随笔分类 -  分析 调试

一个XP SP3调用0地址蓝屏BUG
摘要：0x00蓝屏的堆栈在XPSP3上跑POC之后，一段时间之后会出现蓝屏，蓝屏的堆栈如下，可以看出是ACKData里面CALL了一个0指针导致的蓝屏0x01蓝屏原因1ETW(EventTracingforWindows)是系统提供的一种事件监控机制，用ETW可以用来监控网络IO，磁盘IO等事件。XPSP... 阅读全文
posted @ 2015-11-24 10:15 sysnap 阅读(292) 评论(0) 推荐(0)
调试NTDLL加载
摘要：1 随便切到一个进程0: kd> !process 0 0 explorer.exePROCESS 8157e9a8 SessionId: 0 Cid: 06a4 Peb: 7ffde000 ParentCid: 0688 DirBase: 01f401e0 ObjectTabl... 阅读全文
posted @ 2015-11-18 11:37 sysnap 阅读(605) 评论(0) 推荐(0)
WINRAR弹窗堆栈
摘要：0:000> db 004ddfa8004ddfa8 6f 00 70 00 65 00 6e 00-00 00 00 00 2d 00 6e 00 o.p.e.n.....-.n.030631ac "http://cdn.castplatform.com/scri"030631ec "pt... 阅读全文
posted @ 2015-11-02 12:11 sysnap 阅读(250) 评论(0) 推荐(0)
【原创】FltGetFileNameInformation蓝屏分析
摘要：FAULTING_IP: nt!SeCreateAccessStateEx+5b80564184 848788000000 test byte ptr [edi+88h],alTRAP_FRAME: f1c6756c -- (.trap 0xfffffffff1c6756c)ErrCo... 阅读全文
posted @ 2015-07-05 11:19 sysnap 阅读(1264) 评论(0) 推荐(0)
【原创】调用系统函数里面蓝屏例子
摘要：IRQL_NOT_LESS_OR_EQUAL (a)An attempt was made to access a pageable (or completely invalid) address at aninterrupt request level (IRQL) that is too hig... 阅读全文
posted @ 2015-07-05 11:17 sysnap 阅读(906) 评论(0) 推荐(0)
【原创】FltSendMessage蓝屏分析
摘要：INVALID_PROCESS_DETACH_ATTEMPT (6)Arguments:Arg1: 00000000Arg2: 00000000Arg3: 00000000Arg4: 00000000Debugging Details:------------------CUSTOMER_CRASH... 阅读全文
posted @ 2015-07-05 11:14 sysnap 阅读(1146) 评论(0) 推荐(0)