【方映app源码】【sunwell源码】【eduwind源码】Isbadcodeptr 源码-皮皮网

【方映app源码】【sunwell源码】【eduwind源码】Isbadcodeptr 源码

来源：彩虹授权网源码时间：2024-12-24 04:27:09

1.å¦ä½å®ä½å¯¼è´Crashçä»£ç ä½ç½®
2.å±å¹åè¯

Isbadcodeptr 源码

å¦ä½å®ä½å¯¼è´Crashçä»£ç ä½ç½®

1. å¨å¼åç¯å¢ä¸å®ä½Crashéè¯¯

ãã1.1 æ®éçcrash

ããããåæ¥ççææ®éçcrash

ããããåè§å¾1(c.png)

ãã1.2 è¾é¾å®ä½çcrash

ä»£ç

ããããchar *p = new char[];

ããããp[] = 0xfd;

ããããdelete[] p;

ããããprintf(p);

ããããæ£æµè¿ä¸ç±»é®é¢å¯ä»¥ä½¿ç¨BoundsCheckerå·¥å·çFinalCheckæ¨¡å¼ï¼BoundsCheckerï¼

ããããç¨BoundsCheckeræ£æµåå¯å¾å°ä¸¤ä¸ªéè¯¯ï¼Write overrun(åè¶ç) å Dangling pointer(ä½¿ç¨è¢«å é¤çæé)èä¸é½ç²¾ç¡®å®ä½å°äºåºéçä½ç½®ãæ¯ä¸ªä¸éçå·¥å·ã

ããããåè§å¾2(c.png)

ããããåè§å¾3(c.png)

ãã1.3 æ³¨ævcçè¾åºæ¥å¿

ããããè¿évcçè¾åºæ¥å¿ææ¶è½æä¾ä¸äºæç¨çä¿¡æ¯ã

ããããå¨é¾æ¾çcrashä¸ï¼æå¾å¤§ä¸é¨åæ¯å¼ç¨äºéæ³çæéã

ããããææ¶å¨vcçè¾åºæ¥å¿éå¯ä»¥çå°ç±»ä¼¼äºè¿æ ·çä¿¡æ¯

ããããâemule.exe ä¸ç 0xb7 å¤æå¯è½çå¼å¸¸: 0xC: è¯»åä½ç½® 0xfeeeff æ¶åçè®¿é®å²çª ãâ

2. å®ä½åå¸å¨å¤ççæ¬çCrashéè¯¯

ããå®ç°è¿ä¸åè½ä¸è¬åä»¥ä¸å æ¥ï¼

ããa. ä½¿ç¨SetUnhandledExceptionFilterå½æ°

ããb. ä½¿ç¨MiniDumpWriteDumpå½æ°

ããããå¨ä½ çå¼å¸¸å¤çå½æ°éï¼ä½¿ç¨MiniDumpWriteDumpæéè¯¯ä¿¡æ¯åæç¹å®æ ¼å¼çæä»¶ãå·ä½ä½¿ç¨å¯åç§msdnåemuleæºç ã

ããc. åééè¯¯æ¥å

ããd. æ¥çéè¯¯æ¥å

ããããè¿éä»ç»ç¨vcæ¥çéè¯¯æ¥åçæ¹æ³ï¼è¿å¯ä»¥ç¨windows debug toolsè¿ä¸ªå·¥å·çï¼æ¹æ³è§5.2 ä½¿ç¨windows debug toolsæ¥ç.dmpæä»¶(éè¯¯æ¥å)

ãããã

ããããæ.dmpï¼éè¯¯æ¥åæä»¶ï¼,源码方映app源码 .pdb, .exe. ä»£ç ï¼å¨åä¸ç®å½ä¸ï¼ç¨vcæå¼.dmp æä»¶ã

ãããã

ããä¸ç¹è¡¥åï¼å½æ²¡æâåééè¯¯æ¥åâçåè½ï¼ææ¯æ¤åè½å¤±æï¼ä»¥è´å¼¹åºäºwindowsçâåééè¯¯æ¥åâçå¯¹è¯æ¡ãè¿æ¶å¶å®ä¹æ¯æéè¯¯æ¥åçï¼ä¸è¬å¨C:Documents and Settingsç¨æ·åLocal SettingsTempéçä¸ä¸ª.dmpæä»¶(ä¸è¬åªæä¸ä¸ª.dmp)

3. å°æå·§

ãã3.1 æ ¹æ®ç¨åºå°åæ¾å°ä»£ç ä½ç½®

ããããå¯æå¦ä¸æ¥éª¤ï¼

ããããb. åæ¢å°æ±ç¼ç¶æãï¼Ctrl+Fï¼

ããããc. å¨å°åæ è¾å¥ç¨åºå°åï¼åè½¦ã

ããããd. å¯æCtrl+Fååä»£ç æ¨¡å¼ã

ãã3.2 æ ¹æ®æ¶æ¯å¼æ¥çå¯¹åºçwindowsæ¶æ¯

ãã3.3 æ¥çGetLastErrorè¿åå¼

ããããå¨vcççè§çªå£éè¾å¥â@err,hrâï¼å³å¯çå°LastErroråå¶è§£éã

ãã3.4 å¨ä»£ç ä¸æåç¨åº

ããããå¨debugçä¸å¯ä»¥å¨ä»£ç ä¸å ä¸âAfxDebugBreak()ï¼âä»¥æåç¨åºãreleaseçå¯ä½¿ç¨ â_asm int 3;â

4. ç¼ç¨å°è¦ç¤º

ãã4.1 æç¨IsBadPtrç³»åå½æ°

ããããå½ä½¿ç¨IsBadReadPtr, IsBadWritePtr, IsBadCodePträ¸ç³»åå½æ°æ¶è¦æ³¨æï¼è¿ä¸ç±»å½æ°å¯è½å¹¶ä¸è½è¾¾å°ä½ ææ³è¦çæå¾ã

ããããæ¯å¦ä¸é¢çä»£ç ï¼ä¸¤ä¸ªè¿åé½æ¯falseã

ä»£ç

char *p = new char[];

bool b;

b = IsBadReadPtr(p+, 1);

delete[] p;

char *q = new char[];

b = IsBadReadPtr(p, 1);

ãã4.2 æç¨catch(...)

ããããæä»¥å»ºè®®å°½éå°ç¨catch(...)ï¼å¦æç¥éæä¸åä»£ç ä¼æåºå¼å¸¸ï¼åºè¯¥ç¨ç¡®åçåæ³ãæ¯å¦catch(CFileException *e), catch(int e)ççã

5. éå½

ãã5.1 ä¸ºä»ä¹ç¨åºcrashæ¶è°ç¨å æ æ¯ä¹±ç

ä»£ç

class CA

{

public:

CA(){ }

~CA(){ }

virtual f(){ }

};

void show()

{

printf("shown");

}

int main()

{

// å¯¹åè¢«åå»ºå é¤

CA *p = new CA;

delete p;

// ä¸äºæ£å¸¸çæä½

int *q = new int;

int codeAddress = (int)show;

*q = (int)&codeAddress;

// è°ç¨è¢«å é¤çå¯¹åï¼ç¨åºæå¯è½æ§è¡å°ä»»ä½å°æ¹ã

p->f();

}

ããããå¦æä¸æç½ä¹æ²¡å³ç³»ï¼æä¸é¢è¯´ä¸ªå¤§æ¦ã

ããããé¦åCAå¯¹è±¡è¢«åå»ºåè¢«å é¤ãå¦ææ¤æ¶è°ç¨p->f()å¤åä¼crashã

ããããå¦æä½ ä¸æç½vtableæºå¶ï¼é£ä½ åªè¦ç¥éï¼æåä¸è¡ç âp->f();âä¼æ§è¡åéqææåçåéææåçåéææ ç¤ºçå°åãï¼è¿éæ²¡æéåï¼æ¯ä¸¤ä¸ªâææåçåéâï¼

