 SectionObjectPointer : Ptr64 _SECTION_OBJECT_POINTERS +0x030 PrivateCacheMap : Ptr64 Void +0x038 FinalStatus : Int4B +0x040 RelatedFileObject : Ptr64 _FILE_OBJECT +0x048 LockOperation : UChar +0x049 DeletePending : UChar +0x04a ReadAccess : UChar +0x04b WriteAccess : UChar +0x04c DeleteAccess : UChar +0x04d SharedRead : UChar +0x04e SharedWrite : UChar +0x04f SharedDelete : UChar +0x050 Flags : Uint4B +0x058 FileName : _UNICODE_STRING +0x068 CurrentByteOffset : _LARGE_INTEGER +0x070 Waiters : Uint4B +0x074 Busy : Uint4B +0x078 LastLock : Ptr64 Void +0x080 Lock : _KEVENT +0x098 Event : _KEVENT +0x0b0 CompletionContext : Ptr64 _IO_COMPLETION_CONTEXT +0x0b8 IrpListLock : Uint8B +0x0c0 IrpList : _LIST_ENTRY +0x0d0 FileObjectExtension : Ptr64 Void

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 12-July-10

Monday, July 12th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

File and registry virtualization is for 32-bit apps only (p. 522)

Files (as locations) with executable extensions are excluded from virtualization (p. 524)

luafv.sys - filesystem virtualization driver (pp. 524 - 525)

\Users\<user>\AppData\Local\VirtualStore\Windows\*.* (p. 525)

Admin Approval Mode, over-the-shoulder and consent elevations (p. 529)

appinfo.dll -> consent.exe (p. 529)

Process reparenting (p. 531)

Running regedt32.exe to get virtualized registry view (p. 533)

Typical I/O request flow (pp. 540 - 541) - here is a stack trace example from x64 Windows for a remote file request that reaches network drivers (some irrelevant 3rd-party filter drivers like antivirus were skipped):

Child-SP RetAddr Call Site fffffadf`25d92ff0 fffffadf`28ec5b97 NetworkCardVendor!send_packet+0x33c fffffadf`25d93250 fffffadf`28ec5903 NDIS!ndisMProcessSGList+0x8e fffffadf`25d932e0 fffffadf`28e85618 NDIS!ndisMAllocSGList+0x17c fffffadf`25d933a0 fffffadf`26ab57c4 NDIS!ndisMSendX+0x21e fffffadf`25d934d0 fffffadf`26ab5999 tcpip!ARPSendData+0x23a fffffadf`25d93540 fffffadf`26ab20ea tcpip!ARPTransmit+0x151 fffffadf`25d935d0 fffffadf`26aaecad tcpip!IPTransmit+0xaf5 fffffadf`25d93850 fffffadf`26aa94c6 tcpip!TCPSend+0x8d5 fffffadf`25d93930 fffffadf`26aafa8c tcpip!TdiSend+0x344 fffffadf`25d939a0 fffffadf`26a4085c tcpip!TCPSendData+0xee fffffadf`25d93a00 fffffadf`26a4845b netbt!NTSend+0x227 fffffadf`25d93ac0 fffffadf`269a546d netbt!NbtDispatchInternalCtrl+0x38 fffffadf`25d93c50 fffffadf`269cea18 rdbss!RxTdiSend+0x1a2 fffffadf`25d93cf0 fffffadf`2693efcf rdbss!RxCeSend+0x98 fffffadf`25d93d80 fffffadf`268d82fd mrxsmb!VctTranceive+0xa6 fffffadf`25d93de0 fffffadf`2693fea9 mrxsmb!SmbCeTranceive+0x483 fffffadf`25d93e70 fffffadf`2693e94b mrxsmb!SmbTransactExchangeStart+0x558 fffffadf`25d93f20 fffffadf`26940abf mrxsmb!SmbCeInitiateExchange+0x2fd fffffadf`25d93f70 fffffadf`26940c5b mrxsmb!SmbCeSubmitTransactionRequest+0x148 fffffadf`25d93fe0 fffffadf`269412e0 mrxsmb!_SmbCeTransact+0x1a1 fffffadf`25d940c0 fffffadf`26941625 mrxsmb!MRxSmbQueryFileInformation+0x811 fffffadf`25d94220 fffffadf`26941dfa mrxsmb!MRxSmbQueryFileInformationFromPseudoOpen+0x116 fffffadf`25d94260 fffffadf`2693e94b mrxsmb!SmbPseExchangeStart_Create+0x2da fffffadf`25d94300 fffffadf`2693f50c mrxsmb!SmbCeInitiateExchange+0x2fd fffffadf`25d94350 fffffadf`269cc4c1 mrxsmb!MRxSmbCreate+0x5d6 fffffadf`25d94430 fffffadf`269cc730 rdbss!RxCollapseOrCreateSrvOpen+0x154 fffffadf`25d944d0 fffffadf`269c7a92 rdbss!RxCreateFromNetRoot+0x399 fffffadf`25d94570 fffffadf`269a2a77 rdbss!RxCommonCreate+0x49a fffffadf`25d94680 fffffadf`269343e8 rdbss!RxFsdCommonDispatch+0x51c fffffadf`25d94780 fffffadf`290bfdb3 mrxsmb!MRxSmbFsdDispatch+0x211 fffffadf`25d947d0 fffffadf`290bfdb3 fltmgr!FltpCreate+0x353 [...] fffffadf`25d98460 fffff800`012840b4 nt!IopParseDevice+0x1088 fffffadf`25d98610 fffff800`012887d7 nt!ObpLookupObjectName+0x931 fffffadf`25d98720 fffff800`01295dad nt!ObOpenObjectByName+0x180 fffffadf`25d98910 fffff800`0129cd87 nt!IopCreateFile+0x630 fffffadf`25d98aa0 fffff800`012987f9 nt!IoCreateFile+0x12f fffffadf`25d98b80 fffff800`0102e5fd nt!NtOpenFile+0x49 fffffadf`25d98c00 00000000`77ef0d1a nt!KiSystemServiceCopyEnd+0x3 00000000`000ac568 00000000`77d6f7c9 ntdll!NtCreateFile+0xa 00000000`000ac570 000007ff`7fd535c3 kernel32!CreateFileW+0x511

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 16-June-10

Friday, June 18th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Local security policy audit (pp. 511 - 512) - I used in the past to recommend process audit to track process launch sequences for debugging purposes

Access tokens have separate ACL (pp. 512 - 513)

MSV1_0 - local authentication package (p. 513)

Default credential providers authui.dll amd SmartcardCredentialProvider.dll (p. 514) - Here are stack traces from x64 LogonUI.exe:

THREAD fffffa8013dde9d0 Cid 0238.04f8 Teb: 000007fffffd7000 Win32Thread: fffff900c0679d50 WAIT: (UserRequest) UserMode Non-Alertable fffffa8013ddee60 SynchronizationEvent fffffa8013dde810 SynchronizationEvent Not impersonating DeviceMap fffff88000008e00 Owning Process fffffa80296ecae0 Image: LogonUI.exe Attached Process N/A Image: N/A Wait Start TickCount 26019 Ticks: 402642 (0:01:44:41.255) Context Switch Count 170 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.046 Win32 Start Address authui!CCredentialProviderThread::_sThreadProc (0x000007fefc6d151c) Stack Init fffffa6008efadb0 Current fffffa6008efa230 Base fffffa6008efb000 Limit fffffa6008ef5000 Call 0 Priority 15 BasePriority 13 PriorityDecrement 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffffa60`08efa270 fffff800`01a6b9fa nt!KiSwapContext+0x7f fffffa60`08efa3b0 fffff800`01a712db nt!KiSwapThread+0x13a fffffa60`08efa420 fffff800`01cd160e nt!KeWaitForMultipleObjects+0x2eb fffffa60`08efa4a0 fffff800`01cd1c53 nt!ObpWaitForMultipleObjects+0x26e fffffa60`08efa960 fffff800`01a69233 nt!NtWaitForMultipleObjects+0xe2 fffffa60`08efabb0 00000000`778c72ca nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffffa60`08efac20) 00000000`0211f978 00000000`7769bc03 ntdll!ZwWaitForMultipleObjects+0xa 00000000`0211f980 00000000`777ce2b5 kernel32!WaitForMultipleObjectsEx+0x10b 00000000`0211fa90 00000000`777ce32e USER32!RealMsgWaitForMultipleObjectsEx+0x129 00000000`0211fb30 000007fe`fe4fb196 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0211fb70 000007fe`fe608d42 ole32!CCliModalLoop::BlockFn+0xb6 00000000`0211fbb0 000007fe`fc6d07ad ole32!CoWaitForMultipleHandles+0x102 00000000`0211fcb0 000007fe`fc6d15d4 authui!InternalCoWaitForSingleHandle+0x31 00000000`0211fcf0 000007fe`fc6d1525 authui!CCredentialProviderThread::_vThreadProc+0xa0 00000000`0211fd30 00000000`7769be3d authui!CCredentialProviderThread::_sThreadProc+0x9 00000000`0211fd60 00000000`778a6a51 kernel32!BaseThreadInitThunk+0xd 00000000`0211fd90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa8013e48060 Cid 0238.0610 Teb: 000007fffffa0000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8013e4ab50 NotificationEvent fffffa8013e425b0 SynchronizationEvent Not impersonating DeviceMap fffff88000008e00 Owning Process fffffa80296ecae0 Image: LogonUI.exe Attached Process N/A Image: N/A Wait Start TickCount 13245 Ticks: 415416 (0:01:48:00.531) Context Switch Count 29 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address SmartcardCredentialProvider!I_ReaderMonitorThreadProc (0x000007fefc481db0) Stack Init fffffa6009181db0 Current fffffa6009181230 Base fffffa6009182000 Limit fffffa600917c000 Call 0 Priority 15 BasePriority 13 PriorityDecrement 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffffa60`09181270 fffff800`01a6b9fa nt!KiSwapContext+0x7f fffffa60`091813b0 fffff800`01a712db nt!KiSwapThread+0x13a fffffa60`09181420 fffff800`01cd160e nt!KeWaitForMultipleObjects+0x2eb fffffa60`091814a0 fffff800`01cd1c53 nt!ObpWaitForMultipleObjects+0x26e fffffa60`09181960 fffff800`01a69233 nt!NtWaitForMultipleObjects+0xe2 fffffa60`09181bb0 00000000`778c72ca nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffffa60`09181c20) 00000000`045efa48 00000000`7769bc03 ntdll!ZwWaitForMultipleObjects+0xa 00000000`045efa50 00000000`77691aa1 kernel32!WaitForMultipleObjectsEx+0x10b 00000000`045efb60 000007fe`fc4819bb kernel32!WaitForMultipleObjects+0x11 00000000`045efba0 000007fe`fc481de1 SmartcardCredentialProvider!I_ReaderMonitorWorker+0x8f 00000000`045efc30 00000000`7769be3d SmartcardCredentialProvider!I_ReaderMonitorThreadProc+0x31 00000000`045efc70 00000000`778a6a51 kernel32!BaseThreadInitThunk+0xd 00000000`045efca0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

Win32k.sys sends keyboard messages to LogonUI.exe via RPC (p. 514)

Secondary authentication providers in LogonUI.exe, SSON (p. 515)

wininit.exe is for session 0 legacy GUI processes (p. 516)

Raw input thread (p. 516) - here’re 3 kinds of csrss.exe (different IRPs):

session 0 (no IRP)

THREAD fffffa8013a7d980 Cid 02ec.0338 Teb: 000007fffffae000 Win32Thread: fffff900c00da010 WAIT: (WrUserRequest) KernelMode Alertable fffffa8013665d00 SynchronizationEvent fffffa8013037df0 NotificationTimer fffffa8013665c80 SynchronizationTimer fffff80001bb9f60 NotificationEvent Not impersonating DeviceMap fffff88000008e00 Owning Process fffffa8029668710 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 428616 Ticks: 45 (0:00:00:00.702) Context Switch Count 317 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address winsrv!StartCreateSystemThreads (0x000007fefde7c3b0) Stack Init fffffa6002c33db0 Current fffffa6002c33890 Base fffffa6002c34000 Limit fffffa6002c2e000 Call 0 Priority 15 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffffa60`02c338d0 fffff800`01a6b9fa nt!KiSwapContext+0x7f fffffa60`02c33a10 fffff800`01a712db nt!KiSwapThread+0x13a fffffa60`02c33a80 fffff960`000ed088 nt!KeWaitForMultipleObjects+0x2eb fffffa60`02c33b00 fffff960`00068317 win32k!RawInputThread+0x79c fffffa60`02c33bc0 fffff960`000eddc6 win32k!xxxCreateSystemThreads+0x67 fffffa60`02c33bf0 fffff800`01a69233 win32k!NtUserCallNoParam+0x36 fffffa60`02c33c20 000007fe`fde7c3da nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffffa60`02c33c20) 00000000`002afd98 000007fe`fde7c3c9 winsrv!ZwUserCallNoParam+0xa 00000000`002afda0 00000000`778e2f6c winsrv!StartCreateSystemThreads+0x19 00000000`002afdd0 00000000`00000000 ntdll!RtlUserThreadStart+0x29

session 1 (console, keyboard IRP)

THREAD fffffa80296821d0 Cid 0324.0370 Teb: 000007fffffd3000 Win32Thread: fffff900c00e33b0 WAIT: (WrUserRequest) KernelMode Alertable fffffa80137c6430 SynchronizationEvent fffffa802967fc30 NotificationTimer fffffa8029680360 SynchronizationTimer fffffa802967f970 SynchronizationEvent IRP List: fffffa802968b2e0: (0006,03a0) Flags: 00060970 Mdl: 00000000 fffffa802960d4c0: (0006,03a0) Flags: 00060970 Mdl: 00000000 fffffa8012ec7470: (0006,03a0) Flags: 00060970 Mdl: 00000000 Not impersonating DeviceMap fffff88000008e00 Owning Process fffffa8029672c10 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 428605 Ticks: 56 (0:00:00:00.873) Context Switch Count 24934 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address winsrv!StartCreateSystemThreads (0×000007fefde7c3b0) Stack Init fffffa6008bd0db0 Current fffffa6008bd0890 Base fffffa6008bd1000 Limit fffffa6008bcb000 Call 0 Priority 15 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffffa60`08bd08d0 fffff800`01a6b9fa nt!KiSwapContext+0×7f fffffa60`08bd0a10 fffff800`01a712db nt!KiSwapThread+0×13a fffffa60`08bd0a80 fffff960`000ed088 nt!KeWaitForMultipleObjects+0×2eb fffffa60`08bd0b00 fffff960`00068317 win32k!RawInputThread+0×79c fffffa60`08bd0bc0 fffff960`000eddc6 win32k!xxxCreateSystemThreads+0×67 fffffa60`08bd0bf0 fffff800`01a69233 win32k!NtUserCallNoParam+0×36 fffffa60`08bd0c20 000007fe`fde7c3da nt!KiSystemServiceCopyEnd+0×13 (TrapFrame @ fffffa60`08bd0c20) 00000000`014afab8 000007fe`fde7c3c9 winsrv!ZwUserCallNoParam+0xa 00000000`014afac0 00000000`778e2f6c winsrv!StartCreateSystemThreads+0×19 00000000`014afaf0 00000000`00000000 ntdll!RtlUserThreadStart+0×29

15: kd> !irp fffffa802968b2e0 Irp is active with 7 stacks 7 is current (= 0xfffffa802968b560) No Mdl: System buffer=fffffa8029688790: Thread fffffa80296821d0: Irp stack trace. cmd flg cl Device File Completion-Context [ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000 >[ 3, 0] 0 1 fffffa8013703ce0 fffffa8029687670 00000000-00000000 pending \Driver\kbdclass Args: 00000078 00000000 00000000 00000000

15: kd> !irp fffffa802960d4c0 Irp is active with 10 stacks 10 is current (= 0xfffffa802960d818) No Mdl: System buffer=fffffa8029681010: Thread fffffa80296821d0: Irp stack trace. cmd flg cl Device File Completion-Context [ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000 >[ 3, 0] 0 1 fffffa801392ace0 fffffa8029686880 00000000-00000000 pending \Driver\kbdclass Args: 00000078 00000000 00000000 00000000

15: kd> !irp fffffa8012ec7470 Irp is active with 3 stacks 3 is current (= 0xfffffa8012ec75d0) No Mdl: System buffer=fffffa8029687010: Thread fffffa80296821d0: Irp stack trace. cmd flg cl Device File Completion-Context [ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000 >[ 3, 0] 0 1 fffffa8013722060 fffffa8029680200 00000000-00000000 pending \Driver\kbdclass Args: 00000078 00000000 00000000 00000000

session N (terminal services, termdd IRP)

THREAD fffffa80168fbac0 Cid 175c.533c Teb: 000007fffffae000 Win32Thread: fffff900c018d010 WAIT: (WrUserRequest) KernelMode Alertable fffffa8015355e70 SynchronizationEvent fffffa8016442950 NotificationTimer fffffa80156f9f70 SynchronizationTimer fffffa8016967a50 SynchronizationEvent IRP List: fffffa801501ba30: (0006,0118) Flags: 00060900 Mdl: 00000000 Not impersonating DeviceMap fffff88000008e00 Owning Process fffffa802b33ac10 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 428641 Ticks: 20 (0:00:00:00.312) Context Switch Count 32238 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.218 Win32 Start Address winsrv!StartCreateSystemThreads (0×000007fefde7c3b0) Stack Init fffffa601ccdbdb0 Current fffffa601ccdb890 Base fffffa601ccdc000 Limit fffffa601ccd6000 Call 0 Priority 15 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffffa60`1ccdb8d0 fffff800`01a6b9fa nt!KiSwapContext+0×7f fffffa60`1ccdba10 fffff800`01a712db nt!KiSwapThread+0×13a fffffa60`1ccdba80 fffff960`000ed088 nt!KeWaitForMultipleObjects+0×2eb fffffa60`1ccdbb00 fffff960`00068317 win32k!RawInputThread+0×79c fffffa60`1ccdbbc0 fffff960`000eddc6 win32k!xxxCreateSystemThreads+0×67 fffffa60`1ccdbbf0 fffff800`01a69233 win32k!NtUserCallNoParam+0×36 fffffa60`1ccdbc20 000007fe`fde7c3da nt!KiSystemServiceCopyEnd+0×13 (TrapFrame @ fffffa60`1ccdbc20) 00000000`0137f878 000007fe`fde7c3c9 winsrv!ZwUserCallNoParam+0xa 00000000`0137f880 00000000`778e2f6c winsrv!StartCreateSystemThreads+0×19 00000000`0137f8b0 00000000`00000000 ntdll!RtlUserThreadStart+0×29

15: kd> !irp fffffa801501ba30 Irp is active with 1 stacks 1 is current (= 0xfffffa801501bb00) No Mdl: No System Buffer: Thread fffffa80168fbac0: Irp stack trace. cmd flg cl Device File Completion-Context >[ 3, 0] 0 1 fffffa801370adb0 fffffa801705ef20 00000000-00000000 pending \Driver\TermDD Args: 00000078 00000000 00000000 00000000

Half-hash caching of passwords (p. 517)

logonsessions tool (pp. 519 - 520)

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 31-May-10

Monday, May 31st, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Objects vs. account attributes, privilege vs. account right (p. 501)

NtRaiseHardError requires SeShutdownPrivilege (p. 508)

firmware environment variables (p. 508) - some more info: http://msdn.microsoft.com/en-us/library/ms724325(VS.85).aspx

Implication of Bypass Traverse Checking (SeNotifyPrivilege) (p. 509)

Elevated priviliges don’t extend past machine boundaries (p. 510)

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 26-May-10

Thursday, May 27th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Explicit ACE are ahead of inherited (p. 491)

Differences of inheritable ACE propagation AD objects (p. 491)

Ntmarta.dll: security inheritance support DLL (p. 492)

SeAccessCheck optimization: integrity check -> DACL check (p. 492)

Low and medium integrity processes can read high integrity objects (p. 493)

UIPI safe messages, shatter attacks, blocked (journal) hooks (pp. 493 - 494)

Owner Rights SID (pp. 495 - 496)

Importance of ACE ordering (pp. 497 - 498)

Security editors place Deny ACE on top, Advanced Settings and Effective Permissions (pp. 498 - 500)

AuthZ API: security model in user mode (pp. 500 - 501)

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 25-May-10

Tuesday, May 25th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

No share access for impersonation: we need logon (p. 481)

S(ecure)QOS levels, SECURITY_CONTEXT_TRACKING (p. 482)

Integrity Level (client) <= Integrity Level (server) (pp. 482 - 483)

Restricted tokens -> filtered admin tokens (logon as admin with UAC) (pp. 483 - 484)

Callback, allowed(denied)-object (GUID-based for AD) ACEs (p. 487)

No DACL: full access, empty DACL: no access (p. 487)

System audit-object ACEs (p. 488)

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 24-May-10

Monday, May 24th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Process integrity levels as SIDs (pp. 464 - 465)

Protected mode IE startup sequence (pp. 467 - 470) - ieuser.exe might block several iexplore.exe instances: http://www.dumpanalysis.org/blog/index.php/2009/02/11/stack-trace-collection-blocked-thread-and-coupled-processes-pattern-cooperation/

Integrity levels and mandatory policies for objects (pp. 471- 473)

Many faces of an Administrator, filtered admin tokens (p. 474)

CreateProcessWithLogonW (p. 474)

The token source field (p. 476)

Token authentication and modified IDs (pp. 476 - 477) - token structure from x64 Windows Server R2:

0: kd> dt _TOKEN nt!_TOKEN +0x000 TokenSource : _TOKEN_SOURCE +0x010 TokenId : _LUID +0x018 AuthenticationId : _LUID +0x020 ParentTokenId : _LUID +0x028 ExpirationTime : _LARGE_INTEGER +0x030 TokenLock : Ptr64 _ERESOURCE +0x038 ModifiedId : _LUID +0x040 Privileges : _SEP_TOKEN_PRIVILEGES +0x058 AuditPolicy : _SEP_AUDIT_POLICY +0x074 SessionId : Uint4B +0x078 UserAndGroupCount : Uint4B +0x07c RestrictedSidCount : Uint4B +0x080 VariableLength : Uint4B +0x084 DynamicCharged : Uint4B +0x088 DynamicAvailable : Uint4B +0x08c DefaultOwnerIndex : Uint4B +0x090 UserAndGroups : Ptr64 _SID_AND_ATTRIBUTES +0x098 RestrictedSids : Ptr64 _SID_AND_ATTRIBUTES +0x0a0 PrimaryGroup : Ptr64 Void +0x0a8 DynamicPart : Ptr64 Uint4B +0x0b0 DefaultDacl : Ptr64 _ACL +0x0b8 TokenType : _TOKEN_TYPE +0x0bc ImpersonationLevel : _SECURITY_IMPERSONATION_LEVEL +0x0c0 TokenFlags : Uint4B +0x0c4 TokenInUse : UChar +0x0c8 IntegrityLevelIndex : Uint4B +0x0cc MandatoryPolicy : Uint4B +0x0d0 LogonSession : Ptr64 _SEP_LOGON_SESSION_REFERENCES +0x0d8 OriginatingLogonSession : _LUID +0x0e0 SidHash : _SID_AND_ATTRIBUTES_HASH +0x1f0 RestrictedSidHash : _SID_AND_ATTRIBUTES_HASH +0x300 pSecurityAttributes : Ptr64 _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION +0x308 VariablePart : Uint8B

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 12-May-10

Thursday, May 13th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

SAS -> winlogon.exe starts LogonUI.exe (p. 455) - Here are winlogon.exe threads on x64 W2K8 R2 before SAS:

THREAD fffffa8003cf7060 Cid 01d0.01d4 Teb: 000007fffffdd000 Win32Thread: fffff900c00df900 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004991c90 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003cf65a0 Image: winlogon.exe Attached Process N/A Image: N/A Wait Start TickCount 8831 Ticks: 21731 (0:00:05:39.005) Context Switch Count 424 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.015 Win32 Start Address winlogon!WinMainCRTStartup (0x00000000ff36ec08) Stack Init fffff88003595db0 Current fffff88003595900 Base fffff88003596000 Limit fffff8800358c000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`03595940 fffff800`01ac3752 nt!KiSwapContext+0x7a fffff880`03595a80 fffff800`01ac58af nt!KiCommitThreadWait+0x1d2 fffff880`03595b10 fffff800`01db7db2 nt!KeWaitForSingleObject+0x19f fffff880`03595bb0 fffff800`01abb853 nt!NtWaitForSingleObject+0xb2 fffff880`03595c20 00000000`77bafefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`03595c20) 00000000`0018f778 000007fe`fdc910ac ntdll!NtWaitForSingleObject+0xa 00000000`0018f780 00000000`ff3619ad KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0018f820 00000000`ff3616e8 winlogon!SignalManagerWaitForSignal+0x135 00000000`0018f860 00000000`ff36b8b0 winlogon!StateMachineRun+0x404 00000000`0018fb80 00000000`ff36ed85 winlogon!WinMain+0x13a3 00000000`0018fcf0 00000000`77a5f56d winlogon!I_WMsgkSendMessage+0x252 00000000`0018fdb0 00000000`77b93281 kernel32!BaseThreadInitThunk+0xd 00000000`0018fde0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa800498a060 Cid 01d0.0320 Teb: 000007fffffd7000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa800497bef0 SynchronizationTimer fffffa8004988060 SynchronizationTimer fffffa8004bfe2a0 NotificationEvent fffffa8003c783b0 SynchronizationEvent fffffa8003c78310 SynchronizationEvent fffffa8003c78450 SynchronizationEvent fffffa80049894c0 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003cf65a0 Image: winlogon.exe Attached Process N/A Image: N/A Wait Start TickCount 19271 Ticks: 11291 (0:00:02:56.140) Context Switch Count 16 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x0000000077b79a90) Stack Init fffff88004006db0 Current fffff88004005fd0 Base fffff88004007000 Limit fffff88004001000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04006010 fffff800`01ac3752 nt!KiSwapContext+0x7a fffff880`04006150 fffff800`01abfc4b nt!KiCommitThreadWait+0x1d2 fffff880`040061e0 fffff800`01db8ecf nt!KeWaitForMultipleObjects+0x271 fffff880`04006490 fffff800`01db97d6 nt!ObpWaitForMultipleObjects+0x294 fffff880`04006960 fffff800`01abb853 nt!NtWaitForMultipleObjects+0xe5 fffff880`04006bb0 00000000`77bb046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04006c20) 00000000`0139f848 00000000`77b79bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`0139f850 00000000`77a5f56d ntdll!TppWaiterpThread+0x14d 00000000`0139faf0 00000000`77b93281 kernel32!BaseThreadInitThunk+0xd 00000000`0139fb20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa8004ed7060 Cid 01d0.0a58 Teb: 000007fffffdb000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa800489ac20 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003cf65a0 Image: winlogon.exe Attached Process N/A Image: N/A Wait Start TickCount 27861 Ticks: 2701 (0:00:00:42.135) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x0000000077b78f00) Stack Init fffff88003555db0 Current fffff880035557d0 Base fffff88003556000 Limit fffff88003550000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`03555810 fffff800`01ac3752 nt!KiSwapContext+0x7a fffff880`03555950 fffff800`01ac71c1 nt!KiCommitThreadWait+0x1d2 fffff880`035559e0 fffff800`01db89d7 nt!KeRemoveQueueEx+0x301 fffff880`03555a90 fffff800`01acc996 nt!IoRemoveIoCompletion+0x47 fffff880`03555b20 fffff800`01abb853 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`03555c20 00000000`77bb17ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`03555c20) 00000000`00dcfa18 00000000`77b7914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00dcfa20 00000000`77a5f56d ntdll!TppWorkerThread+0x2c9 00000000`00dcfd20 00000000`77b93281 kernel32!BaseThreadInitThunk+0xd 00000000`00dcfd50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

Here are main threads from both processes on x64 W2K8 R2 after SAS (I brought change password dialog):

THREAD fffffa8004888770 Cid 01c0.01c4 Teb: 000007fffffde000 Win32Thread: fffff900c00d9c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa80049c25c0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048879d0 Image: winlogon.exe Attached Process N/A Image: N/A Wait Start TickCount 34664851 Ticks: 1875 (0:00:00:29.250) Context Switch Count 3202 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.218 Win32 Start Address winlogon!WinMainCRTStartup (0x00000000ffc2ec08) Stack Init fffff880031acdb0 Current fffff880031ac900 Base fffff880031ad000 Limit fffff880031a7000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`031ac940 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`031aca80 fffff800`01ad88af nt!KiCommitThreadWait+0x1d2 fffff880`031acb10 fffff800`01dcadb2 nt!KeWaitForSingleObject+0x19f fffff880`031acbb0 fffff800`01ace853 nt!NtWaitForSingleObject+0xb2 fffff880`031acc20 00000000`76e2fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`031acc20) 00000000`0023f398 000007fe`fd0810ac ntdll!NtWaitForSingleObject+0xa 00000000`0023f3a0 00000000`ffc219ad KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0023f440 00000000`ffc216e8 winlogon!SignalManagerWaitForSignal+0x135 00000000`0023f480 00000000`ffc2b8b0 winlogon!StateMachineRun+0x404 00000000`0023f7a0 00000000`ffc2ed85 winlogon!WinMain+0x13a3 00000000`0023f910 00000000`76bdf56d winlogon!I_WMsgkSendMessage+0x252 00000000`0023f9d0 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`0023fa00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa80049ba060 Cid 01c0.0304 Teb: 000007fffffd7000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa80049b87e0 SynchronizationTimer fffffa80049b4650 SynchronizationTimer fffffa8004e81e20 NotificationEvent fffffa8004edcbf0 SynchronizationEvent fffffa8004edcb50 SynchronizationEvent fffffa8004edcc90 SynchronizationEvent fffffa80049b8670 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048879d0 Image: winlogon.exe Attached Process N/A Image: N/A Wait Start TickCount 34428081 Ticks: 238645 (0:01:02:02.885) Context Switch Count 175 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x0000000076df9a90) Stack Init fffff88004193db0 Current fffff88004192fd0 Base fffff88004194000 Limit fffff8800418e000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04193010 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`04193150 fffff800`01ad2c4b nt!KiCommitThreadWait+0x1d2 fffff880`041931e0 fffff800`01dcbecf nt!KeWaitForMultipleObjects+0x271 fffff880`04193490 fffff800`01dcc7d6 nt!ObpWaitForMultipleObjects+0x294 fffff880`04193960 fffff800`01ace853 nt!NtWaitForMultipleObjects+0xe5 fffff880`04193bb0 00000000`76e3046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04193c20) 00000000`00d2fb38 00000000`76df9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00d2fb40 00000000`76bdf56d ntdll!TppWaiterpThread+0x14d 00000000`00d2fde0 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`00d2fe10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa8005b8e810 Cid 01c0.12d4 Teb: 000007fffffdc000 Win32Thread: fffff900c37a6250 WAIT: (WrLpcReply) UserMode Non-Alertable fffffa8005b8ebd0 Semaphore Limit 0x1 Waiting for reply to ALPC Message fffff8a00c87e750 : queued at port fffffa800661ec60 : owned by process fffffa8005f442b0 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048879d0 Image: winlogon.exe Attached Process N/A Image: N/A Wait Start TickCount 34664851 Ticks: 1875 (0:00:00:29.250) Context Switch Count 150 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0×0000000076df8f00) Stack Init fffff88006c8edb0 Current fffff88006c8e620 Base fffff88006c8f000 Limit fffff88006c87000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`06c8e660 fffff800`01ad6752 nt!KiSwapContext+0×7a fffff880`06c8e7a0 fffff800`01ad88af nt!KiCommitThreadWait+0×1d2 fffff880`06c8e830 fffff800`01aedbef nt!KeWaitForSingleObject+0×19f fffff880`06c8e8d0 fffff800`01dd6a36 nt!AlpcpSignalAndWait+0×8f fffff880`06c8e980 fffff800`01dd49c0 nt!AlpcpReceiveSynchronousReply+0×46 fffff880`06c8e9e0 fffff800`01dd1f3b nt!AlpcpProcessSynchronousRequest+0×33d fffff880`06c8eb00 fffff800`01ace853 nt!NtAlpcSendWaitReceivePort+0×1ab fffff880`06c8ebb0 00000000`76e3070a nt!KiSystemServiceCopyEnd+0×13 (TrapFrame @ fffff880`06c8ec20) 00000000`0103f298 000007fe`fea8aa76 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`0103f2a0 000007fe`feb2cb64 RPCRT4!LRPC_CCALL::SendReceive+0×156 00000000`0103f360 000007fe`feb2cd55 RPCRT4!NdrpClientCall3+0×244 00000000`0103f620 00000000`ffc24979 RPCRT4!NdrClientCall3+0xf2 00000000`0103f9b0 00000000`ffc4e781 winlogon!WluiRequestCredentials+0×71 00000000`0103fa20 00000000`ffc21d04 winlogon!WLGeneric_Request_Change_Credz_Execute+0xa5 00000000`0103fa90 00000000`76df0fb4 winlogon!StateMachineWorkerCallback+0×7f 00000000`0103fac0 00000000`76df4b1f ntdll!TppWorkpExecuteCallback+0xa4 00000000`0103fb20 00000000`76bdf56d ntdll!TppWorkerThread+0×6c9 00000000`0103fe20 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`0103fe50 00000000`00000000 ntdll!RtlUserThreadStart+0×1d

THREAD fffffa8006480640 Cid 01c0.131c Teb: 000007fffffd9000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80042479a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048879d0 Image: winlogon.exe Attached Process N/A Image: N/A Wait Start TickCount 34664380 Ticks: 2346 (0:00:00:36.597) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x0000000076df8f00) Stack Init fffff8800715ddb0 Current fffff8800715d7d0 Base fffff8800715e000 Limit fffff88007158000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0715d810 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`0715d950 fffff800`01ada1c1 nt!KiCommitThreadWait+0x1d2 fffff880`0715d9e0 fffff800`01dcb9d7 nt!KeRemoveQueueEx+0x301 fffff880`0715da90 fffff800`01adf996 nt!IoRemoveIoCompletion+0x47 fffff880`0715db20 fffff800`01ace853 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0715dc20 00000000`76e317ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0715dc20) 00000000`010bf908 00000000`76df914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`010bf910 00000000`76bdf56d ntdll!TppWorkerThread+0x2c9 00000000`010bfc10 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`010bfc40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa8005916290 Cid 01c0.0c04 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80042479a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048879d0 Image: winlogon.exe Attached Process N/A Image: N/A Wait Start TickCount 34664851 Ticks: 1875 (0:00:00:29.250) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x0000000076df8f00) Stack Init fffff88007126db0 Current fffff880071267d0 Base fffff88007127000 Limit fffff88007121000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`07126810 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`07126950 fffff800`01ada1c1 nt!KiCommitThreadWait+0x1d2 fffff880`071269e0 fffff800`01dcb9d7 nt!KeRemoveQueueEx+0x301 fffff880`07126a90 fffff800`01adf996 nt!IoRemoveIoCompletion+0x47 fffff880`07126b20 fffff800`01ace853 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`07126c20 00000000`76e317ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`07126c20) 00000000`009cfaa8 00000000`76df914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`009cfab0 00000000`76bdf56d ntdll!TppWorkerThread+0x2c9 00000000`009cfdb0 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`009cfde0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

We now see the new thread fffffa8005b8e810 waiting for an ALPC message fffff8a00c87e750:

0: kd> !alpc /m fffff8a00c87e750

Message @ fffff8a00c87e750 MessageID : 0x0534 (1332) CallbackID : 0x14152C5 (21058245) SequenceNumber : 0x00000006 (6) Type : LPC_REQUEST DataLength : 0x0060 (96) TotalLength : 0x0088 (136) Canceled : No Release : No ReplyWaitReply : No Continuation : Yes OwnerPort : fffffa80065696c0 [ALPC_CLIENT_COMMUNICATION_PORT] WaitingThread : fffffa8005b8e810 QueueType : ALPC_MSGQUEUE_PENDING QueuePort : fffffa800661ec60 [ALPC_CONNECTION_PORT] QueuePortOwnerProcess : fffffa8005f442b0 (LogonUI.exe) ServerThread : fffffa8005a9b2a0 QuotaCharged : No CancelQueuePort : 0000000000000000 CancelSequencePort : 0000000000000000 CancelSequenceNumber : 0×00000000 (0) ClientContext : 00000000003f5b30 ServerContext : 0000000000000000 PortContext : 00000000015e2640 CancelPortContext : 0000000000000000 SecurityData : 0000000000000000 View : 0000000000000000

The server thread is fffffa8005a9b2a0 and is owned by LogonUI.exe. Here are all threads in that process where I highlighted credential providers:

THREAD fffffa8005f47b60 Cid 06d0.13e0 Teb: 000007fffffde000 Win32Thread: fffff900c1d6ec30 WAIT: (UserRequest) UserMode Non-Alertable fffffa80065be260 SynchronizationEvent fffffa8005bf6240 SynchronizationEvent fffffa8005bcbc70 SynchronizationEvent fffffa80052a9dc0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005f442b0 Image: LogonUI.exe Attached Process N/A Image: N/A Wait Start TickCount 34666693 Ticks: 33 (0:00:00:00.514) Context Switch Count 722 LargeStack UserTime 00:00:00.171 KernelTime 00:00:00.140 Win32 Start Address LogonUI!wWinMainCRTStartup (0x00000000ffb45c58) Stack Init fffff88004911db0 Current fffff88004910fd0 Base fffff88004912000 Limit fffff88004908000 Call 0 Priority 15 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04911010 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`04911150 fffff800`01ad2c4b nt!KiCommitThreadWait+0x1d2 fffff880`049111e0 fffff800`01dcbecf nt!KeWaitForMultipleObjects+0x271 fffff880`04911490 fffff800`01dcc7d6 nt!ObpWaitForMultipleObjects+0x294 fffff880`04911960 fffff800`01ace853 nt!NtWaitForMultipleObjects+0xe5 fffff880`04911bb0 00000000`76e3046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04911c20) 00000000`001bf708 000007fe`fd0813a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`001bf710 00000000`76be3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`001bf810 00000000`76cfbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`001bf8a0 000007fe`fae19ecd USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`001bf940 000007fe`fae19d8e DUser!CoreSC::DUIMsgWaitForMultipleObjectsEx+0x17c 00000000`001bf9f0 00000000`76cf9079 DUser!MphMsgWaitForMultipleObjectsEx+0x7a 00000000`001bfa30 000007fe`fb8e407b USER32!MsgWaitForMultipleObjectsEx+0x37 00000000`001bfa70 000007fe`fb8e4f6c authui!CLogonFrame::DoModal+0×67 00000000`001bfaf0 000007fe`fb8e50cf authui!CLogonUI_CreateThenDoModalThenDestroy+0×299 00000000`001bfb50 00000000`ffb454df authui!CLogonUI::DoModal+0×73 00000000`001bfb80 00000000`ffb45ae6 LogonUI!wWinMain+0xfb 00000000`001bfbe0 00000000`76bdf56d LogonUI!ParseCommandLineToStringArrayLocalAlloc+0×33a 00000000`001bfca0 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`001bfcd0 00000000`00000000 ntdll!RtlUserThreadStart+0×1d

THREAD fffffa8006595720 Cid 06d0.1158 Teb: 000007fffffdc000 Win32Thread: fffff900c35105f0 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005cad160 SynchronizationEvent fffffa8005618d30 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005f442b0 Image: LogonUI.exe Attached Process N/A Image: N/A Wait Start TickCount 34664381 Ticks: 2345 (0:00:00:36.582) Context Switch Count 2 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address msvcrt!endthreadex (0x000007feff0573fc) Stack Init fffff88005638db0 Current fffff88005637fd0 Base fffff88005639000 Limit fffff88005632000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05638010 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`05638150 fffff800`01ad2c4b nt!KiCommitThreadWait+0x1d2 fffff880`056381e0 fffff800`01dcbecf nt!KeWaitForMultipleObjects+0x271 fffff880`05638490 fffff800`01dcc7d6 nt!ObpWaitForMultipleObjects+0x294 fffff880`05638960 fffff800`01ace853 nt!NtWaitForMultipleObjects+0xe5 fffff880`05638bb0 00000000`76e3046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05638c20) 00000000`00eaf4d8 000007fe`fd0813a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`00eaf4e0 00000000`76be3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`00eaf5e0 00000000`76cfbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`00eaf670 000007fe`fae114e6 USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`00eaf710 000007fe`fae116b2 DUser!CoreSC::Wait+0x62 00000000`00eaf760 000007fe`fae205dd DUser!CoreSC::xwProcessNL+0xed 00000000`00eaf7d0 000007fe`fae20500 DUser!GetMessageExA+0x7b 00000000`00eaf820 000007fe`ff0542bf DUser!ResourceManager::SharedThreadProc+0xe8 00000000`00eaf8b0 000007fe`ff057459 msvcrt!endthreadex+0x47 00000000`00eaf8e0 00000000`76bdf56d msvcrt!endthreadex+0xe0 00000000`00eaf910 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`00eaf940 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa8006646060 Cid 06d0.1174 Teb: 000007fffffda000 Win32Thread: fffff900c397bc30 WAIT: (UserRequest) UserMode Non-Alertable fffffa80059522e0 SynchronizationEvent fffffa80061cf2d0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005f442b0 Image: LogonUI.exe Attached Process N/A Image: N/A Wait Start TickCount 34664855 Ticks: 1871 (0:00:00:29.187) Context Switch Count 101 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.015 Win32 Start Address authui!CCredentialProviderThread::_sThreadProc (0x000007fefb8e51c0) Stack Init fffff880057addb0 Current fffff880057acfd0 Base fffff880057ae000 Limit fffff880057a6000 Call 0 Priority 15 BasePriority 13 UnusualBoost 0 ForegroundBoost 1 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`057ad010 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`057ad150 fffff800`01ad2c4b nt!KiCommitThreadWait+0x1d2 fffff880`057ad1e0 fffff800`01dcbecf nt!KeWaitForMultipleObjects+0x271 fffff880`057ad490 fffff800`01dcc7d6 nt!ObpWaitForMultipleObjects+0x294 fffff880`057ad960 fffff800`01ace853 nt!NtWaitForMultipleObjects+0xe5 fffff880`057adbb0 00000000`76e3046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`057adc20) 00000000`02c5f9b8 000007fe`fd0813a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`02c5f9c0 00000000`76be3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`02c5fac0 00000000`76cfbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`02c5fb50 00000000`76cf905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`02c5fbf0 000007fe`febdb46a USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`02c5fc30 000007fe`fecfa542 ole32!CCliModalLoop::BlockFn+0xc2 00000000`02c5fc80 000007fe`fb8e4bc1 ole32!CoWaitForMultipleHandles+0x102 00000000`02c5fd90 000007fe`fb8e4a4a authui!InternalCoWaitForSingleHandle+0×31 00000000`02c5fdd0 000007fe`fb8e51c9 authui!CCredentialProviderThread::_vThreadProc+0xbf 00000000`02c5fe10 00000000`76bdf56d authui!CCredentialProviderThread::_sThreadProc+0×9 00000000`02c5fe40 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`02c5fe70 00000000`00000000 ntdll!RtlUserThreadStart+0×1d

THREAD fffffa8005a9b2a0 Cid 06d0.1248 Teb: 000007fffffd4000 Win32Thread: fffff900c397b850 WAIT: (UserRequest) UserMode Non-Alertable fffffa800559c800 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005f442b0 Image: LogonUI.exe Attached Process N/A Image: N/A Wait Start TickCount 34664851 Ticks: 1875 (0:00:00:29.250) Context Switch Count 12 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0×0000000076df8f00) Stack Init fffff88005871db0 Current fffff88005871900 Base fffff88005872000 Limit fffff8800586b000 Call 0 Priority 15 BasePriority 13 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05871940 fffff800`01ad6752 nt!KiSwapContext+0×7a fffff880`05871a80 fffff800`01ad88af nt!KiCommitThreadWait+0×1d2 fffff880`05871b10 fffff800`01dcadb2 nt!KeWaitForSingleObject+0×19f fffff880`05871bb0 fffff800`01ace853 nt!NtWaitForSingleObject+0xb2 fffff880`05871c20 00000000`76e2fefa nt!KiSystemServiceCopyEnd+0×13 (TrapFrame @ fffff880`05871c20) 00000000`02aee898 000007fe`fd0810ac ntdll!NtWaitForSingleObject+0xa 00000000`02aee8a0 000007fe`fb8e4586 KERNELBASE!WaitForSingleObjectEx+0×79 00000000`02aee940 000007fe`fb8e891c authui!InternalWaitForSingleObject+0×26 00000000`02aee980 000007fe`fb8e8ac4 authui!WPP_SF_qqddd+0×157d 00000000`02aee9e0 000007fe`fea7c7f5 authui!WluirRequestCredentials+0×44 00000000`02aeea20 000007fe`feb2b62e RPCRT4!Invoke+0×65 00000000`02aeeaa0 000007fe`fea74070 RPCRT4!Ndr64StubWorker+0×61b 00000000`02aef060 000007fe`fea79c24 RPCRT4!NdrServerCallAll+0×40 00000000`02aef0b0 000007fe`fea79d86 RPCRT4!DispatchToStubInCNoAvrf+0×14 00000000`02aef0e0 000007fe`fea7c44b RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0×146 00000000`02aef200 000007fe`fea7c38b RPCRT4!RPC_INTERFACE::DispatchToStub+0×9b 00000000`02aef240 000007fe`fea7c322 RPCRT4!RPC_INTERFACE::DispatchToStubWithObject+0×5b 00000000`02aef2c0 000007fe`fea7a11d RPCRT4!LRPC_SCALL::DispatchRequest+0×422 00000000`02aef3a0 000007fe`fea87ddf RPCRT4!LRPC_SCALL::HandleRequest+0×20d 00000000`02aef4d0 000007fe`fea87995 RPCRT4!LRPC_ADDRESS::ProcessIO+0×3bf 00000000`02aef610 00000000`76dfb43b RPCRT4!LrpcIoComplete+0xa5 00000000`02aef6a0 00000000`76df923f ntdll!TppAlpcpExecuteCallback+0×26b 00000000`02aef730 00000000`76bdf56d ntdll!TppWorkerThread+0×3f8 00000000`02aefa30 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`02aefa60 00000000`00000000 ntdll!RtlUserThreadStart+0×1d

THREAD fffffa8005941a10 Cid 06d0.0f10 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa800663a9a0 SynchronizationTimer fffffa8005881650 SynchronizationTimer fffffa8006577ef0 SynchronizationTimer fffffa8005a93bd0 NotificationEvent fffffa80063f6450 SynchronizationEvent fffffa80058fe4c0 SynchronizationEvent fffffa80064c0290 SynchronizationEvent fffffa8004e49e90 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005f442b0 Image: LogonUI.exe Attached Process N/A Image: N/A Wait Start TickCount 34664421 Ticks: 2305 (0:00:00:35.958) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x0000000076df9a90) Stack Init fffff88006946db0 Current fffff88006945fd0 Base fffff88006947000 Limit fffff88006941000 Call 0 Priority 15 BasePriority 13 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`06946010 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`06946150 fffff800`01ad2c4b nt!KiCommitThreadWait+0x1d2 fffff880`069461e0 fffff800`01dcbecf nt!KeWaitForMultipleObjects+0x271 fffff880`06946490 fffff800`01dcc7d6 nt!ObpWaitForMultipleObjects+0x294 fffff880`06946960 fffff800`01ace853 nt!NtWaitForMultipleObjects+0xe5 fffff880`06946bb0 00000000`76e3046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`06946c20) 00000000`02dbf718 00000000`76df9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`02dbf720 00000000`76bdf56d ntdll!TppWaiterpThread+0x14d 00000000`02dbf9c0 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`02dbf9f0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa80056de060 Cid 06d0.0ba8 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8005f7d3e0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005f442b0 Image: LogonUI.exe Attached Process N/A Image: N/A Wait Start TickCount 34664389 Ticks: 2337 (0:00:00:36.457) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x0000000076df8f00) Stack Init fffff8800569ddb0 Current fffff8800569d7d0 Base fffff8800569e000 Limit fffff88005698000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0569d810 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`0569d950 fffff800`01ada1c1 nt!KiCommitThreadWait+0x1d2 fffff880`0569d9e0 fffff800`01dcb9d7 nt!KeRemoveQueueEx+0x301 fffff880`0569da90 fffff800`01adf996 nt!IoRemoveIoCompletion+0x47 fffff880`0569db20 fffff800`01ace853 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0569dc20 00000000`76e317ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0569dc20) 00000000`035cfbb8 00000000`76df914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`035cfbc0 00000000`76bdf56d ntdll!TppWorkerThread+0x2c9 00000000`035cfec0 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`035cfef0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa8005ccfa10 Cid 06d0.03a0 Teb: 000007fffffd8000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8005f7d3e0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005f442b0 Image: LogonUI.exe Attached Process N/A Image: N/A Wait Start TickCount 34664420 Ticks: 2306 (0:00:00:35.973) Context Switch Count 7 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x0000000076df8f00) Stack Init fffff8800459bdb0 Current fffff8800459b7d0 Base fffff8800459c000 Limit fffff88004596000 Call 0 Priority 15 BasePriority 13 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0459b810 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`0459b950 fffff800`01ada1c1 nt!KiCommitThreadWait+0x1d2 fffff880`0459b9e0 fffff800`01dcb9d7 nt!KeRemoveQueueEx+0x301 fffff880`0459ba90 fffff800`01adf996 nt!IoRemoveIoCompletion+0x47 fffff880`0459bb20 fffff800`01ace853 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0459bc20 00000000`76e317ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0459bc20) 00000000`02e5f8c8 00000000`76df914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`02e5f8d0 00000000`76bdf56d ntdll!TppWorkerThread+0x2c9 00000000`02e5fbd0 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`02e5fc00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa800662a800 Cid 06d0.0a54 Teb: 000007fffffaa000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800662aad8 Semaphore Limit 0x2 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005f442b0 Image: LogonUI.exe Attached Process N/A Image: N/A Wait Start TickCount 34664389 Ticks: 2337 (0:00:00:36.457) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ole32!CRpcThreadCache::RpcWorkerThreadEntry (0x000007fefebf3570) Stack Init fffff8800568fdb0 Current fffff8800568f970 Base fffff88005690000 Limit fffff8800568a000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0568f9b0 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`0568faf0 fffff800`01ad8e56 nt!KiCommitThreadWait+0x1d2 fffff880`0568fb80 fffff800`01dcacee nt!KeDelayExecutionThread+0x186 fffff880`0568fbf0 fffff800`01ace853 nt!NtDelayExecution+0x59 fffff880`0568fc20 00000000`76e301fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0568fc20) 00000000`0371fa68 000007fe`fd081203 ntdll!NtDelayExecution+0xa 00000000`0371fa70 000007fe`febeea00 KERNELBASE!SleepEx+0xab 00000000`0371fb10 000007fe`febf2046 ole32!CROIDTable::WorkerThreadLoop+0x10 00000000`0371fb40 000007fe`febf358a ole32!CRpcThread::WorkerLoop+0x1e 00000000`0371fb80 00000000`76bdf56d ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a 00000000`0371fbb0 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`0371fbe0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa80063a4490 Cid 06d0.0ca0 Teb: 000007fffffa8000 Win32Thread: fffff900c1fffc30 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa80063a4850 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005f442b0 Image: LogonUI.exe Attached Process N/A Image: N/A Wait Start TickCount 34664404 Ticks: 2322 (0:00:00:36.223) Context Switch Count 11 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address MSCTF!CCtfServerPort::StaticServerThread (0x000007fefe959274) Stack Init fffff88005b30db0 Current fffff88005b30750 Base fffff88005b31000 Limit fffff88005b2a000 Call 0 Priority 15 BasePriority 13 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b30790 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`05b308d0 fffff800`01ad88af nt!KiCommitThreadWait+0x1d2 fffff880`05b30960 fffff800`01dcf329 nt!KeWaitForSingleObject+0x19f fffff880`05b30a00 fffff800`01dd0a37 nt!AlpcpReceiveMessagePort+0x189 fffff880`05b30a60 fffff800`01dd1f76 nt!AlpcpReceiveMessage+0x2d4 fffff880`05b30b00 fffff800`01ace853 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`05b30bb0 00000000`76e3070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b30c20) 00000000`0390e7b8 000007fe`fe9426a9 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`0390e7c0 000007fe`fe959417 MSCTF!CCtfServerPort::ServerLoop+0x16c 00000000`0390f8e0 000007fe`fe959296 MSCTF!CCtfServerPort::ServerThread+0x15b 00000000`0390fc20 00000000`76bdf56d MSCTF!CCtfServerPort::StaticServerThread+0x28 00000000`0390fc50 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`0390fc80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa800489eb60 Cid 06d0.13b8 Teb: 000007fffffa6000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005833be0 NotificationEvent fffffa8005a03ad0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005f442b0 Image: LogonUI.exe Attached Process N/A Image: N/A Wait Start TickCount 34664421 Ticks: 2305 (0:00:00:35.958) Context Switch Count 19 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address SmartcardCredentialProvider!I_ReaderMonitorThreadProc (0x000007feed747028) Stack Init fffff88005894db0 Current fffff88005893fd0 Base fffff88005895000 Limit fffff8800588f000 Call 0 Priority 15 BasePriority 13 UnusualBoost 0 ForegroundBoost 1 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05894010 fffff800`01ad6752 nt!KiSwapContext+0x7a fffff880`05894150 fffff800`01ad2c4b nt!KiCommitThreadWait+0x1d2 fffff880`058941e0 fffff800`01dcbecf nt!KeWaitForMultipleObjects+0x271 fffff880`05894490 fffff800`01dcc7d6 nt!ObpWaitForMultipleObjects+0x294 fffff880`05894960 fffff800`01ace853 nt!NtWaitForMultipleObjects+0xe5 fffff880`05894bb0 00000000`76e3046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05894c20) 00000000`02d1f948 000007fe`fd0813a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`02d1f950 00000000`76bcf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`02d1fa50 000007fe`ed746b84 kernel32!WaitForMultipleObjects+0xb0 00000000`02d1fae0 000007fe`ed747059 SmartcardCredentialProvider!I_ReaderMonitorWorker+0×9c 00000000`02d1fb80 00000000`76bdf56d SmartcardCredentialProvider!I_ReaderMonitorThreadProc+0×31 00000000`02d1fbc0 00000000`76e13281 kernel32!BaseThreadInitThunk+0xd 00000000`02d1fbf0 00000000`00000000 ntdll!RtlUserThreadStart+0×1d

So according to memory dump analysis pattern terminology these 2 processes are strongly coupled and this fact can be used for analysis logon problems in terminal services environments: http://www.dumpanalysis.org/blog/index.php/2007/09/26/crash-dump-analysis-patterns-part-28/

intrauser isolation (p. 459)

file object security (p. 460) - here is an example from x64 W2K8 R2:

0: kd> !handle [...] 0008: Object: fffffa800658e070 GrantedAccess: 00100020 Entry: fffff8a00445d020 Object: fffffa800658e070 Type: (fffffa8003c0dde0) File ObjectHeader: fffffa800658e040 (new version) HandleCount: 1 PointerCount: 1 Directory Object: 00000000 Name: \DL\Notmyfault\exe\x64\Release {HarddiskVolume2} […] 001c: Object: fffffa8005f44ee0 GrantedAccess: 001f0003 (Protected) Entry: fffff8a00445d070 Object: fffffa8005f44ee0 Type: (fffffa8003c00570) Event ObjectHeader: fffffa8005f44eb0 (new version) HandleCount: 1 PointerCount: 2 […]

0: kd> dt _OBJECT_TYPE fffffa8003c0dde0 ntdll!_OBJECT_TYPE +0x000 TypeList : _LIST_ENTRY [ 0xfffffa80`03c0dde0 - 0xfffffa80`03c0dde0 ] +0x010 Name : _UNICODE_STRING "File" +0x020 DefaultObject : 0x00000000`00000098 +0x028 Index : 0x1c '' +0x02c TotalNumberOfObjects : 0x5645 +0x030 TotalNumberOfHandles : 0x89e +0x034 HighWaterNumberOfObjects : 0x5baf +0x038 HighWaterNumberOfHandles : 0x8b5 +0×040 TypeInfo : _OBJECT_TYPE_INITIALIZER +0×0b0 TypeLock : _EX_PUSH_LOCK +0×0b8 Key : 0×656c6946 +0×0c0 CallbackList : _LIST_ENTRY [ 0xfffffa80`03c0dea0 - 0xfffffa80`03c0dea0 ]

0: kd> dt _OBJECT_TYPE_INITIALIZER fffffa8003c0dde0+40 ntdll!_OBJECT_TYPE_INITIALIZER +0x000 Length : 0x70 +0x002 ObjectTypeFlags : 0x11 '' +0x002 CaseInsensitive : 0y1 +0x002 UnnamedObjectsOnly : 0y0 +0x002 UseDefaultObject : 0y0 +0x002 SecurityRequired : 0y0 +0x002 MaintainHandleCount : 0y1 +0x002 MaintainTypeList : 0y0 +0x002 SupportsObjectCallbacks : 0y0 +0x004 ObjectTypeCode : 1 +0x008 InvalidAttributes : 0x130 +0x00c GenericMapping : _GENERIC_MAPPING +0x01c ValidAccessMask : 0x1f01ff +0x020 RetainAccess : 0 +0x024 PoolType : 0 ( NonPagedPool ) +0x028 DefaultPagedPoolCharge : 0x400 +0x02c DefaultNonPagedPoolCharge : 0x180 +0x030 DumpProcedure : (null) +0x038 OpenProcedure : (null) +0x040 CloseProcedure : 0xfffff800`01de6890 void nt!IopCloseFile+0 +0x048 DeleteProcedure : 0xfffff800`01de6610 void nt!IopDeleteFile+0 +0x050 ParseProcedure : 0xfffff800`01df7370 long nt!IopParseFile+0 +0×058 SecurityProcedure : 0xfffff800`01db7130 long nt!IopGetSetSecurityObject+0 +0×060 QueryNameProcedure : 0xfffff800`01db7470 long nt!IopQueryName+0<> +0×068 OkayToCloseProcedure : (null)

0: kd> dt _OBJECT_TYPE_INITIALIZER fffffa8003c00570+40 ntdll!_OBJECT_TYPE_INITIALIZER +0x000 Length : 0x70 +0x002 ObjectTypeFlags : 0 '' +0x002 CaseInsensitive : 0y0 +0x002 UnnamedObjectsOnly : 0y0 +0x002 UseDefaultObject : 0y0 +0x002 SecurityRequired : 0y0 +0x002 MaintainHandleCount : 0y0 +0x002 MaintainTypeList : 0y0 +0x002 SupportsObjectCallbacks : 0y0 +0x004 ObjectTypeCode : 2 +0x008 InvalidAttributes : 0x100 +0x00c GenericMapping : _GENERIC_MAPPING +0x01c ValidAccessMask : 0x1f0003 +0x020 RetainAccess : 0 +0x024 PoolType : 0 ( NonPagedPool ) +0x028 DefaultPagedPoolCharge : 0 +0x02c DefaultNonPagedPoolCharge : 0x70 +0x030 DumpProcedure : (null) +0x038 OpenProcedure : (null) +0x040 CloseProcedure : (null) +0x048 DeleteProcedure : (null) +0x050 ParseProcedure : (null) +0×058 SecurityProcedure : 0xfffff800`01d97070 long nt!SeDefaultObjectMethod+0 +0×060 QueryNameProcedure : (null) +0×068 OkayToCloseProcedure : (null)

SID = SVAS*-RID, S-Version-Authority-Subauthority*-RelativeID (pp. 461 - 462)

PsGetSid (p. 463)

Administrator SID = Machine SID + ‘-500′ (p. 463) - here’s my test (real computer name has been changed to COMPUTER):

C:\PsTools>PsGetSid COMPUTER

SID for COMPUTER\COMPUTER: S-1-5-21-30...49-19...94-15...96

C:\PsTools>PsGetSid S-1-5-21-30...49-19...94-15...96-500

Account for COMPUTER\S-1-5-21-30...49-19...94-15...96-500: User: COMPUTER\Administrator

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 09-April-10

Saturday, April 10th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Hard CPU limits per-session, -user and -system (pp. 444-445)

Security and user-interface limits on jobs (p. 447)

job objects (pp. 447 - 450) - we can dump all processes via !process 0 1 command and look for “Job ” in the output as on my x64 W2K8 system:

1: kd> !process 0 1

PROCESS fffffa8004e28c10 SessionId: 1 Cid: 0a70 Peb: 7fffffd8000 ParentCid: 09ec DirBase: 93cfb000 ObjectTable: fffff88008ec2a20 HandleCount: 405. Image: MSASCui.exe VadRoot fffffa8004de0390 Vads 106 Clone 0 Private 1932. Modified 352. Locked 0. DeviceMap fffff88008479c90 Token fffff88008edb060 ElapsedTime 00:03:15.554 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 197440 QuotaPoolUsage[NonPagedPool] 21728 Working Set Sizes (now,min,max) (3259, 50, 345) (13036KB, 200KB, 1380KB) PeakWorkingSetSize 3259 VirtualSize 96 Mb PeakVirtualSize 96 Mb PageFaultCount 5245 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 2214 Job fffffa80050f8860

PROCESS fffffa800511b260 SessionId: 1 Cid: 0a78 Peb: 7fffffd3000 ParentCid: 09ec DirBase: 93dcb000 ObjectTable: fffff880089d4ae0 HandleCount: 128. Image: wmdSync.exe VadRoot fffffa800511aba0 Vads 77 Clone 0 Private 436. Modified 0. Locked 0. DeviceMap fffff88008479c90 Token fffff88008ee1060 ElapsedTime 00:03:15.429 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 150088 QuotaPoolUsage[NonPagedPool] 7296 Working Set Sizes (now,min,max) (1554, 50, 345) (6216KB, 200KB, 1380KB) PeakWorkingSetSize 1558 VirtualSize 75 Mb PeakVirtualSize 76 Mb PageFaultCount 1643 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 584 Job fffffa80050f8860

PROCESS fffffa8005120a30 SessionId: 1 Cid: 0a88 Peb: 7efdf000 ParentCid: 09ec DirBase: 923cd000 ObjectTable: fffff88008e29560 HandleCount: 99. Image: daemon.exe VadRoot fffffa8004a8cba0 Vads 96 Clone 0 Private 843. Modified 0. Locked 0. DeviceMap fffff88008479c90 Token fffff88008eed730 ElapsedTime 00:03:14.976 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 175272 QuotaPoolUsage[NonPagedPool] 9024 Working Set Sizes (now,min,max) (2608, 50, 345) (10432KB, 200KB, 1380KB) PeakWorkingSetSize 2615 VirtualSize 92 Mb PeakVirtualSize 94 Mb PageFaultCount 3463 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 1397 Job fffffa80050f8860

PROCESS fffffa80051b5640 SessionId: 1 Cid: 0b98 Peb: 7efdf000 ParentCid: 09ec DirBase: 8e371000 ObjectTable: fffff8800910ced0 HandleCount: 59. Image: WZQKPICK.EXE VadRoot fffffa80051c1630 Vads 58 Clone 0 Private 215. Modified 0. Locked 0. DeviceMap fffff88008479c90 Token fffff8800910c860 ElapsedTime 00:03:00.903 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 123744 QuotaPoolUsage[NonPagedPool] 5376 Working Set Sizes (now,min,max) (1274, 50, 345) (5096KB, 200KB, 1380KB) PeakWorkingSetSize 1274 VirtualSize 62 Mb PeakVirtualSize 63 Mb PageFaultCount 1304 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 331 Job fffffa80050f8860

PROCESS fffffa800530e040 SessionId: 0 Cid: 0bcc Peb: 7fffffd6000 ParentCid: 0328 DirBase: 12c7cc000 ObjectTable: fffff880097c19e0 HandleCount: 193. Image: WmiPrvSE.exe VadRoot fffffa80053864c0 Vads 107 Clone 0 Private 766. Modified 0. Locked 0. DeviceMap fffff88007fe7530 Token fffff8800995f060 ElapsedTime 00:00:27.349 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 102888 QuotaPoolUsage[NonPagedPool] 10176 Working Set Sizes (now,min,max) (2338, 50, 345) (9352KB, 200KB, 1380KB) PeakWorkingSetSize 2338 VirtualSize 56 Mb PeakVirtualSize 56 Mb PageFaultCount 2724 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 1359 Job fffffa8004d71560

1: kd> !job fffffa8004d71560 Job at fffffa8004d71560 TotalPageFaultCount 0 TotalProcesses 1 ActiveProcesses 1 TotalTerminatedProcesses 0 LimitFlags 2b08 MinimumWorkingSetSize 0 MaximumWorkingSetSize 0 ActiveProcessLimit 20 PriorityClass 0 UIRestrictionsClass 0 SecurityLimitFlags 0 Token 0000000000000000

1: kd> !job fffffa80050f8860 Job at fffffa80050f8860 TotalPageFaultCount 0 TotalProcesses 4 ActiveProcesses 4 TotalTerminatedProcesses 0 LimitFlags 1000 MinimumWorkingSetSize 0 MaximumWorkingSetSize 0 ActiveProcessLimit 0 PriorityClass 0 UIRestrictionsClass 0 SecurityLimitFlags 0 Token 0000000000000000

1: kd> dt _EJOB fffffa80050f8860 nt!_EJOB +0x000 Event : _KEVENT +0x018 JobLinks : _LIST_ENTRY [ 0xfffff800`019c2450 - 0xfffffa80`04d71578 ] +0x028 ProcessListHead : _LIST_ENTRY [ 0xfffffa80`04e28e58 - 0xfffffa80`051b5888 ] +0x038 JobLock : _ERESOURCE +0x0a0 TotalUserTime : _LARGE_INTEGER 0x0 +0x0a8 TotalKernelTime : _LARGE_INTEGER 0x0 +0x0b0 ThisPeriodTotalUserTime : _LARGE_INTEGER 0x0 +0x0b8 ThisPeriodTotalKernelTime : _LARGE_INTEGER 0x0 +0x0c0 TotalPageFaultCount : 0 +0x0c4 TotalProcesses : 4 +0x0c8 ActiveProcesses : 4 +0x0cc TotalTerminatedProcesses : 0 +0x0d0 PerProcessUserTimeLimit : _LARGE_INTEGER 0x0 +0x0d8 PerJobUserTimeLimit : _LARGE_INTEGER 0x0 +0x0e0 LimitFlags : 0x1000 +0x0e8 MinimumWorkingSetSize : 0 +0x0f0 MaximumWorkingSetSize : 0 +0x0f8 ActiveProcessLimit : 0 +0x100 Affinity : 0 +0x108 PriorityClass : 0 '' +0x110 AccessState : (null) +0x118 UIRestrictionsClass : 0 +0x11c EndOfJobTimeAction : 0 +0x120 CompletionPort : (null) +0x128 CompletionKey : (null) +0x130 SessionId : 1 +0x134 SchedulingClass : 5 +0x138 ReadOperationCount : 0 +0x140 WriteOperationCount : 0 +0x148 OtherOperationCount : 0 +0x150 ReadTransferCount : 0 +0x158 WriteTransferCount : 0 +0x160 OtherTransferCount : 0 +0x168 ProcessMemoryLimit : 0 +0x170 JobMemoryLimit : 0 +0x178 PeakProcessMemoryUsed : 0x912 +0x180 PeakJobMemoryUsed : 0x11b3 +0x188 CurrentJobMemoryUsed : 0x11ae +0x190 MemoryLimitsLock : _EX_PUSH_LOCK +0x198 JobSetLinks : _LIST_ENTRY [ 0xfffffa80`050f89f8 - 0xfffffa80`050f89f8 ] +0x1a8 MemberLevel : 0 +0x1ac JobFlags : 1

C2 reqs: SLF - DAC - SAC - ORP (p. 452) - mnemonic to remember perhaps for security exams like CISSP

B reqs: TPF - TFM (p. 453)

Security targets and protection profiles (p. 453)

Advanced .NET Debugging by M. Hewardt:

type handle as a pointer to method table (p. 53) - I liked managed heap - execution engine boundary and propose this colored space diagram (will add this to Dictionary of Debugging soon as a tripartite “virtual” memory division) :

!DumpModule command (p. 57)

!U command (pp. 58 - 59)

!DumpMT command (p. 59)

!DumpMT -md to dump type method descriptors (p. 60)

!DumpMD command (p. 60)

m_CodeOrIL: 00920070 (p. 61) - the address looks like as UNICODE string but I belive this is just a coincidence, the false positive of Wild Pointer pattern: http://www.dumpanalysis.org/blog/index.php/2008/03/11/crash-dump-analysis-patterns-part-55/

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Advanced .NET Debugging, Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 30-March-10

Saturday, April 3rd, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

per-PRCB queued, system-wide dispatcher, system-wide context swap and per-thread spinlocks (pp. 434-435)

physical over logical processor preference for scheduling (p. 435)

!smt command (p. 436) - here is the putput from x64 machine (from the output we can infer the following relationship logical processor -> core -> physical processor):

1: kd> !smt SMT Summary: ------------ KeActiveProcessors: **-------------------------------------------------------------- (0000000000000003) KiIdleSummary: -*-------------------------------------------------------------- (0000000000000002) No PRCB SMT Set APIC Id 0 fffff80001991680 **-------------------------------------------------------------- (0000000000000003) 0x00000000 1 fffffa60005ec180 **-------------------------------------------------------------- (0000000000000003) 0x00000001

Maximum cores per physical processor: 2 Maximum logical processors per core: 1

NUMA (pp. 436 - 438) - I can see NUMA even on my small desktop system

1: kd> !numa NUMA Summary: ------------ Number of NUMA nodes : 1 Number of Processors : 2 MmAvailablePages : 0x000C7CB9 KeActiveProcessors : (3)

NODE 0 (FFFFF80001995640): ProcessorMask : (3) Color : 0x00000000 MmShiftedColor : 0x00000000 Seed : 0x00000001 Right : 0x00000000 Left : 0x00000001 Zeroed Page Count: 0x0000000000000000 Free Page Count : 0x0000000000000000

Thread affinity (pp. 438 - 440) - see also Affine Thread crash dump analysis pattern: http://www.dumpanalysis.org/blog/index.php/2008/06/27/crash-dump-analysis-patterns-part-68/

uniprocessor flag as a workaround for multithreading defects (p. 439)

Set(Query)ProcessAffinityUpdateMode and dynamic processor changes (p. 442)

choosing a processor (idle ideal -> idle current -> idle previous -> current -> ideal running less priority thread) (pp. 433 - 444)

no guarantee to run all highest priority threads vs. always runs the highest priority thread (p. 444)

Advanced .NET Debugging by M. Hewardt:

value vs. reference types (p. 42)

sosex!bpsc (p. 46)

per frame managed stack trace: !ClrStack -a (p. 46)

d* for simple local value types, !dumpobj for references, !dumpvc for value type fields (pp. 46 - 47)

sync blocks (pp. 49 - 52) - here is the output from my x64 test program:

0:000> !ClrStack -a OS Thread Id: 0x6e8 (0)

000000000013ed10 000007ff001ac709 System.IO.TextReader+SyncTextReader.ReadLine() PARAMETERS: this = 0x0000000002a2b568

0:000> !dumpobj 0x0000000002a2b568 Name: System.IO.TextReader+SyncTextReader MethodTable: 000007feee67bea8 EEClass: 000007feedb851e0 Size: 32(0x20) bytes (C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll) Fields: MT Field Offset Type VT Attr Value Name 000007feede86048 400018a 8 System.Object 0 instance 0000000000000000 __identity 000007feedecd198 4001c87 b18 System.IO.TextReader 0 shared static Null >> Domain:Value 0000000000220840:0000000002a2b060 << 000007feedecd198 4001c88 10 System.IO.TextReader 0 instance 0000000002a2af28 _in ThinLock owner 1 (0000000000000000), Recursive 0

0:000> dq 0x0000000002a2b568-8 00000000`02a2b560 00000001`00000000 000007fe`ee67bea8 00000000`02a2b570 00000000`00000000 00000000`02a2af28 00000000`02a2b580 00000000`00000000 00000000`00000000 00000000`02a2b590 00000000`00000000 00000000`00000000 00000000`02a2b5a0 00000000`00000000 00000000`00000000 00000000`02a2b5b0 00000000`00000000 00000000`00000000 00000000`02a2b5c0 00000000`00000000 00000000`00000000 00000000`02a2b5d0 00000000`00000000 00000000`00000000

0:000> !syncblk 1 Index SyncBlock MonitorHeld Recursion Owning Thread Info SyncBlock Owner 1 0000000000259bf8 0 0 0000000000000000 none 0000000002a28030 System.EventHandler ----------------------------- Total 1 CCW 0 RCW 0 ComClassFactory 0 Free 0

thin sync blocks (p. 52)

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Advanced .NET Debugging, Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 26-March-10

Friday, March 26th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Impossibility to disable foreground after-wait priority boosts (p. 423)

CPU Stress tool (pp. 423 - 425, 428 - 430) - Good tool to model CPU spikes. See also Modeling CPU Spikes article I co-authored for Debugging Expert magazine: http://www.debuggingexperts.com/debugged-june-09

CPU starvation prevention via balance set manager thread (p. 427)

MMCSS priority boosts (p. 432)

Network throttling to prevent DPC activity interrupting MMCSS boosting (p. 433)

Advanced .NET Debugging by M. Hewardt:

System | shared | def app := bookkeeping, precreation | mscorlib | app code (pp. 37 - 38) - here we check that mscorlib assembly belongs to the shared domain:

0:003> !dumpdomain -------------------------------------- System Domain: 000007fef00f8ef0 LowFrequencyHeap: 000007fef00f8f38 HighFrequencyHeap: 000007fef00f8fc8 StubHeap: 000007fef00f9058 Stage: OPEN Name: None -------------------------------------- Shared Domain: 000007fef00f9860 LowFrequencyHeap: 000007fef00f98a8 HighFrequencyHeap: 000007fef00f9938 StubHeap: 000007fef00f99c8 Stage: OPEN Name: None Assembly: 00000000003a2d10 ————————————– Domain 1: 0000000000390840 LowFrequencyHeap: 0000000000390888 HighFrequencyHeap: 0000000000390918 StubHeap: 00000000003909a8 Stage: OPEN SecurityDescriptor: 00000000003930e0 Name: TestCLR.exe

[...]

