Question

有没有办法从Windows内核崩溃转储中检索流程描述和发布者？

我尝试了!process和!dml_proc。它没有显示该信息。

Answer 1

描述可以从exe模块获取。例如：

0: kd> !PROCESS fffffa800482f940 2
GetPointerFromAddress: unable to read from fffff80397f65000
PROCESS fffffa800482f940
    SessionId: 1  Cid: 0e3c    Peb: 7f7cfefa000  ParentCid: 04bc
    DirBase: 26bcc000  ObjectTable: fffff8a0028f4e80  HandleCount: <Data Not Accessible>
    Image: Taskmgr.exe


0: kd> .process /p  fffffa800482f940
Implicit process is now fffffa80`0482f940
0: kd> .reload /user
Loading User Symbols
..........................................................
0: kd> lmvm Taskmgr
Browse full module list
start             end                 module name
000007f7`d08c0000 000007f7`d09da000   taskmgr    (deferred)             
   Image path: C:\Windows\system32\taskmgr.exe
   Image name: taskmgr.exe
   Browse all global symbols  functions  data
   Timestamp:        Thu Jul 26 02:07:18 2012 (50107C26)
   CheckSum:         00119B41
   ImageSize:        0011A000
   File version:     6.2.9200.16384
   Product version:  6.2.9200.16384
   File flags:       0 (Mask 3F)
   File OS:          40004 NT Win32
   File type:        1.0 App
   File date:        00000000.00000000
   Translations:     0409.04b0
   CompanyName:      Microsoft Corporation
   ProductName:      Microsoft® Windows® Operating System
   InternalName:     Taskmgr.exe
   OriginalFilename: Taskmgr.exe
   ProductVersion:   6.2.9200.16384
   FileVersion:      6.2.9200.16384 (win8_rtm.120725-1247)
   FileDescription:  Task Manager
   LegalCopyright:   © Microsoft Corporation. All rights reserved.

Answer 2

我正在尝试编辑并向pykd-teams回复发布澄清，但编辑结果不大，所以将此作为答案发布

lmvm输出中的FileDescription引用“任务管理器详细信息”选项卡中的描述列

公司名称引用是指启动选项卡中的发布商列

class XX {
   /* ... */
   function limitExcerptToWords($numWords) {
       add_filter( 'excerpt_length', function () use($numWords) {
            return $numwords;
        });
   }
   /* ... */
}

您可以通过修改启动时执行的任何文件的rsrc部分中的FILE_VERSION_INFO进行检查，请参阅下面与上面发布的相同exe的windbg中的已编辑发布者

如何检查上述断言的有效性

C:\Windows\system32>wmic Startup where Caption="vmware user process" get /format:list    
Caption=VMware User Process
Command="C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr
Description=VMware User Process
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name=VMware User Process
SettingID=
User=Public
UserSID= 

C:\Windows\system32>reg query hklm\software\microsoft\windows\currentversion\run    
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
    VMware User Process REG_SZ "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr

open a live kd session    
run task manager in target and select a startup     
look at details and locate the process name   say vmtoolsd.exe    
break into kd using ctrl+break     
!process 0 0 vmtoolsd.exe    
.process /p /r EPROCESS ADDRESS OF vmtoolsd.exe    
!dh vmtoolsd find the Data directory SECURITY DIRECTORY and start searching for FILE_VERSION_INFO   
loacte the string value of Company Name    
use eb Address to edit the Company Name to some random string    
execute using g    
now execute task manager and you will see the publisher column in startup tab reflecting the random string as publisher

这里是检索每个正在运行的进程的用户名的示例脚本

username is not tied to file but to process grab the token     
from !process <Eproc> 1  and pass the TOKEN value to !token -n

应该得到你的结果

!for_each_process "r $t0=(@@c++(((_EPROCESS*) @#Process )->Token.Object)&0xfffffff8);r? $t1=@@c++(((_TOKEN*)@@(@$t0))->LogonSession->AccountName);r? $t2=@@c++(((_EPROCESS *) @#Process )->ImageFileName);.printf \"%mu\t\t\t%ma\\n\",@@c++((wchar_t *)@$t1.Buffer),@@c++((char*)@$t2)"

Answer 3

您可以使用DbgKit中的!ps命令获取此信息以及更多信息。

注意： 从内核内存转储中，您只能获取用户名。要获取用户名，文件描述和公司名称，您需要完整的内存转储。

将dbgkit.dll复制到winext文件夹（例如：C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext）
在WinDbg中打开转储文件
运行.load dbgkit命令
运行!ps命令（查看运行的其他命令！dbgkit.help）

转储中的流程描述，用户和发布者信息

3 个答案: