Get stack limits on windows

Internet is full of all kinds of explanations on how you can get TIB via fs register, but it's over-complicated and obviously does not work for x64. Here is a much cleaner alternative, works for both x32 and x64.

#include "stdafx.h"
#include <stdio.h>
#include <windows.h>
#include <winnt.h>
#include <tchar.h>

#define INSTACKRANGE(x, pTib)  ( ((x) > (pTib->StackBase)) ? (0) : (((x) < (pTib->StackLimit)) ? (0) : (1)) )

int _tmain(int argc, _TCHAR* argv[])
{
    volatile int var1 = 123;
    static volatile int var2 = 456;
    NT_TIB * pTib = (NT_TIB *)NtCurrentTeb();
    printf("Base %p Limit %p var1 %p (%s) var2 %p (%s)\n",
        pTib->StackBase,pTib->StackLimit,
        &var1,INSTACKRANGE(&var1,pTib) ? "in":"out",
        &var2,INSTACKRANGE(&var2,pTib) ? "in":"out");

    return 0;
}

Java stack dump from service process

Java versions prior to 1.5 did not have anything similar to jstack, hence this workaround.

This method involves windbg and sdbgext plugin.
After attaching to the target, and verifying symbols:

.load sdbgext
bp kernel32!writefile "db poi(@esp+0x8) L? poi(@esp+0xc);g"
!remotecall kernel32!CtrlRoutine 0 1;g

windbg has a ".call" command, but it's unusable here, as it requires function with private symbols.

When debugger breaks back with something similar to:


Control-Break exception - code 40010008 (first chance)

continue unhandled (gn).

This method also works for javaw, which for some reason writes the dump output into handle 0xffffffff (-1)

If process standard output was not redirected to a file, you'll still get debugger output,

this is due the breakpoint on kernel32!WriteFile:

014cf268  46 75 6c 6c 20 74 68 72-65 61 64 20 64 75 6d 70  Full thread dump

014cf278  3a                                               :

014cf264  0d 0a                                            ..

014cfa48  0d 0a                                            ..

014cf260  22 54 68 72 65 61 64 2d-31 22 20                 "Thread-1" 

014cf254  70 72 69 6f 3d 35 20 74-69 64 3d 30 78 39 38 39  prio=5 tid=0x989

014cf264  33 38 30 20                                      380 

014cf258  6e 69 64 3d 30 78 64 37-34 20                    nid=0xd74 

014cf25c  77 61 69 74 69 6e 67 20-6f 6e 20 6d 6f 6e 69 74  waiting on monit

014cf26c  6f 72 20                                         or 

014cf258  5b 30 2e 2e 30 78 37 66-61 65 38 5d              [0..0x7fae8]

014cf254  0d 0a                                            ..

014cfa48  0d 0a                                            ..

Not too readable, but better than nothing...

Had a hard time finding this on the net:

new SDDL tokens introduced in XP/2003:

• AN - Anonymous Logon (SDDL_ANONYMOUS)
• LS - Local Service Account (SDDL_LOCAL_SERVICE)
• NS - Network Service Account (SDDL_NETWORK_SERVICE)
• RD - Remote Desktop Users (SDDL_REMOTE_DESKTOP)
• NO - Network Configuration Operators (SDDL_NETWORK_CONFIGURATION_OPS)
• MU - Performance Monitor Users (SDDL_PERFMON_USERS)
• LU - Performance Log Users (SDDL_PERFLOG_USERS)

ConvertStringSecurityDescriptorToSecurityDescriptor will fail with 0x00000539 - The security ID structure is invalid on win2k box with these...

IIS6 generated dump, with wrong/unrelated exception record:

.ecxr

eax=7ffdd000

...

ntdll!DbgBreakPoint:

7c81a3e1 cc int 3

!analzye -v found the correct exception, but took very long time to run,

here is some kind of shortcut:

By reviewing stacks I've found kernel32!UnhandledExceptionFilter+xxx

00a7d4f4 01001623 00a7d79c 00000000 77ecb7c0 kernel32!UnhandledExceptionFilter+0x7c0 (FPO: [SEH])

00a7d510 7a09c0ff 00a7d79c 00a7d774 77e761b7 w3wp!WpUnhandledExceptionFilter+0x3d (FPO: [1,1,4])

00a7d51c 77e761b7 00a7d79c 00000000 00000000 mscorwks!InternalUnhandledExceptionFilter+0x16 (FPO: [1,0,0])

00a7d774 77e792a3 00a7d79c 77e61ac1 00a7d7a4 kernel32!UnhandledExceptionFilter+0x12a (FPO: [SEH])

00a7d77c 77e61ac1 00a7d7a4 00000000 00a7d7a4 kernel32!BaseThreadStart+0x4a (FPO: [SEH])

00a7d7a4 7c828772 00a7d888 00a7ffdc 00a7d8a4 kernel32!_except_handler3+0x61 (FPO: [Uses EBP] [3,0,7])

00a7d7c8 7c828743 00a7d888 00a7ffdc 00a7d8a4 ntdll!ExecuteHandler2+0x26

00a7d870 7c82857e 00a78000 00a7d8a4 00a7d888 ntdll!ExecuteHandler+0x24

00a7d870 005e7617 00a78000 00a7d8a4 00a7d888 ntdll!KiUserExceptionDispatcher+0xe (FPO: [2,0,0]) (CONTEXT @ 00a7d8a4)

00a7dc64 005e7240 006da4c8 00a7dd48 00a7dd48 my!code+0x117

....

Get exception record:

>.exr poi(00a7d79c)

ExceptionAddress: 005e7617 (my!code+0x00000117)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000000

Parameter[1]: 00000000

Attempt to read from address 00000000

Get exception context:

>.cxr poi(00a7d79c+4)

eax=00000000 ebx=00a7fd60 ecx=99fab407 edx=9f7c000d esi=00a7fd6c edi=00a7dc64

eip=005e7617 esp=00a7db70 ebp=00a7dc64 iopl=0 nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246

my!code+0x117:

005e7617 0fbe08 movsx ecx,byte ptr [eax] ds:0023:00000000=??

If original stack did not show your frames:

>kv = 00a7dc64

ChildEBP RetAddr Args to Child

00a7dc64 005e7240 006da4c8 00a7dd48 00a7dd48 my!code+0x117

00a7fd60 005e7e4a 006da4c8 00a7ff70 00000000 my!code1+0x70

00a7fe90 005e7b3a 00000000 00000000 00746538 my!code2+0x10a

Profit!

Microsoft Platform SDK

It appears that PSDK (Windows Server 2003 R2) does not recognize Visual C Express installation, and therefore Build Envs are not functioning.
VCDetect.Exe invoked during PSDK installation, ad should find Visual studio, and create setenv.bat.
To make story short, here how it should look:

@ECHO OFF
CALL "C:\Program Files\Microsoft Visual Studio 8\Common7\Tools\VSVars32.bat"
SET MSVCVer=8.0

Long story:

VCDetect.Exe looks up in the registry keys:
SOFTWARE\Microsoft\VisualStudio\(7.0|7.1|8.0)\Setup\VS\ProductDir


Visual studio express also has this key, but in:
SOFTWARE\Microsoft\VCExpress\8.0\Setup\VC...