Assembly: 00000000003a2d10 [C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll] ClassLoader: 00000000003a2dd0 SecurityDescriptor: 00000000003a2110 Module Name 000007feeda51000 C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll

0:003> !dumpassembly 00000000003a2d10 Parent Domain: 000007fef00f9860 Name: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll ClassLoader: 00000000003a2dd0 SecurityDescriptor: 000000000335db78 Module Name 000007feeda51000 C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll

Multimodule assemblies with separate PE file for a manifest (p. 40)

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Advanced .NET Debugging, Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 22-March-10

Wednesday, March 24th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Processor mode doesn’t affect thread scheduling (p. 414)

Preemption can be before a quantum ends and in that case the preempted thread is pushed at the front of a ready queue (pp. 414 - 415)

Clock interval extension of quanta for interrupted threads (pp. 416 - 417)

Context Switching (p. 418) - just noticed (never paid attention to before) that WinDbg shows empty context for the preempted thread:

x86 W2K3:

0: kd> kL ChildEBP RetAddr ba3a2a44 80833ed1 nt!KiSwapContext+0x26 ba3a2a70 80829c14 nt!KiSwapThread+0x2e5 ba3a2ab8 b9c5674d nt!KeWaitForSingleObject+0x346 [...]

0: kd> r Last set context: eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000 eip=8088f77e esp=ba3a2a38 ebp=ba3a2a70 iopl=0 nv up di pl nz na po nc cs=0008 ss=0010 ds=0000 es=0000 fs=0000 gs=0000 efl=00000000 nt!KiSwapContext+0×26: 8088f77e 8b2c24 mov ebp,dword ptr [esp] ss:0010:ba3a2a38=ba3a2a70

0: kd> uf nt!KiSwapContext nt!KiSwapContext: 8088f758 sub esp,10h 8088f75b mov dword ptr [esp+0Ch],ebx 8088f75f mov dword ptr [esp+8],esi 8088f763 mov dword ptr [esp+4],edi 8088f767 mov dword ptr [esp],ebp 8088f76a mov ebx,dword ptr fs:[1Ch] 8088f771 mov edi,ecx 8088f773 mov esi,edx 8088f775 movzx ecx,byte ptr [edi+4Eh] 8088f779 call nt!SwapContext (8088f880) 8088f77e mov ebp,dword ptr [esp] 8088f781 mov edi,dword ptr [esp+4] 8088f785 mov esi,dword ptr [esp+8] 8088f789 mov ebx,dword ptr [esp+0Ch] 8088f78d add esp,10h 8088f790 ret

x64 W2K8:

1: kd> kL *** Stack trace for last set context - .thread/.cxr resets it Child-SP RetAddr Call Site fffffa60`02ddc7c0 fffff800`0187a6fa nt!KiSwapContext+0x7f fffffa60`02ddc900 fffff800`0186f35b nt!KiSwapThread+0x13a fffffa60`02ddc970 fffff800`01ad9e57 nt!KeWaitForSingleObject+0x2cb fffffa60`02ddca00 fffff800`01ad9219 nt!AlpcpReceiveMessagePort+0x287 fffffa60`02ddca60 fffff800`01ada58a nt!AlpcpReceiveMessage+0x245 fffffa60`02ddcb00 fffff800`01877ef3 nt!NtAlpcSendWaitReceivePort+0x1da fffffa60`02ddcbb0 00000000`7747756a nt!KiSystemServiceCopyEnd+0x13 00000000`0020f5a8 00000000`00000000 ntdll!ZwAlpcSendWaitReceivePort+0xa

1: kd> r Last set context: rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8000187ac7f rsp=fffffa6002ddc7c0 rbp=fffffa80047ca290 r8=0000000000000000 r9=0000000000000000 r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up di pl nz na pe nc cs=0000 ss=0000 ds=0000 es=0000 fs=0000 gs=0000 efl=00000000 nt!KiSwapContext+0×7f: fffff800`0187ac7f 488d8c2400010000 lea rcx,[rsp+100h]

1: kd> uf nt!KiSwapContext nt!KiSwapContext: fffff800`0187ac00 sub rsp,138h fffff800`0187ac07 lea rax,[rsp+100h] fffff800`0187ac0f movaps xmmword ptr [rsp+30h],xmm6 fffff800`0187ac14 movaps xmmword ptr [rsp+40h],xmm7 fffff800`0187ac19 movaps xmmword ptr [rsp+50h],xmm8 fffff800`0187ac1f movaps xmmword ptr [rsp+60h],xmm9 fffff800`0187ac25 movaps xmmword ptr [rsp+70h],xmm10 fffff800`0187ac2b movdqa xmmword ptr [rax-80h],xmm11 fffff800`0187ac31 movdqa xmmword ptr [rax-70h],xmm12 fffff800`0187ac37 movdqa xmmword ptr [rax-60h],xmm13 fffff800`0187ac3d movdqa xmmword ptr [rax-50h],xmm14 fffff800`0187ac43 movdqa xmmword ptr [rax-40h],xmm15 fffff800`0187ac49 mov qword ptr [rax],rbx fffff800`0187ac4c mov qword ptr [rax+8],rdi fffff800`0187ac50 mov qword ptr [rax+10h],rsi fffff800`0187ac54 mov qword ptr [rax+18h],r12 fffff800`0187ac58 mov qword ptr [rax+20h],r13 fffff800`0187ac5c mov qword ptr [rax+28h],r14 fffff800`0187ac60 mov qword ptr [rax+30h],r15 fffff800`0187ac64 mov rbx,qword ptr gs:[20h] fffff800`0187ac6d mov rdi,rcx fffff800`0187ac70 mov rsi,rdx fffff800`0187ac73 movzx ecx,byte ptr [rdi+156h] fffff800`0187ac7a call nt!SwapContext (fffff800`0187af50) fffff800`0187ac7f lea rcx,[rsp+100h] fffff800`0187ac87 movdqa xmm6,xmmword ptr [rsp+30h] fffff800`0187ac8d movdqa xmm7,xmmword ptr [rsp+40h] fffff800`0187ac93 movdqa xmm8,xmmword ptr [rsp+50h] fffff800`0187ac9a movdqa xmm9,xmmword ptr [rsp+60h] fffff800`0187aca1 movdqa xmm10,xmmword ptr [rsp+70h] fffff800`0187aca8 movdqa xmm11,xmmword ptr [rcx-80h] fffff800`0187acae movdqa xmm12,xmmword ptr [rcx-70h] fffff800`0187acb4 movdqa xmm13,xmmword ptr [rcx-60h] fffff800`0187acba movdqa xmm14,xmmword ptr [rcx-50h] fffff800`0187acc0 movdqa xmm15,xmmword ptr [rcx-40h] fffff800`0187acc6 mov rbx,qword ptr [rcx] fffff800`0187acc9 mov rdi,qword ptr [rcx+8] fffff800`0187accd mov rsi,qword ptr [rcx+10h] fffff800`0187acd1 mov r12,qword ptr [rcx+18h] fffff800`0187acd5 mov r13,qword ptr [rcx+20h] fffff800`0187acd9 mov r14,qword ptr [rcx+28h] fffff800`0187acdd mov r15,qword ptr [rcx+30h] fffff800`0187ace1 add rsp,138h fffff800`0187ace8 ret

We also see that if there is an attempt to switch from a DPC we get a bugcheck

1: kd> uf nt!SwapContext nt!SwapContext: fffff800`0187af50 sub rsp,38h fffff800`0187af54 mov qword ptr [rsp+30h],rbp fffff800`0187af59 mov byte ptr [rsp+28h],cl fffff800`0187af5d cmp byte ptr [rsi+95h],0 fffff800`0187af64 jne nt!SwapContext+0x1cb (fffff800`0187b11b)

[...]

nt!SwapContext+0x1b2: fffff800`0187b102 xor r9,r9 fffff800`0187b105 mov qword ptr [rsp+20h],r9 fffff800`0187b10a mov r8,rsi fffff800`0187b10d mov rdx,rdi fffff800`0187b110 mov ecx,0B8h fffff800`0187b115 call nt!KeBugCheckEx (fffff800`01878450) fffff800`0187b11a ret

It happens infrequently: http://www.dumpanalysis.org/blog/index.php/2008/03/12/bug-check-frequencies/

Idle process and threads can have NULL fields (pp. 418 - 419) - on x64 W2K8:

1: kd> !process poi(PsIdleProcess) PROCESS fffff800019970c0 SessionId: none Cid: 0000 Peb: 00000000 ParentCid: 0000 DirBase: 00124000 ObjectTable: fffff88000000080 HandleCount: 551. Image: Idle VadRoot fffffa8003b97c70 Vads 1 Clone 0 Private 1. Modified 0. Locked 0. DeviceMap 0000000000000000 Token fffff88000003330 ElapsedTime 00:00:00.000 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (6, 50, 450) (24KB, 200KB, 1800KB) PeakWorkingSetSize 6 VirtualSize 0 Mb PeakVirtualSize 0 Mb PageFaultCount 1 MemoryPriority BACKGROUND BasePriority 0 CommitCharge 0

THREAD fffff80001996b80 Cid 0000.0000 Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0 Not impersonating DeviceMap fffff88000007310 Owning Process fffff800019970c0 Image: Idle Attached Process fffffa8003bf1040 Image: System Wait Start TickCount 16846 Ticks: 1721 (0:00:00:26.847) Context Switch Count 229608 UserTime 00:00:00.000 KernelTime 00:04:13.532 Win32 Start Address nt!KiIdleLoop (0xfffff8000187c880) Stack Init fffff80002bdadb0 Current fffff80002bdad40 Base fffff80002bdb000 Limit fffff80002bd5000 Call 0 Priority 16 BasePriority 0 PriorityDecrement 0 IoPriority 0 PagePriority 0 Child-SP RetAddr Call Site fffff800`02bdad80 fffff800`01a49860 nt!KiIdleLoop+0x11b fffff800`02bdadb0 00000000`00000000 nt!zzz_AsmCodeRange_End+0x4

THREAD fffffa60005f5d40 Cid 0000.0000 Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 1 Not impersonating DeviceMap fffff88000007310 Owning Process fffff800019970c0 Image: Idle Attached Process fffffa8003bf1040 Image: System Wait Start TickCount 0 Ticks: 18567 (0:00:04:49.647) Context Switch Count 241262 UserTime 00:00:00.000 KernelTime 00:04:23.501 Win32 Start Address nt!KiIdleLoop (0xfffff8000187c880) Stack Init fffffa600191bdb0 Current fffffa600191bd40 Base fffffa600191c000 Limit fffffa6001916000 Call 0 Priority 16 BasePriority 0 PriorityDecrement 0 IoPriority 0 PagePriority 0 Child-SP RetAddr Call Site fffffa60`0191bcd8 fffffa60`00f07685 intelppm!C1Halt+0x2 fffffa60`0191bce0 fffff800`0187cb83 intelppm!C1Idle+0x9 fffffa60`0191bd10 fffff800`0187c8a1 nt!PoIdle+0x183 fffffa60`0191bd80 fffff800`01a49860 nt!KiIdleLoop+0x21 fffffa60`0191bdb0 00000000`fffffa60 nt!zzz_AsmCodeRange_End+0x4 fffffa60`005efd00 00000000`00000000 0xfffffa60

MMCSS (MultiMedia Class Schedular Service) and priority boosts in Vista (p. 420)

Priority boosts never go beyond level 15 (p. 421) - looks like addition of velocities in relativity, where v1 > c/2, v2 > c/2 but v1+v2 < c (where c is the speed of light) :-)

Priority boosts for low prioroty _ERESOURCE owners (pp. 422 - 423)

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 18-March-10

Friday, March 19th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Deferred ready and standby thread states (p. 400)

Gait waiting (p. 401)

Transition state as state with paged out kernel stack (p. 401) - flattening thread state transition diagram for ready state:

deferred ready -> ready <-> running

Thread state counter in Performance Monitor (pp. 402 - 404)

Per-processor ready queues and O(1) (pp. 404 - 405)

PRCB (p. 404) - rather a huge structure on x64 W2K8:

0: kd> dt nt!_KPRCB +0x000 MxCsr : Uint4B +0x004 Number : Uint2B +0x006 InterruptRequest : UChar +0x007 IdleHalt : UChar +0x008 CurrentThread : Ptr64 _KTHREAD +0x010 NextThread : Ptr64 _KTHREAD +0x018 IdleThread : Ptr64 _KTHREAD +0x020 NestingLevel : UChar +0x021 Group : UChar +0x022 PrcbPad00 : [6] UChar +0x028 RspBase : Uint8B +0x030 PrcbLock : Uint8B +0x038 SetMember : Uint8B +0x040 ProcessorState : _KPROCESSOR_STATE +0x5f0 CpuType : Char +0x5f1 CpuID : Char +0x5f2 CpuStep : Uint2B +0x5f2 CpuStepping : UChar +0x5f3 CpuModel : UChar +0x5f4 MHz : Uint4B +0x5f8 HalReserved : [8] Uint8B +0x638 MinorVersion : Uint2B +0x63a MajorVersion : Uint2B +0x63c BuildType : UChar +0x63d CpuVendor : UChar +0x63e CoresPerPhysicalProcessor : UChar +0x63f LogicalProcessorsPerCore : UChar +0x640 ApicMask : Uint4B +0x644 CFlushSize : Uint4B +0x648 AcpiReserved : Ptr64 Void +0x650 InitialApicId : Uint4B +0x654 Stride : Uint4B +0x658 PrcbPad01 : [3] Uint8B +0x670 LockQueue : [49] _KSPIN_LOCK_QUEUE +0x980 PPLookasideList : [16] _PP_LOOKASIDE_LIST +0xa80 PPNPagedLookasideList : [32] _GENERAL_LOOKASIDE_POOL +0x1680 PPPagedLookasideList : [32] _GENERAL_LOOKASIDE_POOL +0x2280 PacketBarrier : Uint8B +0×2288 DeferredReadyListHead : _SINGLE_LIST_ENTRY +0×2290 MmPageFaultCount : Int4B +0×2294 MmCopyOnWriteCount : Int4B +0×2298 MmTransitionCount : Int4B +0×229c MmDemandZeroCount : Int4B +0×22a0 MmPageReadCount : Int4B +0×22a4 MmPageReadIoCount : Int4B +0×22a8 MmDirtyPagesWriteCount : Int4B +0×22ac MmDirtyWriteIoCount : Int4B +0×22b0 MmMappedPagesWriteCount : Int4B +0×22b4 MmMappedWriteIoCount : Int4B +0×22b8 KeSystemCalls : Uint4B +0×22bc KeContextSwitches : Uint4B +0×22c0 CcFastReadNoWait : Uint4B +0×22c4 CcFastReadWait : Uint4B +0×22c8 CcFastReadNotPossible : Uint4B +0×22cc CcCopyReadNoWait : Uint4B +0×22d0 CcCopyReadWait : Uint4B +0×22d4 CcCopyReadNoWaitMiss : Uint4B +0×22d8 LookasideIrpFloat : Int4B +0×22dc IoReadOperationCount : Int4B +0×22e0 IoWriteOperationCount : Int4B +0×22e4 IoOtherOperationCount : Int4B +0×22e8 IoReadTransferCount : _LARGE_INTEGER +0×22f0 IoWriteTransferCount : _LARGE_INTEGER +0×22f8 IoOtherTransferCount : _LARGE_INTEGER +0×2300 TargetSet : Uint8B +0×2308 IpiFrozen : Uint4B +0×230c PrcbPad3 : [116] UChar +0×2380 RequestMailbox : [64] _REQUEST_MAILBOX +0×3380 SenderSummary : Uint8B +0×3388 PrcbPad4 : [120] UChar +0×3400 DpcData : [2] _KDPC_DATA +0×3440 DpcStack : Ptr64 Void +0×3448 SparePtr0 : Ptr64 Void +0×3450 MaximumDpcQueueDepth : Int4B +0×3454 DpcRequestRate : Uint4B +0×3458 MinimumDpcRate : Uint4B +0×345c DpcInterruptRequested : UChar +0×345d DpcThreadRequested : UChar +0×345e DpcRoutineActive : UChar +0×345f DpcThreadActive : UChar +0×3460 TimerHand : Uint8B +0×3460 TimerRequest : Uint8B +0×3468 TickOffset : Int4B +0×346c MasterOffset : Int4B +0×3470 DpcLastCount : Uint4B +0×3474 ThreadDpcEnable : UChar +0×3475 QuantumEnd : UChar +0×3476 PrcbPad50 : UChar +0×3477 IdleSchedule : UChar +0×3478 DpcSetEventRequest : Int4B +0×347c KeExceptionDispatchCount : Uint4B +0×3480 DpcEvent : _KEVENT +0×3498 PrcbPad51 : Ptr64 Void +0×34a0 CallDpc : _KDPC +0×34e0 ClockKeepAlive : Int4B +0×34e4 ClockCheckSlot : UChar +0×34e5 ClockPollCycle : UChar +0×34e6 PrcbPad6 : [2] UChar +0×34e8 DpcWatchdogPeriod : Int4B +0×34ec DpcWatchdogCount : Int4B +0×34f0 PrcbPad70 : [2] Uint8B +0×3500 WaitListHead : _LIST_ENTRY +0×3510 WaitLock : Uint8B +0×3518 ReadySummary : Uint4B +0×351c QueueIndex : Uint4B +0×3520 PrcbPad71 : [12] Uint8B +0×3580 DispatcherReadyListHead : [32] _LIST_ENTRY +0×3780 InterruptCount : Uint4B +0×3784 KernelTime : Uint4B +0×3788 UserTime : Uint4B +0×378c DpcTime : Uint4B +0×3790 InterruptTime : Uint4B +0×3794 AdjustDpcThreshold : Uint4B +0×3798 SkipTick : UChar +0×3799 DebuggerSavedIRQL : UChar +0×379a PollSlot : UChar +0×379b PrcbPad80 : [5] UChar +0×37a0 DpcTimeCount : Uint4B +0×37a4 DpcTimeLimit : Uint4B +0×37a8 PeriodicCount : Uint4B +0×37ac PeriodicBias : Uint4B +0×37b0 PrcbPad81 : [2] Uint8B +0×37c0 ParentNode : Ptr64 _KNODE +0×37c8 MultiThreadProcessorSet : Uint8B +0×37d0 MultiThreadSetMaster : Ptr64 _KPRCB +0×37d8 StartCycles : Uint8B +0×37e0 MmSpinLockOrdering : Int4B +0×37e4 PageColor : Uint4B +0×37e8 NodeColor : Uint4B +0×37ec NodeShiftedColor : Uint4B +0×37f0 SecondaryColorMask : Uint4B +0×37f4 Sleeping : Int4B +0×37f8 CycleTime : Uint8B +0×3800 CcFastMdlReadNoWait : Uint4B +0×3804 CcFastMdlReadWait : Uint4B +0×3808 CcFastMdlReadNotPossible : Uint4B +0×380c CcMapDataNoWait : Uint4B +0×3810 CcMapDataWait : Uint4B +0×3814 CcPinMappedDataCount : Uint4B +0×3818 CcPinReadNoWait : Uint4B +0×381c CcPinReadWait : Uint4B +0×3820 CcMdlReadNoWait : Uint4B +0×3824 CcMdlReadWait : Uint4B +0×3828 CcLazyWriteHotSpots : Uint4B +0×382c CcLazyWriteIos : Uint4B +0×3830 CcLazyWritePages : Uint4B +0×3834 CcDataFlushes : Uint4B +0×3838 CcDataPages : Uint4B +0×383c CcLostDelayedWrites : Uint4B +0×3840 CcFastReadResourceMiss : Uint4B +0×3844 CcCopyReadWaitMiss : Uint4B +0×3848 CcFastMdlReadResourceMiss : Uint4B +0×384c CcMapDataNoWaitMiss : Uint4B +0×3850 CcMapDataWaitMiss : Uint4B +0×3854 CcPinReadNoWaitMiss : Uint4B +0×3858 CcPinReadWaitMiss : Uint4B +0×385c CcMdlReadNoWaitMiss : Uint4B +0×3860 CcMdlReadWaitMiss : Uint4B +0×3864 CcReadAheadIos : Uint4B +0×3868 MmCacheTransitionCount : Int4B +0×386c MmCacheReadCount : Int4B +0×3870 MmCacheIoCount : Int4B +0×3874 PrcbPad91 : [3] Uint4B +0×3880 PowerState : _PROCESSOR_POWER_STATE +0×3998 KeAlignmentFixupCount : Uint4B +0×399c VendorString : [13] UChar +0×39a9 PrcbPad10 : [3] UChar +0×39ac FeatureBits : Uint4B +0×39b0 UpdateSignature : _LARGE_INTEGER +0×39b8 DpcWatchdogDpc : _KDPC +0×39f8 DpcWatchdogTimer : _KTIMER +0×3a38 Cache : [5] _CACHE_DESCRIPTOR +0×3a74 CacheCount : Uint4B +0×3a78 CachedCommit : Uint4B +0×3a7c CachedResidentAvailable : Uint4B +0×3a80 HyperPte : Ptr64 Void +0×3a88 WheaInfo : Ptr64 Void +0×3a90 EtwSupport : Ptr64 Void +0×3aa0 InterruptObjectPool : _SLIST_HEADER +0×3ab0 HypercallPageList : _SLIST_HEADER +0×3ac0 HypercallPageVirtual : Ptr64 Void +0×3ac8 VirtualApicAssist : Ptr64 Void +0×3ad0 StatisticsPage : Ptr64 Uint8B +0×3ad8 RateControl : Ptr64 Void +0×3ae0 CacheProcessorMask : [5] Uint8B +0×3b08 PackageProcessorSet : Uint8B +0×3b10 CoreProcessorSet : Uint8B

Changed thread quantum accounting in Vista (now: clock cycles), quantum targets, partial quantum decay (pp. 406 - 407)

The mystery of huge number in KiCyclesPerClockQuantum (p. 408) - here is an output on my PC:

0: kd> dd KiCyclesPerClockQuantum l1 fffff800`01a45170 008e58db

0: kd> !cpuinfo CP F/M/S Manufacturer MHz PRCB Signature MSR 8B Signature Features 0 6,15,2 GenuineIntel 1794 0000005600000000 20193ffe 1 6,15,2 GenuineIntel 1794 0000005600000000 20193ffe Cached Update Signature 0000005a00000000 Initial Update Signature 0000005600000000

C:\>C:\DL\Clockres.exe

Maximum timer interval: 15.600 ms Minimum timer interval: 0.500 ms Current timer interval: 1.000 ms

HKLM\S\CCS\C\PriorityControl\Win32PrioritySeparation vs. PsPrioritySeperation - looks like a misprint that needs fixing in the next version of Windows Why it was a deliberate misspelling (p. 411) we can only guess…

0: kd> dd PsPrioritySeperation l1 fffff800`01a45228 00000002

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 15-March-10

Tuesday, March 16th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Limiting high-priority ready threads by a processor affinity (p. 391)

Thread dispatch reasons: ready, leaves running state, priority change, processor affinity change (p. 392)

Thread vs. process scheduling granularity (pp. 392 - 393)

Thread priority level 0 is reserved for zero page thread (p. 393)

2 pespectives on thread priority levels (pp. 393 - 394)

Changing CPU-intensive process base priority instead of priority of individual threads (p. 395)

Increased based priority for special processes (p. 395) - here is a comparison of base priorities between lsm.exe and smss.exe from x64 W2K8:

0: kd> !process fffffa80047ffc10 PROCESS fffffa80047ffc10 SessionId: 0 Cid: 0294 Peb: 7fffffd6000 ParentCid: 0238 DirBase: b1c4e000 ObjectTable: fffff88007f05cd0 HandleCount: 173. Image: lsm.exe VadRoot fffffa80046dd720 Vads 68 Clone 0 Private 462. Modified 0. Locked 0. DeviceMap fffff88000007310 Token fffff88007f376f0 ElapsedTime 00:04:17.552 UserTime 00:00:00.015 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 69000 QuotaPoolUsage[NonPagedPool] 7072 Working Set Sizes (now,min,max) (1314, 50, 345) (5256KB, 200KB, 1380KB) PeakWorkingSetSize 1318 VirtualSize 36 Mb PeakVirtualSize 38 Mb PageFaultCount 1375 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 756

0: kd> !process fffffa80046d9040 PROCESS fffffa80046d9040 SessionId: none Cid: 019c Peb: 7fffffdf000 ParentCid: 0004 DirBase: bccd5000 ObjectTable: fffff880005f45b0 HandleCount: 33. Image: smss.exe VadRoot fffffa80046d97e0 Vads 19 Clone 0 Private 96. Modified 24. Locked 0. DeviceMap fffff88000007310 Token fffff88000964af0 ElapsedTime 00:04:40.343 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 10392 QuotaPoolUsage[NonPagedPool] 1728 Working Set Sizes (now,min,max) (254, 50, 345) (1016KB, 200KB, 1380KB) PeakWorkingSetSize 254 VirtualSize 6 Mb PeakVirtualSize 16 Mb PageFaultCount 458 MemoryPriority BACKGROUND BasePriority 11 CommitCharge 127

Sleep(0) to relinquish the rest of quantum (p. 396)

Realtime Notepad (pp. 397 - 398) - I’m often asked why it doesn’t affect performance? This is because most threads in a system are waiting and notepad is waiting for window messages to process like keyboard and mouse. It is more noticeable when a realtime thread starts looping - it becomes scheduled every time

WSRM (Windows System Resource Manager) (pp. 398 - 399) - Looks good to prevent CPU spikes and memory leaks to come out of control

Thread priorities and IRQL (pp. 399 - 400) - in another words these concepts are orthogonal (independent from each other)

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 11-March-10

Thursday, March 11th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Clock cycle counter for measuring CPU activity (p. 382)

Process Explorer usage to inspect hung threads (p. 383) - useful for coupled processes (http://www.dumpanalysis.org/blog/index.php/2007/09/26/crash-dump-analysis-patterns-part-28/) and could be great with simultaneous WinDbg session to inspect wait chains (http://www.dumpanalysis.org/blog/index.php/2009/02/17/wait-chain-patterns/)

Process Explorer shows both thread and WOW64 thread stacks on x64 (p. 384)

Thread stack and context query limitations for protected processes (pp. 384 - 386)

Thread pool mechanism was moved into kernel space in Vista (p. 387)

TpWorkerFactory and I/O completion ports and KQUEUE (pp. 387 - 388) - see also a “brief guide” to I/O completion ports: http://www.dumpanalysis.org/blog/index.php/2007/11/27/understanding-io-completion-ports/

The mystery of ntdll!TppWorkerThread in stack traces (pp. 389 - 390)

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 10-March-10

Thursday, March 11th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

W32THREAD (p. 371) - One candidate in _ETHREAD that points to it is Tcb.Win32Thread. One interesting code I found on how to extract window message queues from it: http://www.cc.gatech.edu/~brendan/volatility/dl/threadqueues.py. _W32THREAD structure on x64 W2K8 (we also see that is points to _ETHREAD):

0: kd> dt _W32THREAD win32k!_W32THREAD +0x000 pEThread : Ptr64 _ETHREAD +0x008 RefCount : Uint4B +0x010 ptlW32 : Ptr64 _TL +0x018 pgdiDcattr : Ptr64 Void +0x020 pgdiBrushAttr : Ptr64 Void +0x028 pUMPDObjs : Ptr64 Void +0x030 pUMPDHeap : Ptr64 Void +0x038 pUMPDObj : Ptr64 Void +0x040 pProxyPort : Ptr64 Void +0x048 pClientID : Ptr64 Void +0x050 GdiTmpTgoList : _LIST_ENTRY

!thread output fields (p. 376) - Stack Base and Limit fields can be useful to dump raw stack data via dps command to see execution residue or when reconstructing stack trace, see, for example, this pattern: http://www.dumpanalysis.org/blog/index.php/2009/10/23/crash-dump-analysis-patterns-part-88/

tlist utility (p. 377)

Thread creation calls (pp. 380 - 381) - a condensed view of top level function calls on x64 W2K8:

0: kd> uf /c CreateThread kernel32!CreateThread (00000000`7731c1c0) kernel32!CreateThread+0x28 (00000000`7731c1e8): call to kernel32!CreateRemoteThread (00000000`7731c200)

0: kd> uf /c CreateRemoteThread Flow analysis was incomplete, some code may be missing kernel32!CreateRemoteThread (00000000`7731c200) kernel32!CreateRemoteThread+0x134 (00000000`7731c334): call to ntdll!NtCreateThreadEx (00000000`77477790) kernel32!CreateRemoteThread+0×166 (00000000`7731c366): call to ntdll!RtlAllocateActivationContextStack (00000000`77456900) kernel32!CreateRemoteThread+0×1b4 (00000000`7731c3b4): call to ntdll!RtlQueryInformationActivationContext (00000000`77456b20) kernel32!CreateRemoteThread+0×241 (00000000`7731c441): call to ntdll!CsrClientCallServer (00000000`7747a460) kernel32!CreateRemoteThread+0×281 (00000000`7731c47d): call to ntdll!ZwResumeThread (00000000`77477230) kernel32!CreateRemoteThread+0×38b (00000000`7731c4ae): call to kernel32!_security_check_cookie (00000000`7732c200)

0: kd> uf /c NtCreateThreadEx ntdll!NtCreateThreadEx (00000000`77477790) no calls found

0: kd> uf NtCreateThreadEx ntdll!NtCreateThreadEx: 00000000`77477790 4c8bd1 mov r10,rcx 00000000`77477793 b8a5000000 mov eax,0A5h 00000000`77477798 0f05 syscall 00000000`7747779a c3 ret

0: kd> uf /c nt!NtCreateThreadEx nt!NtCreateThreadEx (fffff800`01af60fc) nt!NtCreateThreadEx+0x3d (fffff800`01af6139): call to nt!memset (fffff800`0187a4d0) nt!NtCreateThreadEx+0x5b (fffff800`01af6157): call to nt!memset (fffff800`0187a4d0) nt!NtCreateThreadEx+0x99 (fffff800`01af6195): call to nt!memset (fffff800`0187a4d0) nt!NtCreateThreadEx+0xc8 (fffff800`01af61c4): call to nt!PspBuildCreateProcessContext (fffff800`01af5204) nt!NtCreateThreadEx+0x1e1 (fffff800`01af62dd): call to nt!PspCreateThread (fffff800`01af5d40) nt!NtCreateThreadEx+0×1f0 (fffff800`01af62ec): call to nt!PspDeleteCreateProcessContext (fffff800`01af68f0)

0: kd> uf /c nt!PspCreateThread nt!PspCreateThread (fffff800`01af5d40) nt!PspCreateThread+0x102 (fffff800`01af5e42): call to nt!ObReferenceObjectByHandle (fffff800`01ad8110) nt!PspCreateThread+0x15b (fffff800`01af5e9b): call to nt!ObfReferenceObject (fffff800`01883250) nt!PspCreateThread+0x22f (fffff800`01af5f6f): call to nt!PspAllocateThread (fffff800`01af6338) nt!PspCreateThread+0x243 (fffff800`01af5f83): call to nt!ObfDereferenceObject (fffff800`0187cde0) nt!PspCreateThread+0x2a6 (fffff800`01af5fe6): call to nt!PspInsertThread (fffff800`01af4c10) nt!PspCreateThread+0x318 (fffff800`01af6058): call to nt!ObfDereferenceObject (fffff800`0187cde0) nt!PspCreateThread+0x32a (fffff800`01af606a): call to nt!_security_check_cookie (fffff800`01895e50) nt!PspCreateThread+0x36a (fffff800`01af60aa): call to nt!ObfReferenceObject (fffff800`01883250) nt!PspCreateThread+0x3a2 (fffff800`01af60e2): call to nt!ExfAcquireRundownProtection (fffff800`0184f66c) nt! ?? ::NNGAKEGL::`string'+0x2816e (fffff800`01b3628e): call to nt!KiCheckForKernelApcDelivery (fffff800`0183c754) nt! ?? ::NNGAKEGL::`string'+0x281ad (fffff800`01b362ca): call to nt!ExfReleaseRundownProtection (fffff800`0184f690) nt! ?? ::NNGAKEGL::`string'+0x281ce (fffff800`01b362eb): call to nt!KiCheckForKernelApcDelivery (fffff800`0183c754) nt! ?? ::NNGAKEGL::`string'+0x281d8 (fffff800`01b362f5): call to nt!ObfDereferenceObject (fffff800`0187cde0) nt! ?? ::NNGAKEGL::`string'+0x281e7 (fffff800`01b36304): call to nt!ExfReleaseRundownProtection (fffff800`0184f690) nt! ?? ::NNGAKEGL::`string'+0x281ff (fffff800`01b3631c): call to nt!KiCheckForKernelApcDelivery (fffff800`0183c754) nt! ?? ::NNGAKEGL::`string'+0x2821a (fffff800`01b36337): call to nt!PspTerminateThreadByPointer (fffff800`01ad30dc)

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 01-March-10

Tuesday, March 2nd, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

NtCreateProcess (pp. 349 - 351) - a condensed view of top level function calls on x64 W2K8:

0: kd> uf /c nt!NtCreateProcess nt!NtCreateProcess (fffff800`01c51770) nt!NtCreateProcess+0x64 (fffff800`01c517d4): call to nt!NtCreateProcessEx (fffff800`01c516e0)

0: kd> uf /c nt!NtCreateProcessEx nt!NtCreateProcessEx (fffff800`01c516e0) nt!NtCreateProcessEx+0x7d (fffff800`01c5175d): call to nt!PspCreateProcess (fffff800`01c51410)

0: kd> uf /c nt!PspCreateProcess nt!PspCreateProcess (fffff800`01c51410) nt!PspCreateProcess+0xd0 (fffff800`01c514e0): call to nt!ObReferenceObjectByHandle (fffff800`01ad8110) nt!PspCreateProcess+0xff (fffff800`01c5150f): call to nt!ObfDereferenceObject (fffff800`0187cde0) nt!PspCreateProcess+0x146 (fffff800`01c51556): call to nt!ObReferenceObjectByHandle (fffff800`01ad8110) nt!PspCreateProcess+0x1a6 (fffff800`01c515b6): call to nt!PspAllocateProcess (fffff800`01aac690) nt!PspCreateProcess+0x202 (fffff800`01c51612): call to nt!PspInsertProcess (fffff800`01aa6520) nt!PspCreateProcess+0x21b (fffff800`01c5162b): call to nt!PspDoHandleSweepSingle (fffff800`01b92770) nt!PspCreateProcess+0x26f (fffff800`01c5167f): call to nt!SeDeleteAccessState (fffff800`01b02f8c) nt!PspCreateProcess+0x27a (fffff800`01c5168a): call to nt!ObfDereferenceObject (fffff800`0187cde0) nt!PspCreateProcess+0x287 (fffff800`01c51697): call to nt!ObfDereferenceObject (fffff800`0187cde0) nt!PspCreateProcess+0x294 (fffff800`01c516a4): call to nt!ObfDereferenceObject (fffff800`0187cde0) nt!PspCreateProcess+0x2a7 (fffff800`01c516b7): call to nt!_security_check_cookie (fffff800`01895e50)

NtCreateUserProcess (pp. 351 - 360) - a condensed view of top level function calls on x64 W2K8:

0: kd> uf /c nt!NtCreateUserProcess nt!NtCreateUserProcess (fffff800`01ab2238) nt!NtCreateUserProcess+0x97 (fffff800`01ab22cf): call to nt!memset (fffff800`0187a4d0) nt!NtCreateUserProcess+0xb4 (fffff800`01ab22ec): call to nt!memset (fffff800`0187a4d0) nt!NtCreateUserProcess+0x184 (fffff800`01ab23bc): call to nt!ExRaiseDatatypeMisalignment (fffff800`01bddd20) nt!NtCreateUserProcess+0x1c2 (fffff800`01ab23fb): call to nt!memset (fffff800`0187a4d0) nt!NtCreateUserProcess+0x1dd (fffff800`01ab2416): call to nt!PspBuildCreateProcessContext (fffff800`01af5204) nt!NtCreateUserProcess+0x207 (fffff800`01ab2440): call to nt!PspCaptureCreateInfo (fffff800`01aad390) nt!NtCreateUserProcess+0x2d1 (fffff800`01ab250a): call to nt!ZwOpenFile (fffff800`01873480) nt!NtCreateUserProcess+0x311 (fffff800`01ab254a): call to nt!ObReferenceObjectByHandle (fffff800`01ad8110) nt!NtCreateUserProcess+0x378 (fffff800`01ab25b1): call to nt!ZwCreateSection (fffff800`01873760) nt!NtCreateUserProcess+0x3af (fffff800`01ab25e8): call to nt!ObReferenceObjectByHandle (fffff800`01ad8110) nt!NtCreateUserProcess+0x412 (fffff800`01ab264b): call to nt!PspCaptureProcessParameters (fffff800`01aae128) nt!NtCreateUserProcess+0x483 (fffff800`01ab26bc): call to nt!PspAllocateProcess (fffff800`01aac690) nt!NtCreateUserProcess+0x546 (fffff800`01ab277f): call to nt!ObfReferenceObject (fffff800`01883250) nt!NtCreateUserProcess+0x630 (fffff800`01ab2869): call to nt!PspAllocateThread (fffff800`01af6338) nt!NtCreateUserProcess+0x69f (fffff800`01ab28d8): call to nt!PspInsertProcess (fffff800`01aa6520) nt!NtCreateUserProcess+0x70e (fffff800`01ab2947): call to nt!PspInsertThread (fffff800`01af4c10) nt!NtCreateUserProcess+0x74f (fffff800`01ab2988): call to nt!PspCreateObjectHandle (fffff800`01b01e10) nt!NtCreateUserProcess+0x775 (fffff800`01ab29ae): call to nt!memmove (fffff800`0186fce0) nt!NtCreateUserProcess+0x7ca (fffff800`01ab2a03): call to nt!PspUpdateCreateInfo (fffff800`01aadc9c) nt!NtCreateUserProcess+0x7d9 (fffff800`01ab2a12): call to nt!SeDeleteAccessState (fffff800`01b02f8c) nt!NtCreateUserProcess+0x7e9 (fffff800`01ab2a22): call to nt!ObfDereferenceObject (fffff800`0187cde0) nt!NtCreateUserProcess+0x7f1 (fffff800`01ab2a2a): call to nt!ObfDereferenceObject (fffff800`0187cde0) nt!NtCreateUserProcess+0x7fe (fffff800`01ab2a37): call to nt!PspDeleteCreateProcessContext (fffff800`01af68f0) nt!NtCreateUserProcess+0x810 (fffff800`01ab2a49): call to nt!_security_check_cookie (fffff800`01895e50) nt!NtCreateUserProcess+0x862 (fffff800`01ab2a9b): call to nt!ZwOpenFile (fffff800`01873480) nt!NtCreateUserProcess+0x884 (fffff800`01ab2abd): call to nt!PspUpdateCreateInfo (fffff800`01aadc9c) nt! ?? ::NNGAKEGL::`string'+0x4f944 (fffff800`01b55164): call to nt!ObReferenceObjectByHandle (fffff800`01ad8110) nt! ?? ::NNGAKEGL::`string'+0x4f9a5 (fffff800`01b551c5): call to nt!PspUpdateCreateInfo (fffff800`01aadc9c) nt! ?? ::NNGAKEGL::`string'+0x4fa80 (fffff800`01b55298): call to nt!PspGetContextThreadInternal (fffff800`01b02660) nt! ?? ::NNGAKEGL::`string'+0x4faf3 (fffff800`01b55303): call to nt!ExfTryToWakePushLock (fffff800`0186b924) nt! ?? ::NNGAKEGL::`string'+0x4fb21 (fffff800`01b55325): call to nt!KiCheckForKernelApcDelivery (fffff800`0183c754) nt! ?? ::NNGAKEGL::`string'+0x4fb3e (fffff800`01b55342): call to nt!PspDoHandleSweepSingle (fffff800`01b92770) nt! ?? ::NNGAKEGL::`string'+0x4fb92 (fffff800`01b55392): call to nt!KiCheckForKernelApcDelivery (fffff800`0183c754) nt! ?? ::NNGAKEGL::`string'+0x4fba0 (fffff800`01b553a0): call to nt!PspDoHandleSweepSingle (fffff800`01b92770) nt! ?? ::NNGAKEGL::`string'+0x4fbb2 (fffff800`01b553b2): call to nt!PsTerminateProcess (fffff800`01b94140)

The check for import of disallowed API during post-process initialization (p. 361)

CsrCreateProcess (pp. 361 - 362) - Here’s a condensed view of top level function calls on x64 W2K8:

0: kd> uf /c CsrCreateProcess CSRSRV!CsrCreateProcess (000007fe`fd8c76c8) CSRSRV!CsrCreateProcess+0x18 (000007fe`fd8c76e0): call to CSRSRV!CsrpCreateProcess (000007fe`fd8c7280)

0: kd> uf /c CsrpCreateProcess CSRSRV!CsrpCreateProcess (000007fe`fd8c7280) CSRSRV!CsrpCreateProcess+0x2e (000007fe`fd8c72ae): call to ntdll!RtlEnterCriticalSection (00000000`77478920) CSRSRV!CsrpCreateProcess+0x66 (000007fe`fd8c72e6): call to CSRSRV!CsrCreateThread (000007fe`fd8c77fc) CSRSRV!CsrpCreateProcess+0x78 (000007fe`fd8c72f8): call to ntdll!ZwClose (00000000`77476e00) CSRSRV!CsrpCreateProcess+0x83 (000007fe`fd8c7303): call to CSRSRV!CsrAllocateProcess (000007fe`fd8c715c) CSRSRV!CsrpCreateProcess+0xa4 (000007fe`fd8c7324): call to CSRSRV!CsrGetProcessLuid (000007fe`fd8c8790) CSRSRV!CsrpCreateProcess+0x114 (000007fe`fd8c7394): call to CSRSRV!memcpy (000007fe`fd8cadec) CSRSRV!CsrpCreateProcess+0x1ab (000007fe`fd8c742b): call to ntdll!NtSetInformationProcess (00000000`77476ed0) CSRSRV!CsrpCreateProcess+0x1d2 (000007fe`fd8c7452): call to ntdll!NtSetInformationProcess (00000000`77476ed0) CSRSRV!CsrpCreateProcess+0x257 (000007fe`fd8c74d7): call to ntdll!NtSetInformationProcess (00000000`77476ed0) CSRSRV!CsrpCreateProcess+0x277 (000007fe`fd8c74f7): call to ntdll!RtlFreeHeap (00000000`77478c80) CSRSRV!CsrpCreateProcess+0x2d8 (000007fe`fd8c7558): call to ntdll!NtQueryInformationThread (00000000`77476f60) CSRSRV!CsrpCreateProcess+0x2f0 (000007fe`fd8c7570): call to ntdll!RtlFreeHeap (00000000`77478c80) CSRSRV!CsrpCreateProcess+0x2fd (000007fe`fd8c757d): call to CSRSRV!CsrAllocateThread (000007fe`fd8c7b94) CSRSRV!CsrpCreateProcess+0x32d (000007fe`fd8c75ad): call to CSRSRV!CsrInsertThread (000007fe`fd8c7bfc) CSRSRV!CsrpCreateProcess+0x344 (000007fe`fd8c75c4): call to ntdll!RtlFreeHeap (00000000`77478c80) CSRSRV!CsrpCreateProcess+0x356 (000007fe`fd8c75d6): call to ntdll!RtlFreeHeap (00000000`77478c80) CSRSRV!CsrpCreateProcess+0x365 (000007fe`fd8c75e5): call to ntdll!RtlLeaveCriticalSection (00000000`77478960) CSRSRV!CsrpCreateProcess+0x393 (000007fe`fd8c7613): call to CSRSRV!CsrSetBackgroundPriority (000007fe`fd8c712c) CSRSRV!CsrpCreateProcess+0x3b6 (000007fe`fd8c7636): call to CSRSRV!CsrInsertProcess (000007fe`fd8c71f0) CSRSRV!CsrpCreateProcess+0x3d8 (000007fe`fd8c7658): call to ntdll!RtlLeaveCriticalSection (00000000`77478960)

No elevation, virtualization and compatibility checks for protected processes (p. 362)

KiThreadStartup (p. 363) - it looks like on x64 W2K8 it is KxStartUserThread that has this high-level call structure:

0: kd> uf /c nt!KxStartUserThread nt!KxStartUserThread (fffff800`018b56e0) nt!KiStartUserThread+0x12 (fffff800`018b5756): unresolvable call: call qword ptr [rsp+10h] nt!KiStartUserThread+0x9f (fffff800`018b57e3): call to nt!KiInitiateUserApc (fffff800`0189d710) nt!KiStartUserThread+0xbc (fffff800`018b5800): call to nt!KiRestoreDebugRegisterState (fffff800`01878860)

PspUserThreadStartup (p. 363) - high-level call structure on x64 W2K8

0: kd> uf /c PspUserThreadStartup nt!PspUserThreadStartup (fffff800`01b01ae4) nt!PspUserThreadStartup+0xa1 (fffff800`01b01b85): call to nt!MmGetSessionLocaleId (fffff800`01b028a4) nt!PspUserThreadStartup+0xdc (fffff800`01b01bc0): call to nt!DbgkCreateThread (fffff800`01b02cc0) nt!PspUserThreadStartup+0x100 (fffff800`01b01be4): call to nt!PfProcessCreateNotification (fffff800`01ab46cc) nt!PspUserThreadStartup+0x121 (fffff800`01b01c05): call to nt!PspInitializeThunkContext (fffff800`01b028e4) nt! ?? ::NNGAKEGL::`string'+0x42263 (fffff800`01b48d5a): call to nt!ExfAcquirePushLockExclusive (fffff800`0186aa60) nt! ?? ::NNGAKEGL::`string'+0x4226b (fffff800`01b48d62): call to nt!ExfReleasePushLockExclusive (fffff800`018c4b98) nt! ?? ::NNGAKEGL::`string'+0x42283 (fffff800`01b48d7a): call to nt!KiCheckForKernelApcDelivery (fffff800`0183c754) nt! ?? ::NNGAKEGL::`string'+0x42299 (fffff800`01b48d90): call to nt!PspTerminateThreadByPointer (fffff800`01ad30dc)

System-wide cookie in SharedUserData for pointer encoding/decoding API (p. 363)

LdrInitializeThunk (p. 364) - high-level call structure on x64 W2K8

0: kd> uf /c LdrInitializeThunk ntdll!LdrInitializeThunk (00000000`774568d0) ntdll!LdrInitializeThunk+0x9 (00000000`774568d9): call to ntdll!LdrpInitialize (00000000`77456990) ntdll!LdrInitializeThunk+0×13 (00000000`774568e3): call to ntdll!ZwContinue (00000000`77477140) ntdll!LdrInitializeThunk+0×1a (00000000`774568ea): call to ntdll!RtlRaiseStatus (00000000`774e8fa0) ntdll!RtlAllocateActivationContextStack+0×29 (00000000`7745692d): call to ntdll!RtlAllocateHeap (00000000`774789b0)

0: kd> uf /c LdrpInitialize Matched: 00000000`774567f0 ntdll!LdrpInitialize = <no type information> Matched: 00000000`77456990 ntdll!LdrpInitialize = <no type information> Ambiguous symbol error at ‘LdrpInitialize’

0: kd> uf /c 00000000`77456990 Flow analysis was incomplete, some code may be missing ntdll!LdrpInitialize (00000000`77456990) ntdll!LdrpInitialize+0xaa (00000000`7745689a): call to ntdll!LdrpInitializeThread (00000000`77470770) ntdll!LdrpInitialize+0xaf (00000000`7745689f): call to ntdll!ZwTestAlert (00000000`77478490) ntdll! ?? ::FNODOBFM::`string’+0×20948 (00000000`7746bb8b): call to ntdll!RtlInitializeSRWLock (00000000`774687f0) ntdll! ?? ::FNODOBFM::`string’+0×20954 (00000000`7746bb97): call to ntdll!LdrpInitializeProcess (00000000`7746ca20) ntdll! ?? ::FNODOBFM::`string’+0×20b40 (00000000`7746d540): call to ntdll!InitSecurityCookie (00000000`7746d560) ntdll! ?? ::FNODOBFM::`string’+0×20ae4 (00000000`7746e52f): call to ntdll!NtDelayExecution (00000000`77477050)

0: kd> uf /c ntdll!LdrpInitializeThread ntdll!LdrpInitializeThread (00000000`77470770) ntdll!LdrShutdownThread+0x139 (00000000`77437544): call to ntdll!LdrpCallTlsInitializers (00000000`77437630) ntdll!LdrpInitializeThread+0x16d (00000000`774376f8): call to ntdll!LdrpCallTlsInitializers (00000000`77437630) ntdll!LdrShutdownThread+0x124 (00000000`77448199): call to ntdll!RtlActivateActivationContextUnsafeFast (00000000`77478bf0) ntdll!LdrShutdownThread+0x149 (00000000`774481b5): unresolvable call: call rsi ntdll!LdrShutdownThread+0x151 (00000000`774481bd): call to ntdll!RtlDeactivateActivationContextUnsafeFast (00000000`77478b00) ntdll!LdrShutdownThread+0x68 (00000000`77448238): call to ntdll!RtlEnterCriticalSection (00000000`77478920) ntdll!LdrShutdownThread+0x1cd (00000000`774483cf): call to ntdll!LdrpFreeTls (00000000`774482f0) ntdll!LdrShutdownThread+0x1e1 (00000000`774483e3): call to ntdll!RtlLeaveCriticalSection (00000000`77478960) ntdll!LdrShutdownThread+0x1e6 (00000000`774483e8): call to ntdll!LdrpCleanupThreadTlsData (00000000`77448490) ntdll!LdrShutdownThread+0x213 (00000000`77448415): call to ntdll!RtlFreeHeap (00000000`77478c80) ntdll!LdrShutdownThread+0x246 (00000000`77448448): call to ntdll!RtlFreeActivationContextStack (00000000`774480a0) ntdll!LdrpInitializeThread+0x264 (00000000`774706bf): call to ntdll!RtlLeaveCriticalSection (00000000`77478960) ntdll!LdrpInitializeThread+0x43 (00000000`774707b3): call to ntdll!RtlAllocateActivationContextStack (00000000`77456900) ntdll!LdrpInitializeThread+0x5f (00000000`774707cf): call to ntdll!RtlEnterCriticalSection (00000000`77478920) ntdll!LdrpInitializeThread+0x65 (00000000`774707d5): call to ntdll!LdrpAllocateTls (00000000`774569d0) ntdll!LdrpInitializeThread+0x13e (00000000`774708ae): call to ntdll!RtlActivateActivationContextUnsafeFast (00000000`77478bf0) ntdll!LdrpInitializeThread+0x161 (00000000`774708d5): unresolvable call: call rsi ntdll!LdrpInitializeThread+0x17c (00000000`774708e1): call to ntdll!RtlDeactivateActivationContextUnsafeFast (00000000`77478b00) ntdll!LdrpInitializeThread+0x1a9 (00000000`7749017c): call to ntdll!RtlRaiseStatus (00000000`774e8fa0) ntdll!LdrpInitializeThread+0x1b5 (00000000`77490188): call to ntdll!RtlLeaveCriticalSection (00000000`77478960) ntdll!LdrpInitializeThread+0x1d0 (00000000`774901a3): call to ntdll!NtDelayExecution (00000000`77477050) ntdll!LdrpInitializeThread+0x1dc (00000000`774901af): call to ntdll!RtlEnterCriticalSection (00000000`77478920) ntdll!LdrpInitializeThread+0x233 (00000000`7749020a): call to ntdll!RtlActivateActivationContextUnsafeFast (00000000`77478bf0) ntdll!LdrpInitializeThread+0x245 (00000000`7749021c): call to ntdll!LdrpCallTlsInitializers (00000000`77437630) ntdll!LdrpInitializeThread+0x250 (00000000`77490227): call to ntdll!RtlDeactivateActivationContextUnsafeFast (00000000`77478b00) ntdll!LdrShutdownThread+0x1ab (00000000`7749027e): call to ntdll!RtlActivateActivationContextUnsafeFast (00000000`77478bf0) ntdll!LdrShutdownThread+0x1bd (00000000`77490290): call to ntdll!LdrpCallTlsInitializers (00000000`77437630) ntdll!LdrShutdownThread+0x1c8 (00000000`7749029b): call to ntdll!RtlDeactivateActivationContextUnsafeFast (00000000`77478b00) ntdll! ?? ::FNODOBFM::`string'+0x15c61 (00000000`774bd160): call to ntdll!NtDelayExecution (00000000`77477050) ntdll! ?? ::FNODOBFM::`string'+0x15c6e (00000000`774bd16d): call to ntdll!RtlRaiseStatus (00000000`774e8fa0) ntdll! ?? ::FNODOBFM::`string'+0x15cb0 (00000000`774bd1a6): call to ntdll!RtlEnterCriticalSection (00000000`77478920) ntdll! ?? ::FNODOBFM::`string'+0x15cbc (00000000`774bd1b2): call to ntdll!RtlLeaveCriticalSection (00000000`77478960) ntdll! ?? ::FNODOBFM::`string'+0x15cd7 (00000000`774bd1cd): call to ntdll!RtlFreeHeap (00000000`77478c80) ntdll! ?? ::FNODOBFM::`string'+0x15cfd (00000000`774bd1f3): call to ntdll!RtlFreeHeap (00000000`77478c80)

