Archive for July 6th, 2010

Crash Dump Analysis Patterns (Part 100)

Tuesday, July 6th, 2010

In addition to hooking functions via code patching there is another function pre- and post-processing done via windows message hooking mechanism that I call Message Hooks pattern to differentiate it from Hooked Functions pattern. In some cases message hooking become sources of aberrant software behaviour including spikes, hangs and crashes. We can identify such residue looking at the problem thread raw stack:

0:000> !teb
TEB at 7ffde000
    ExceptionList:        0012fcdc
    StackBase:            00130000
    StackLimit:           0011b000
    SubSystemTib:         00000000
    FiberData:            00001e00
    ArbitraryUserPointer: 00000000
    Self:                 7ffde000
    EnvironmentPointer:   00000000
    ClientId:             0000050c . 000004b8
    RpcHandle:            00000000
    Tls Storage:          00000000
    PEB Address:          7ffdf000
    LastErrorValue:       0
    LastStatusValue:      c0000034
    Count Owned Locks:    0
    HardErrorMode:        0

0:000> dps 0011b000 00130000
[...]
0012fc78  7e4318d1 user32!DispatchHookA
0012fc7c  0012fcb8
0012fc80  7472467f
0012fc84  7e43e1ad user32!NtUserCallNextHookEx+0xc
0012fc88  7e43e18a user32!CallNextHookEx+0×6f

0012fc8c  00000003
0012fc90  00000011
0012fc94  001d0001
0012fc98  00000001
0012fc9c  00000003
0012fca0  00000000
0012fca4  001d0001
0012fca8  0012fcec
0012fcac  74730844DllA!ThreadKeyboardProc+0×77
0012fcb0  001e04f7
0012fcb4  00000003
0012fcb8  00000011
0012fcbc  001d0001
0012fcc0  00000003
0012fcc4  00020003
0012fcc8  001d0001
0012fccc  00000000
0012fcd0  001e04f7
0012fcd4  0012fcc0
0012fcd8  00000000
0012fcdc  0012fd4c
0012fce0  7475f1a6
0012fce4  74730850
0012fce8  ffffffff
0012fcec  0012fd20
0012fcf0  7e431923 user32!DispatchHookA+0×101
0012fcf4  00000003
0012fcf8  00000011
0012fcfc  001d0001
0012fd00  00000000
0012fd04  0012fe94
0012fd08  00000102
0012fd0c  7ffde000
0012fd10  00000000
0012fd14  00000001
0012fd18  00000003
0012fd1c  7e42b326 user32!CallHookWithSEH+0×44
0012fd20  0012fd5c
0012fd24  7e42b317 user32!CallHookWithSEH+0×21
0012fd28  00020003
0012fd2c  00000011
0012fd30  001d0001
0012fd34  747307c3
0012fd38  00000000
0012fd3c  0012fe94
0012fd40  00000102
[…]

0:000> ub 74730844
DllA!ThreadKeyboardProc+0×5e:
7473082b jne     DllA!ThreadKeyboardProc+0×77 (74730844)
7473082d cmp     dword ptr [ebp-1Ch],esi
74730830 je      DllA!ThreadKeyboardProc+0×77 (74730844)
74730832 push    dword ptr [ebp+10h]
74730835 push    dword ptr [ebp+0Ch]
74730838 push    dword ptr [ebp+8]
7473083b push    dword ptr [ebp-1Ch]
7473083e call    dword ptr [DllA!_imp__CallNextHookEx (74721248)]

Sometimes we can even reconstruct stack trace fragments that show message hooking call stack. When threads are spiking or blocked in a message hook procedure we can see a hooking module too:

0:000> kL
ChildEBP RetAddr 
0012fc80 7e43e1ad ntdll!KiFastSystemCallRet
0012fca8 74730844 user32!NtUserCallNextHookEx+0xc
0012fcec 7e431923 DllA!ThreadKeyboardProc+0×77
0012fd20 7e42b317 user32!DispatchHookA+0×101
0012fd5c 7e430238 user32!CallHookWithSEH+0×21

0012fd80 7c90e473 user32!__fnHkINDWORD+0×24
0012fda4 7e4193e9 ntdll!KiUserCallbackDispatcher+0×13
0012fdd0 7e419402 user32!NtUserPeekMessage+0xc
0012fdfc 747528ee user32!PeekMessageW+0xbc
[…]
0012fff0 00000000 kernel32!BaseProcessStart+0×23

The next 2 posts will feature a case study and a modeling example.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -