Fail Fast 代码
当Windows遇到可能危及计算机安全的错误情况时,遇到该情况的程序会尽快终止。这是通过快速故障机制完成的。你不能重新定义它,也不能将它从用户模式代码中挂钩。在x86/x64上,它被实现为一个中断调用,在内核内部处理。
这些代码的定义在winnt.h中
Definition | Value | Comment |
FAST_FAIL_LEGACY_GS_VIOLATION | 0 | Do not use. Legacy value. |
FAST_FAIL_VTGUARD_CHECK_FAILURE | 1 | |
FAST_FAIL_STACK_COOKIE_CHECK_FAILURE | 2 | |
FAST_FAIL_CORRUPT_LIST_ENTRY | 3 | |
FAST_FAIL_INCORRECT_STACK | 4 | |
FAST_FAIL_INVALID_ARG | 5 | |
FAST_FAIL_GS_COOKIE_INIT | 6 | |
FAST_FAIL_FATAL_APP_EXIT | 7 | |
FAST_FAIL_RANGE_CHECK_FAILURE | 8 | |
FAST_FAIL_UNSAFE_REGISTRY_ACCESS | 9 | |
FAST_FAIL_GUARD_ICALL_CHECK_FAILURE | 10 | |
FAST_FAIL_GUARD_WRITE_CHECK_FAILURE | 11 | |
FAST_FAIL_INVALID_FIBER_SWITCH | 12 | |
FAST_FAIL_INVALID_SET_OF_CONTEXT | 13 | |
FAST_FAIL_INVALID_REFERENCE_COUNT | 14 | |
FAST_FAIL_INVALID_JUMP_BUFFER | 18 | |
FAST_FAIL_MRDATA_MODIFIED | 19 | |
FAST_FAIL_CERTIFICATION_FAILURE | 20 | |
FAST_FAIL_INVALID_EXCEPTION_CHAIN | 21 | |
FAST_FAIL_CRYPTO_LIBRARY | 22 | |
FAST_FAIL_INVALID_CALL_IN_DLL_CALLOUT | 23 | |
FAST_FAIL_INVALID_IMAGE_BASE | 24 | |
FAST_FAIL_DLOAD_PROTECTION_FAILURE | 25 | |
FAST_FAIL_UNSAFE_EXTENSION_CALL | 26 | |
FAST_FAIL_DEPRECATED_SERVICE_INVOKED | 27 | |
FAST_FAIL_INVALID_BUFFER_ACCESS | 28 | |
FAST_FAIL_INVALID_BALANCED_TREE | 29 | |
FAST_FAIL_INVALID_NEXT_THREAD | 30 | |
FAST_FAIL_GUARD_ICALL_CHECK_SUPPRESSED | 31 | Telemetry, nonfatal |
FAST_FAIL_APCS_DISABLED | 32 | |
FAST_FAIL_INVALID_IDLE_STATE | 33 | |
FAST_FAIL_MRDATA_PROTECTION_FAILURE | 34 | |
FAST_FAIL_UNEXPECTED_HEAP_EXCEPTION | 35 | |
FAST_FAIL_INVALID_LOCK_STATE | 36 | |
FAST_FAIL_GUARD_JUMPTABLE | 37 | Compiler uses this value. Do not change. |
FAST_FAIL_INVALID_LONGJUMP_TARGET | 38 | |
FAST_FAIL_INVALID_DISPATCH_CONTEXT | 39 | |
FAST_FAIL_INVALID_THREAD | 40 | |
FAST_FAIL_INVALID_SYSCALL_NUMBER | 41 | Telemetry, nonfatal |
FAST_FAIL_INVALID_FILE_OPERATION | 42 | Telemetry, nonfatal |
FAST_FAIL_LPAC_ACCESS_DENIED | 43 | Telemetry, nonfatal |
FAST_FAIL_GUARD_SS_FAILURE | 44 | |
FAST_FAIL_LOADER_CONTINUITY_FAILURE | 45 | Telemetry, nonfatal |
FAST_FAIL_GUARD_EXPORT_SUPPRESSION_FAILURE | 46 | |
FAST_FAIL_INVALID_CONTROL_STACK | 47 | |
FAST_FAIL_SET_CONTEXT_DENIED | 48 | |
FAST_FAIL_INVALID_IAT | 49 | |
FAST_FAIL_HEAP_METADATA_CORRUPTION | 50 | |
FAST_FAIL_PAYLOAD_RESTRICTION_VIOLATION | 51 | |
FAST_FAIL_LOW_LABEL_ACCESS_DENIED | 52 | Telemetry, nonfatal |
FAST_FAIL_ENCLAVE_CALL_FAILURE | 53 | |
FAST_FAIL_UNHANDLED_LSS_EXCEPTON | 54 | |
FAST_FAIL_ADMINLESS_ACCESS_DENIED | 55 | Telemetry, nonfatal |
FAST_FAIL_UNEXPECTED_CALL | 56 | |
FAST_FAIL_CONTROL_INVALID_RETURN_ADDRESS | 57 | |
FAST_FAIL_UNEXPECTED_HOST_BEHAVIOR | 58 | |
FAST_FAIL_FLAGS_CORRUPTION | 59 | |
FAST_FAIL_VEH_CORRUPTION | 60 | |
FAST_FAIL_ETW_CORRUPTION | 61 | |
FAST_FAIL_RIO_ABORT | 62 | |
FAST_FAIL_INVALID_PFN | 63 | |
FAST_FAIL_GUARD_ICALL_CHECK_FAILURE_XFG | 64 | |
FAST_FAIL_CAST_GUARD | 65 | Compiler uses this value. Do not change. |
FAST_FAIL_HOST_VISIBILITY_CHANGE | 66 | |
FAST_FAIL_KERNEL_CET_SHADOW_STACK_ASSIST | 67 | |
FAST_FAIL_PATCH_CALLBACK_FAILED | 68 | |
FAST_FAIL_NTDLL_PATCH_FAILED | 69 | |
FAST_FAIL_INVALID_FLS_DATA | 70 |
FAST_FAIL_LEGACY_GS_VIOLATION定义是一个保留值,保留用于与STATUS_STACK_BUFFER_OVERRUN异常状态代码的先前实现兼容。在用户模式下,代码__fastfail()将被视为不可继续的Second chance exception,代码为0xC0000409(STATUS_STACK_BUFFER_OVERRUN)。不存在需要处理的First chance exception。这是经过深思熟虑的——假设程序状态已损坏,并且异常处理机制可能已被破坏(比如病毒等)。快速失败代码是与第二次机会异常一起提供的第一个参数。可能还有其他参数。在内核模式下,__fastfail()由特定的错误检查代码0x139(kernel_SECURITY_CHECK_FAILURE)处理。如果存在调试器,它将有机会在程序终止执行之前检查程序。
为虫子生,为虫子死,为虫子奋斗一辈子