0: kd> uf /c ntdll!LdrpInitializeProcess Flow analysis was incomplete, some code may be missing ntdll!LdrpInitializeProcess (00000000`7746ca20) ntdll!LdrpInitializeProcess+0xf88 (00000000`7746bc0d): call to ntdll!LdrpUpdateOrderLinks (00000000`774644c0) ntdll!LdrpInitializeProcess+0xf9c (00000000`7746bc21): call to ntdll!RtlInsertInvertedFunctionTable (00000000`77464e50) ntdll!LdrpInitializeProcess+0xfa4 (00000000`7746bc29): call to ntdll!LdrpAllocateDataTableEntry (00000000`77464380) ntdll!LdrpInitializeProcess+0x1098 (00000000`7746bc76): call to ntdll!RtlImageNtHeaderEx (00000000`7747dc00) ntdll!LdrpInitializeProcess+0x10f1 (00000000`7746bccd): call to ntdll!RtlAppendUnicodeStringToString (00000000`774574b0) ntdll!LdrpInitializeProcess+0x110f (00000000`7746bceb): call to ntdll!LdrpUpdateOrderLinks (00000000`774644c0) ntdll!LdrpInitializeProcess+0x1123 (00000000`7746bcff): call to ntdll!RtlInsertInvertedFunctionTable (00000000`77464e50) ntdll!LdrpInitializeProcess+0x1128 (00000000`7746bd04): call to ntdll!RtlInitializeHistoryTable (00000000`7746da90) ntdll!LdrpInitializeProcess+0x11c9 (00000000`7746bd4f): call to ntdll!RtlpInitCurrentDir (00000000`7746db70) ntdll!LdrpInitializeProcess+0x1648 (00000000`7746bdca): call to ntdll!LdrLoadDll (00000000`77463e30) ntdll!LdrpInitializeProcess+0x16ba (00000000`7746bdf9): call to ntdll!LdrGetProcedureAddressEx (00000000`7747dd10) ntdll!LdrpInitializeProcess+0x171f (00000000`7746be16): call to ntdll!LdrpWalkImportDescriptor (00000000`77466390) ntdll!LdrpInitializeProcess+0x18cd (00000000`7746be5b): call to ntdll!LdrpInitializeTls (00000000`7746e380) ntdll!LdrpInitializeProcess+0x1940 (00000000`7746be88): call to ntdll!LdrpRunInitializeRoutines (00000000`77464650) ntdll!LdrpInitializeProcess+0x138e (00000000`7746bedf): call to ntdll!LdrLoadDll (00000000`77463e30) ntdll!LdrpInitializeProcess+0x13ff (00000000`7746bf0d): call to ntdll!LdrGetProcedureAddressEx (00000000`7747dd10) ntdll!LdrpInitializeProcess+0x1475 (00000000`7746bf3b): call to ntdll!LdrGetProcedureAddressEx (00000000`7747dd10) ntdll!LdrpInitializeProcess+0x14eb (00000000`7746bf69): call to ntdll!LdrGetProcedureAddressEx (00000000`7747dd10) ntdll!LdrpInitializeProcess+0x19f5 (00000000`7746bfc5): call to ntdll!_security_check_cookie (00000000`7747acb0) ntdll!LdrpInitializeProcess+0x32 (00000000`7746ca52): call to ntdll!RtlSetUnhandledExceptionFilter (00000000`7746c2d0) ntdll!LdrpInitializeProcess+0xe9 (00000000`7746ca9a): call to ntdll!RtlInitNlsTables (00000000`7746c920) ntdll!LdrpInitializeProcess+0xf6 (00000000`7746caa7): call to ntdll!RtlResetRtlTranslations (00000000`7746c410) ntdll!LdrpInitializeProcess+0xfe (00000000`7746caaf): call to ntdll!RtlpInitSRWLock (00000000`7746c530) ntdll!LdrpInitializeProcess+0x103 (00000000`7746cab4): call to ntdll!RtlpInitConditionVariable (00000000`7746c550) ntdll!LdrpInitializeProcess+0x213 (00000000`7746cb7d): call to ntdll!RtlImageNtHeader (00000000`774567b0) ntdll!LdrpInitializeProcess+0x273 (00000000`7746cbd7): call to ntdll!LdrpInitializeExecutionOptions (00000000`7746c6b0) ntdll!LdrpInitializeProcess+0x353 (00000000`7746cc2f): call to ntdll!RtlImageDirectoryEntryToData (00000000`7746a940) ntdll!LdrpInitializeProcess+0x3cd (00000000`7746cc95): call to ntdll!RtlNormalizeProcessParams (00000000`7746c2f0) ntdll!LdrpInitializeProcess+0x423 (00000000`7746cce3): call to ntdll!RtlImageDirectoryEntryToData (00000000`7746a940) ntdll!LdrpInitializeProcess+0x448 (00000000`7746cd02): call to ntdll!memset (00000000`77478830) ntdll!LdrpInitializeProcess+0x58c (00000000`7746cd53): call to ntdll!RtlpInitDeferredCriticalSection (00000000`7746c640) ntdll!LdrpInitializeProcess+0x7d5 (00000000`7746ceb5): call to ntdll!RtlInitializeCriticalSection (00000000`77455d20) ntdll!LdrpInitializeProcess+0x7fb (00000000`7746cedb): call to ntdll!RtlInitializeHeapManager (00000000`7746c7a0) ntdll!LdrpInitializeProcess+0x84b (00000000`7746cf2a): call to ntdll!RtlCreateHeap (00000000`77466ed0) ntdll!LdrpInitializeProcess+0x8e2 (00000000`7746cf51): call to ntdll!RtlAllocateActivationContextStack (00000000`77456900) ntdll!LdrpInitializeProcess+0x8f6 (00000000`7746cf65): call to ntdll!EtwpInitializeDll (00000000`7746c250) ntdll!LdrpInitializeProcess+0x916 (00000000`7746cf85): call to ntdll!RtlCreateTagHeap (00000000`7746d320) ntdll!LdrpInitializeProcess+0x942 (00000000`7746cfb1): call to ntdll!RtlCreateTagHeap (00000000`7746d320) ntdll!LdrpInitializeProcess+0x962 (00000000`7746cfd1): call to ntdll!RtlpInitEnvironmentBlock (00000000`7746d380) ntdll!LdrpInitializeProcess+0x96f (00000000`7746cfde): call to ntdll!RtlpInitParameterBlock (00000000`7746d7f0) ntdll!LdrpInitializeProcess+0xa5e (00000000`7746d068): call to ntdll!RtlInitUnicodeString (00000000`7747ad10) ntdll!LdrpInitializeProcess+0xa73 (00000000`7746d07d): call to ntdll!RtlAppendUnicodeStringToString (00000000`774574b0) ntdll!LdrpInitializeProcess+0xa87 (00000000`7746d091): call to ntdll!RtlAppendUnicodeStringToString (00000000`774574b0) ntdll!LdrpInitializeProcess+0xaf0 (00000000`7746d0fe): call to ntdll!ZwOpenDirectoryObject (00000000`77477290) ntdll!LdrpInitializeProcess+0xc2a (00000000`7746d171): call to ntdll!ZwOpenSymbolicLinkObject (00000000`77477cb0) ntdll!LdrpInitializeProcess+0xc6b (00000000`7746d1b2): call to ntdll!ZwQuerySymbolicLinkObject (00000000`77477f60) ntdll!LdrpInitializeProcess+0xc7a (00000000`7746d1c1): call to ntdll!ZwClose (00000000`77476e00) ntdll!LdrpInitializeProcess+0xe50 (00000000`7746d24d): call to ntdll!LdrpAllocateDataTableEntry (00000000`77464380) ntdll!LdrpInitializeProcess+0xee4 (00000000`7746d289): call to ntdll!RtlImageNtHeaderEx (00000000`7747dc00) ntdll!LdrpInitializeProcess+0x30d (00000000`77473eb0): call to ntdll!NtQueryInformationProcess (00000000`77476ea0) ntdll!LdrpInitializeProcess+0x635 (00000000`77473ef0): call to ntdll!RtlSetBits (00000000`77466c00) ntdll!LdrpInitializeProcess+0x873 (00000000`77473f19): call to ntdll!RtlCreateHeap (00000000`77466ed0) ntdll!LdrpInitializeProcess+0xbb8 (00000000`774744f9): call to ntdll!ZwOpenDirectoryObject (00000000`77477290) ntdll!LdrpInitializeProcess+0xe10 (00000000`77474554): call to ntdll!RtlAppendUnicodeStringToString (00000000`774574b0) ntdll!LdrpInitializeProcess+0x77 (00000000`77490a96): call to ntdll!NtQueryVirtualMemory (00000000`77476f40) ntdll!LdrpInitializeProcess+0xb3 (00000000`77490ad2): call to ntdll!NtQueryVirtualMemory (00000000`77476f40) ntdll!LdrpInitializeProcess+0x2d2 (00000000`77490b92): call to ntdll!LdrpLogDbgPrint (00000000`774ec5a0) ntdll!LdrpInitializeProcess+0x2db (00000000`77490b9d): call to ntdll!DbgBreakPoint (00000000`77476060) ntdll!LdrpInitializeProcess+0x720 (00000000`77490d34): call to ntdll!LdrQueryImageFileExecutionOptions (00000000`77473260) ntdll!LdrpInitializeProcess+0x790 (00000000`77490da4): call to ntdll!LdrpLogDbgPrint (00000000`774ec5a0) ntdll!LdrpInitializeProcess+0x79a (00000000`77490dae): call to ntdll!DbgBreakPoint (00000000`77476060) ntdll!LdrpInitializeProcess+0x7c6 (00000000`77490dda): call to ntdll!RtlControlStackTraceDataBase (00000000`774e3cd0) ntdll!LdrpInitializeProcess+0x8ac (00000000`77490e27): call to ntdll!LdrpLogDbgPrint (00000000`774ec5a0) ntdll!LdrpInitializeProcess+0x8bf (00000000`77490e3a): call to ntdll!DbgBreakPoint (00000000`77476060) ntdll!LdrpInitializeProcess+0x9ff (00000000`77490e8c): call to ntdll!RtlQueryImageFileKeyOption (00000000`77473320) ntdll!LdrpInitializeProcess+0xb0f (00000000`77490ee2): call to ntdll!RtlInitUnicodeString (00000000`7747ad10) ntdll!LdrpInitializeProcess+0xcea (00000000`77490f57): call to ntdll!LdrpLogDbgPrint (00000000`774ec5a0) ntdll!LdrpInitializeProcess+0xd01 (00000000`77490f6e): call to ntdll!LdrpInitializationFailure (00000000`774ed120) ntdll!LdrpInitializeProcess+0xd3f (00000000`77490f82): call to ntdll!RtlAllocateHeap (00000000`774789b0) ntdll!LdrpInitializeProcess+0xd7d (00000000`77490fc0): call to ntdll!LdrpLogDbgPrint (00000000`774ec5a0) ntdll!LdrpInitializeProcess+0xd90 (00000000`77490fd3): call to ntdll!DbgBreakPoint (00000000`77476060)

Private vs. shared assemblies (p. 365)

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 09-February-10

Tuesday, February 9th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

CreateProcess and Increase Scheduling Priority privilege (p. 351)

MS-DOS apps share the same VDM (p. 353)

HKLM\S\CCS\C\WOW\DefaultSeparateVDM (p. 353)

IMAGE_FILE_UP_SYSTEM_ONLY PE characteristic to run on a single CPU (p. 358)

Upon creation initial thread starts in kernel mode in KiThreadStartup (p. 360)

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Windows Internals, Reading Notebook | No Comments »

Reading Notebook: 25-January-10

Monday, January 25th, 2010

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Kernel Process variables (p. 343)

0: kd> !process poi(PsIdleProcess) PROCESS fffff800019910c0 SessionId: none Cid: 0000 Peb: 00000000 ParentCid: 0000 DirBase: 00124000 ObjectTable: fffff88000000080 HandleCount: 606. Image: Idle VadRoot fffffa8003b97c70 Vads 1 Clone 0 Private 1. Modified 0. Locked 0. DeviceMap 0000000000000000 Token fffff88000003330 ElapsedTime 00:00:00.000 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (6, 50, 450) (24KB, 200KB, 1800KB) PeakWorkingSetSize 6 VirtualSize 0 Mb PeakVirtualSize 0 Mb PageFaultCount 1 MemoryPriority BACKGROUND BasePriority 0 CommitCharge 0

THREAD fffff80001990b80 Cid 0000.0000 Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0 Not impersonating DeviceMap fffff88000007310 Owning Process fffff800019910c0 Image: Idle Attached Process fffffa8003bf1040 Image: System Wait Start TickCount 16021 Ticks: 13224 (0:00:03:26.295) Context Switch Count 142852 UserTime 00:00:00.000 KernelTime 00:06:13.700 Win32 Start Address nt!KiIdleLoop (0xfffff80001876880) Stack Init fffff80002bdadb0 Current fffff80002bdad40 Base fffff80002bdb000 Limit fffff80002bd5000 Call 0 Priority 16 BasePriority 0 PriorityDecrement 0 IoPriority 0 PagePriority 0 Child-SP RetAddr Call Site fffff800`02bdad80 fffff800`01a43860 nt!KiIdleLoop+0x11b fffff800`02bdadb0 00000000`00000000 nt!zzz_AsmCodeRange_End+0x4

THREAD fffffa60005f5d40 Cid 0000.0000 Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 1 Not impersonating DeviceMap fffff88000007310 Owning Process fffff800019910c0 Image: Idle Attached Process fffffa8003bf1040 Image: System Wait Start TickCount 0 Ticks: 29245 (0:00:07:36.224) Context Switch Count 162365 UserTime 00:00:00.000 KernelTime 00:06:14.808 Win32 Start Address nt!KiIdleLoop (0xfffff80001876880) Stack Init fffffa600191bdb0 Current fffffa600191bd40 Base fffffa600191c000 Limit fffffa6001916000 Call 0 Priority 16 BasePriority 0 PriorityDecrement 0 IoPriority 0 PagePriority 0 Child-SP RetAddr Call Site fffffa60`0191bd80 fffff800`01a43860 nt!KiIdleLoop+0x11b fffffa60`0191bdb0 00000000`00000000 nt!zzz_AsmCodeRange_End+0x4

Relevant process functions (pp. 344 - 345) - More of them can be found here: http://msdn.microsoft.com/en-us/library/ms684847(VS.85).aspx

Protected processes (pp. 346 - 348) - It can be seen in _EPROCESS block (the output taken from a complete memory dump):

0: kd> dt _EPROCESS fffffa8004b5e040 ntdll!_EPROCESS [...] +0x36c ProtectedProcess : 0y1 [...]

The following script lists protected processes on W2K8:

0: kd> !for_each_process "dt _EPROCESS ImageFileName @#Process; dt _EPROCESS ProtectedProcess @#Process" ntdll!_EPROCESS +0x238 ImageFileName : [16] "System" ntdll!_EPROCESS +0x36c ProtectedProcess : 0y1 [...] ntdll!_EPROCESS +0x238 ImageFileName : [16] "audiodg.exe" ntdll!_EPROCESS +0x36c ProtectedProcess : 0y1 [...]

System process is protected because of Ksecdd.sys stores info in user space (p. 347)

PROCESS_QUERY_LIMITED_INFORMATION (p. 347)

Access violation by design for Protected Media Path processes when a kernel-mode debugger is enabled (p. 348) - this is not an optimal design in my opinion - I had problems with that: http://www.dumpanalysis.org/blog/index.php/2010/01/08/live-kernel-debugging-of-a-system-freeze-case-study/. The better way is to show a message box and gracefully exit and only emit AV if message box is bypassed.

Advanced .NET Debugging by M. Hewardt:

PE format and its relation to .NET (pp. 26 - 27)

AddressOfEntryPoint (pp. 28 - 29 and p. 31) - we can also use !dh command to find that address (similar to what dumpbin.exe does):

0:001> lm m notepad start end module name 00000000`ff180000 00000000`ff1af000 notepad (deferred)

0:001> !dh 00000000`ff180000 [...] OPTIONAL HEADER VALUES 20B magic # 8.00 linker version E400 size of code 1CC00 size of initialized data 0 size of uninitialized data D1B4 address of entry point 1000 base of code —– new —– 00000000ff180000 image base 1000 section alignment 200 file alignment 2 subsystem (Windows GUI) 6.00 operating system version 6.00 image version 6.00 subsystem version 2F000 size of image 400 size of headers 32C26 checksum […]

0:001> u 00000000`ff180000+D1B4 notepad!WinMainCRTStartup: 00000000`ff18d1b4 4883ec28 sub rsp,28h 00000000`ff18d1b8 e88b020000 call notepad!_security_init_cookie (00000000`ff18d448) 00000000`ff18d1bd 4883c428 add rsp,28h 00000000`ff18d1c1 e9b6fcffff jmp notepad!IsTextUTF8+0xc0 (00000000`ff18ce7c) 00000000`ff18d1c6 cc int 3 00000000`ff18d1c7 cc int 3 00000000`ff18d1c8 cc int 3 00000000`ff18d1c9 cc int 3

Application domains in ASP.NET; 3 default app domains (system, shared, default) in normal app (p. 34)

!dumpdomain SOS command (pp. 35 - 36)

Low(High)FrequencyHeap and StubHeap (p. 36) - Looks like they are not normal heaps or heap segments. I plan to test all commands on x64 .NET:

0:003> !dumpdomain -------------------------------------- System Domain: 000007fef15a8ef0 LowFrequencyHeap: 000007fef15a8f38 HighFrequencyHeap: 000007fef15a8fc8 StubHeap: 000007fef15a9058 Stage: OPEN Name: None -------------------------------------- Shared Domain: 000007fef15a9860 LowFrequencyHeap: 000007fef15a98a8 HighFrequencyHeap: 000007fef15a9938 StubHeap: 000007fef15a99c8 Stage: OPEN Name: None Assembly: 0000000000372d10 -------------------------------------- Domain 1: 0000000000360840 LowFrequencyHeap: 0000000000360888 HighFrequencyHeap: 0000000000360918 StubHeap: 00000000003609a8 Stage: OPEN SecurityDescriptor: 00000000003630e0 Name: TestCLR.exe [...]

- Dmitry Vostokov @ SoftwareGeneralist.com -

Posted in Notes on Advanced .NET Debugging, Notes on Windows Internals, Reading Notebook | No Comments »

Archive for the ‘Reading Notebook’ Category

Reading Notebook: 03-August-10

Reading Notebook: 19-July-10

Reading Notebook: 12-July-10

Reading Notebook: 16-June-10

Reading Notebook: 31-May-10

Reading Notebook: 26-May-10

Reading Notebook: 25-May-10

Reading Notebook: 24-May-10

Reading Notebook: 12-May-10

Reading Notebook: 09-April-10

Reading Notebook: 30-March-10

Reading Notebook: 26-March-10

Reading Notebook: 22-March-10

Reading Notebook: 18-March-10

Reading Notebook: 15-March-10

Reading Notebook: 11-March-10

Reading Notebook: 10-March-10

Reading Notebook: 01-March-10

Reading Notebook: 09-February-10

Reading Notebook: 25-January-10

Pages

Categories

Recent Comments

Archives

Blogroll

Contributors

Magazines

Related Links

Meta

Subscribe

September 2010
M	T	W	T	F	S	S
« Aug
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30