ãã5.2 ä½¿ç¨Debugging tools for windowsæ¥ç.dmpæä»¶(éè¯¯æ¥å)

ããããb. å®è£WinDbg

ããããd. æå¼.dmpæä»¶

ããããf. æå¼è°ç¨å æ (ALT + F6)æ¥çCrashçä½ç½®

ããããg. è¿è¡åæ

ç®ä»

ããï¼FinalCheckè½æ£æµåºçéè¯¯åè¡¨è§éå½1ï¼

å±å¹åè¯

HMODULE hmodule=GetModuleHandle(âMypro.exeâ);

1ï¼ å®è£é¼ æ é©åï¼éè¿é©åå½æ°è·å¾é¼ æ æ¶æ¯ã

ä½¿ç¨å°çAPIå½æ°ï¼SetWindowsHookEx

ä½¿ç¨å°çAPIå½æ°ï¼WindowFromPointï¼ScreenToClientï¼InvalidateRect

BOOL WINAPI MyTextOutA(HDC hdc, int nXStart, int nYStart, LPCSTR lpszString,int cbString)

{

// è¿éè¿è¡è¾åºlpszStringçå¤ç

// ç¶åè°ç¨æ£ççTextOutAå½æ°

}

HookImportFunctionçç¨æ³ï¼

HOOKFUNCDESC hd;

PROC pOrigFuns;

hd.szFunc="TextOutA";

hd.pProc=(PROC)MyTextOutA;

HookImportFunction (AfxGetInstanceHandle(),"gdi.dll",&hd,pOrigFuns);

///////////////////////////////////////////// Begin ///////////////////////////////////////////////////////////////

#include <crtdbg.h>

// è¿éå®ä¹äºä¸ä¸ªäº§çæéçå®

#define MakePtr(cast, ptr, AddValue) (cast)((DWORD)(ptr)+(DWORD)(AddValue))

// å®ä¹äºHOOKFUNCDESCç»æ,æä»¬ç¨è¿ä¸ªç»æä½ä¸ºåæ°ä¼ ç»HookImportFunctionå½æ°

typedef struct tag_HOOKFUNCDESC

{

LPCSTR szFunc; // The name of the function to hook.

PROC pProc; // The procedure to blast in.

} HOOKFUNCDESC , * LPHOOKFUNCDESC;

// è¿ä¸ªå½æ°çæµå½åç³»ç»æ¯å¦æ¯WindowNT

BOOL IsNT();

// è¿ä¸ªå½æ°å¾å°hModule -- å³æä»¬éè¦æªè·çå½æ°æå¨çDLLæ¨¡åçå¼å¥æè¿°ç¬¦(import descriptor)

PIMAGE_IMPORT_DESCRIPTOR GetNamedImportDescriptor(HMODULE hModule, LPCSTR szImportModule);

// æä»¬çä¸»å½æ°

BOOL HookImportFunction(HMODULE hModule, LPCSTR szImportModule,

LPHOOKFUNCDESC paHookFunc, PROC* paOrigFuncs)

{

/////////////////////// ä¸é¢çä»£ç æ£æµåæ°çæææ§ ////////////////////////////

_ASSERT(szImportModule);

_ASSERT(!IsBadReadPtr(paHookFunc, sizeof(HOOKFUNCDESC)));

#ifdef _DEBUG

if (paOrigFuncs) _ASSERT(!IsBadWritePtr(paOrigFuncs, sizeof(PROC)));

_ASSERT(paHookFunc.szFunc);

_ASSERT(*paHookFunc.szFunc != '\0');

_ASSERT(!IsBadCodePtr(paHookFunc.pProc));

#endif

if ((szImportModule == NULL) || (IsBadReadPtr(paHookFunc, sizeof(HOOKFUNCDESC))))

{

_ASSERT(FALSE);

SetLastErrorEx(ERROR_INVALID_PARAMETER, SLE_ERROR);

return FALSE;

}

//////////////////////////////////////////////////////////////////////////////

// çæµå½åæ¨¡åæ¯å¦æ¯å¨2GBèæååç©ºé´ä¹ä¸

// è¿é¨åçå°åååæ¯å±äºWinè¿ç¨å±äº«ç

if (!IsNT() && ((DWORD)hModule >= 0x))

{

_ASSERT(FALSE);

SetLastErrorEx(ERROR_INVALID_HANDLE, SLE_ERROR);

return FALSE;

}

// æ¸é¶

if (paOrigFuncs) memset(paOrigFuncs, NULL, sizeof(PROC));

// è°ç¨GetNamedImportDescriptor()å½æ°,æ¥å¾å°hModule -- å³æä»¬éè¦

// æªè·çå½æ°æå¨çDLLæ¨¡åçå¼å¥æè¿°ç¬¦(import descriptor)

PIMAGE_IMPORT_DESCRIPTOR pImportDesc = GetNamedImportDescriptor(hModule, szImportModule);

if (pImportDesc == NULL)

return FALSE; // è¥ä¸ºç©º,åæ¨¡åæªè¢«å½åè¿ç¨æå¼å¥

// ä»DLLæ¨¡åä¸å¾å°åå§çTHUNKä¿¡æ¯,å ä¸ºpImportDesc->FirstThunkæ°ç»ä¸çåå§ä¿¡æ¯å·²ç»

// å¨åºç¨ç¨åºå¼å¥è¯¥DLLæ¶è¦çä¸äºææçå¼å¥ä¿¡æ¯,æä»¥æä»¬éè¦éè¿åå¾pImportDesc->OriginalFirstThunk

// æéæ¥è®¿é®å¼å¥å½æ°åçä¿¡æ¯

PIMAGE_THUNK_DATA pOrigThunk = MakePtr(PIMAGE_THUNK_DATA, hModule,

pImportDesc->OriginalFirstThunk);

// ä»pImportDesc->FirstThunkå¾å°IMAGE_THUNK_DATAæ°ç»çæé,ç±äºè¿éå¨DLLè¢«å¼å¥æ¶å·²ç»å¡«åäº

// ææçå¼å¥ä¿¡æ¯,æä»¥çæ£çæªè·å®éä¸æ£æ¯å¨è¿éè¿è¡ç

PIMAGE_THUNK_DATA pRealThunk = MakePtr(PIMAGE_THUNK_DATA, hModule, pImportDesc->FirstThunk);

while (pOrigThunk->u1.Function)

{

// åªå¯»æ¾é£äºæå½æ°åèä¸æ¯åºå·å¼å¥çå½æ°

if (IMAGE_ORDINAL_FLAG != (pOrigThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG))

{

// å¾å°å¼å¥å½æ°çå½æ°å

PIMAGE_IMPORT_BY_NAME pByName = MakePtr(PIMAGE_IMPORT_BY_NAME, hModule,

pOrigThunk->u1.AddressOfData);

// å¦æå½æ°åä»¥NULLå¼å§,è·³è¿,ç»§ç»ä¸ä¸ä¸ªå½æ°

if ('\0' == pByName->Name[0])

continue;

// bDoHookç¨æ¥æ£æ¥æ¯å¦æªè·æå

BOOL bDoHook = FALSE;

// æ£æ¥æ¯å¦å½åå½æ°æ¯æä»¬éè¦æªè·çå½æ°

if ((paHookFunc.szFunc[0] == pByName->Name[0]) &&

(strcmpi(paHookFunc.szFunc, (char*)pByName->Name) == 0))

{

// æ¾å°äº!

if (paHookFunc.pProc)

bDoHook = TRUE;

}

if (bDoHook)

{

// æä»¬å·²ç»æ¾å°äºæè¦æªè·çå½æ°,é£ä¹å°±å¼å§å¨æå§

MEMORY_BASIC_INFORMATION mbi_thunk;

VirtualQuery(pRealThunk, &mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));

_ASSERT(VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,

PAGE_READWRITE, &mbi_thunk.Protect));

// ä¿åæä»¬æè¦æªè·çå½æ°çæ£ç¡®è·³è½¬å°å

if (paOrigFuncs)

paOrigFuncs = (PROC)pRealThunk->u1.Function;

pRealThunk->u1.Function = (PDWORD)paHookFunc.pProc;

// æä½å®æ¯!å°è¿ä¸åèæååæ¹ååæ¥çä¿æ¤ç¶æ

DWORD dwOldProtect;

_ASSERT(VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,

mbi_thunk.Protect, &dwOldProtect));

SetLastError(ERROR_SUCCESS);

return TRUE;

}

// è®¿é®IMAGE_THUNK_DATAæ°ç»ä¸çä¸ä¸ä¸ªåç´

pOrigThunk++;

pRealThunk++;

}

return TRUE;

}

// GetNamedImportDescriptorå½æ°çå®ç°

PIMAGE_IMPORT_DESCRIPTOR GetNamedImportDescriptor(HMODULE hModule, LPCSTR szImportModule)

{

// æ£æµåæ°

_ASSERT(szImportModule);

_ASSERT(hModule);

if ((szImportModule == NULL) || (hModule == NULL))

{

_ASSERT(FALSE);

SetLastErrorEx(ERROR_INVALID_PARAMETER, SLE_ERROR);

return NULL;

}

// å¾å°Dosæä»¶å¤´

PIMAGE_DOS_HEADER pDOSHeader = (PIMAGE_DOS_HEADER) hModule;

// æ£æµæ¯å¦MZæä»¶å¤´

if (IsBadReadPtr(pDOSHeader, sizeof(IMAGE_DOS_HEADER)) ||

(pDOSHeader->e_magic != IMAGE_DOS_SIGNATURE))

{

_ASSERT(FALSE);

SetLastErrorEx(ERROR_INVALID_PARAMETER, SLE_ERROR);

return NULL;

}

// åå¾PEæä»¶å¤´

PIMAGE_NT_HEADERS pNTHeader = MakePtr(PIMAGE_NT_HEADERS, pDOSHeader, pDOSHeader->e_lfanew);

// æ£æµæ¯å¦PEæ åæä»¶

if (IsBadReadPtr(pNTHeader, sizeof(IMAGE_NT_HEADERS)) ||

(pNTHeader->Signature != IMAGE_NT_SIGNATURE))

{

_ASSERT(FALSE);

SetLastErrorEx(ERROR_INVALID_PARAMETER, SLE_ERROR);

return NULL;

}

// æ£æ¥PEæä»¶çå¼å¥æ®µ(å³ .idata section)

if (pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress == 0)

return NULL;

// å¾å°å¼å¥æ®µ(å³ .idata section)çæé

PIMAGE_IMPORT_DESCRIPTOR pImportDesc = MakePtr(PIMAGE_IMPORT_DESCRIPTOR, pDOSHeader,

pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);

while (pImportDesc->Name)

{

PSTR szCurrMod = MakePtr(PSTR, pDOSHeader, pImportDesc->Name);

if (stricmp(szCurrMod, szImportModule) == 0)

break; // æ¾å°!ä¸æå¾ªç¯

// ä¸ä¸ä¸ªåç´

pImportDesc++;

}

if (pImportDesc->Name == NULL)

return NULL;

// è¿åå½æ°ææ¾å°çæ¨¡åæè¿°ç¬¦(import descriptor)

return pImportDesc;

}

// IsNT()å½æ°çå®ç°

BOOL IsNT()

{

OSVERSIONINFO stOSVI;

memset(&stOSVI, NULL, sizeof(OSVERSIONINFO));

stOSVI.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);

BOOL bRet = GetVersionEx(&stOSVI);

_ASSERT(TRUE == bRet);

if (FALSE == bRet) return FALSE;

return (VER_PLATFORM_WIN_NT == stOSVI.dwPlatformId);

}

/////////////////////////////////////////////// End //////////////////////////////////////////////////////////////////////

【方映app源码】【sunwell源码】【eduwind源码】Isbadcodeptr 源码

热点文章

精彩图文