Нарушение страницы и нарушение доступа к appverifier в ntdll!RtlCreateHeap

Я живое приложение отладки с использованием windbg с включенной кучи страниц и верификатором приложения. Я включил кучу страниц с помощью следующей команды:

gflags / p / enable "C: \ Program Files \ myapp.exe" / full

Запустил приложение, подключил к windbg и выполнил следующие команды. Остановлено с нарушением прав доступа - код c0000005 при создании новой кучи.

0:000> !gflag
Current NtGlobalFlag contents: 0x02000101
    soe - Stop On Exception
    vrf - Enable application verifier
    hpa - Place heap allocations at ends of pages

0:000> !gflag +ust +htc +hfc +hpc +hvc 
New NtGlobalFlag contents: 0x020011f1
    soe - Stop On Exception
    htc - Enable heap tail checking
    hfc - Enable heap free checking
    hpc - Enable heap parameter checking
    hvc - Enable heap validation on call
    vrf - Enable application verifier
    ust - Create user mode stack trace database
    hpa - Place heap allocations at ends of pages

0:000> !heap
HEAPEXT: Unable to get address of ntdll!RtlpHeapInvalidBadAddress.
NtGlobalFlag enables following debugging aids for new heaps:    tail checking
    free checking
    validate parameters
    validate on call
    stack back traces
Index   Address  Name      Debugging options enabled
  1:   1d8ca990000                
  2:   1d8cbc70000                
  3:   1d8ca920000                
0:000> g
(76c.2180): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
ntdll!RtlDebugCreateHeap+0x2bb:
00007ff9`c903b47b 66898730010000  mov     word ptr [rdi+130h],ax ds:000001d8`ceff0130=eeee
0:000> g
(76c.2180): Access violation - code c0000005 (!!! second chance !!!)
ntdll!RtlDebugCreateHeap+0x2bb:
00007ff9`c903b47b 66898730010000  mov     word ptr [rdi+130h],ax ds:00000051`5e0fe060=0000
0:000> g
(76c.2180): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
ntdll!RtlDebugCreateHeap+0x2bb:
00007ff9`c903b47b 66898730010000  mov     word ptr [rdi+130h],ax ds:000001d8`ceff0130=eeee

0:000> k
Child-SP          RetAddr           Call Site
00000051`5e0fe4f0 00007ff9`c8ff48c0 ntdll!RtlDebugCreateHeap+0x2bb
00000051`5e0fe570 00007ff9`a22b3847 ntdll!RtlCreateHeap+0xa44e0
00000051`5e0fe760 00007ff9`c8ff4797 verifier!AVrfDebugPageHeapCreate+0x207
00000051`5e0fe800 00007ff9`a22d37a7 ntdll!RtlCreateHeap+0xa43b7
00000051`5e0fe9f0 00007ff9`c62a3677 verifier!AVrfpRtlCreateHeap+0x97
00000051`5e0fea40 00007ff9`c8eb9898 KERNELBASE!HeapCreate+0x47
00000051`5e0fea80 00007ff9`c8ea7c2c msvcrt!heap_init+0x18
00000051`5e0feab0 00007ff9`c8ea7907 msvcrt!core_crt_dll_init+0xcc
00000051`5e0fec20 00007ff9`a22c0f29 msvcrt!CRTDLL_INIT+0x57
00000051`5e0fec50 00007ff9`c8f6a37f verifier!AVrfpStandardDllEntryPointRoutine+0xc9
00000051`5e0fecd0 00007ff9`c8f4771a ntdll!LdrpCallInitRoutine+0x4b
00000051`5e0fed30 00007ff9`c8f47567 ntdll!LdrpInitializeNode+0x15a
00000051`5e0fee50 00007ff9`c8f47585 ntdll!LdrpInitializeGraphRecurse+0x73
00000051`5e0fee90 00007ff9`c8f47585 ntdll!LdrpInitializeGraphRecurse+0x91
00000051`5e0feed0 00007ff9`c8f47585 ntdll!LdrpInitializeGraphRecurse+0x91
00000051`5e0fef10 00007ff9`c8f47585 ntdll!LdrpInitializeGraphRecurse+0x91
00000051`5e0fef50 00007ff9`c8f47585 ntdll!LdrpInitializeGraphRecurse+0x91
00000051`5e0fef90 00007ff9`c8f47585 ntdll!LdrpInitializeGraphRecurse+0x91
00000051`5e0fefd0 00007ff9`c8fd1bfe ntdll!LdrpInitializeGraphRecurse+0x91
00000051`5e0ff010 00007ff9`c90088f8 ntdll!LdrpInitializeProcess+0x77e
00000051`5e0ff410 00007ff9`c8fb9f6e ntdll!_LdrpInitialize+0x4e934
00000051`5e0ff490 00000000`00000000 ntdll!LdrInitializeThunk+0xe

Как отладить эту проблему?

0 ответов

Другие вопросы по тегам