Crash Dump Analysis Patterns (Part 100)

In addition to hooking functions via code patching there is another function pre- and post-processing done via windows message hooking mechanism that I call Message Hooks pattern to differentiate it from Hooked Functions pattern. In some cases message hooking become sources of aberrant software behaviour including spikes, hangs and crashes. We can identify such residue looking at the problem thread raw stack:

0:000> !teb
TEB at 7ffde000
    ExceptionList:        0012fcdc
    StackBase:            00130000
    StackLimit:           0011b000
    SubSystemTib:         00000000
    FiberData:            00001e00
    ArbitraryUserPointer: 00000000
    Self:                 7ffde000
    EnvironmentPointer:   00000000
    ClientId:             0000050c . 000004b8
    RpcHandle:            00000000
    Tls Storage:          00000000
    PEB Address:          7ffdf000
    LastErrorValue:       0
    LastStatusValue:      c0000034
    Count Owned Locks:    0
    HardErrorMode:        0

0:000> dps 0011b000 00130000
[...]
0012fc78  7e4318d1 user32!DispatchHookA
0012fc7c  0012fcb8
0012fc80  7472467f
0012fc84  7e43e1ad user32!NtUserCallNextHookEx+0xc
0012fc88  7e43e18a user32!CallNextHookEx+0×6f

0012fc8c  00000003
0012fc90  00000011
0012fc94  001d0001
0012fc98  00000001
0012fc9c  00000003
0012fca0  00000000
0012fca4  001d0001
0012fca8  0012fcec
0012fcac  74730844DllA!ThreadKeyboardProc+0×77
0012fcb0  001e04f7
0012fcb4  00000003
0012fcb8  00000011
0012fcbc  001d0001
0012fcc0  00000003
0012fcc4  00020003
0012fcc8  001d0001
0012fccc  00000000
0012fcd0  001e04f7
0012fcd4  0012fcc0
0012fcd8  00000000
0012fcdc  0012fd4c
0012fce0  7475f1a6
0012fce4  74730850
0012fce8  ffffffff
0012fcec  0012fd20
0012fcf0  7e431923 user32!DispatchHookA+0×101
0012fcf4  00000003
0012fcf8  00000011
0012fcfc  001d0001
0012fd00  00000000
0012fd04  0012fe94
0012fd08  00000102
0012fd0c  7ffde000
0012fd10  00000000
0012fd14  00000001
0012fd18  00000003
0012fd1c  7e42b326 user32!CallHookWithSEH+0×44
0012fd20  0012fd5c
0012fd24  7e42b317 user32!CallHookWithSEH+0×21
0012fd28  00020003
0012fd2c  00000011
0012fd30  001d0001
0012fd34  747307c3
0012fd38  00000000
0012fd3c  0012fe94
0012fd40  00000102
[…]

0:000> ub 74730844
DllA!ThreadKeyboardProc+0×5e:
7473082b jne     DllA!ThreadKeyboardProc+0×77 (74730844)
7473082d cmp     dword ptr [ebp-1Ch],esi
74730830 je      DllA!ThreadKeyboardProc+0×77 (74730844)
74730832 push    dword ptr [ebp+10h]
74730835 push    dword ptr [ebp+0Ch]
74730838 push    dword ptr [ebp+8]
7473083b push    dword ptr [ebp-1Ch]
7473083e call    dword ptr [DllA!_imp__CallNextHookEx (74721248)]

Sometimes we can even reconstruct stack trace fragments that show message hooking call stack. When threads are spiking or blocked in a message hook procedure we can see a hooking module too:

0:000> kL
ChildEBP RetAddr 
0012fc80 7e43e1ad ntdll!KiFastSystemCallRet
0012fca8 74730844 user32!NtUserCallNextHookEx+0xc
0012fcec 7e431923 DllA!ThreadKeyboardProc+0×77
0012fd20 7e42b317 user32!DispatchHookA+0×101
0012fd5c 7e430238 user32!CallHookWithSEH+0×21

0012fd80 7c90e473 user32!__fnHkINDWORD+0×24
0012fda4 7e4193e9 ntdll!KiUserCallbackDispatcher+0×13
0012fdd0 7e419402 user32!NtUserPeekMessage+0xc
0012fdfc 747528ee user32!PeekMessageW+0xbc
[…]
0012fff0 00000000 kernel32!BaseProcessStart+0×23

The next 2 posts will feature a case study and a modeling example.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

3 Responses to “Crash Dump Analysis Patterns (Part 100)”

  1. Crash Dump Analysis » Blog Archive » Models for Memory and Trace Analysis Patterns (Part 3) Says:

    […] we model Message Hooks pattern using MessageHistory tool. It uses window message hooking mechanism to intercept window […]

  2. Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 111) Says:

    […] the presence of the whole Pervasive System. It is not just a module that does function and / or message hooking but the whole system of modules from a single vendor that is context-aware (for example, […]

  3. Dmitry Vostokov Says:

    Another example:

    002afcd0 765614ab ntdll!ZwWaitForSingleObject+0×15
    002afd3c 768b1194 KERNELBASE!WaitForSingleObjectEx+0×98
    002afd54 768b1148 kernel32!WaitForSingleObjectExImplementation+0×75
    002afd68 002e95de kernel32!WaitForSingleObject+0×12
    WARNING: Stack unwind information not available. Following frames may be wrong.
    002afd9c 767c8336 HookA+0×95de
    002afdcc 767b80a9 USER32!DispatchHookA+0×10e
    002afe0c 767c2bfd USER32!CallHookWithSEH+0×21
    002afe3c 775b010a USER32!__fnHkINLPMOUSEHOOKSTRUCTEX+0×29
    002afed4 00471c64 ntdll!KiUserCallbackDispatcher+0×2e
    002afefc 00471d1f ProcessA+0×62d60
    […]
    002aff94 775d9f72 kernel32!BaseThreadInitThunk+0xe
    002affd4 775d9f45 ntdll!__RtlUserThreadStart+0×70
    002affec 00000000 ntdll!_RtlUserThreadStart+0×1b

Leave a Reply

You must be logged in to post a comment.