VS2003 在push edi 的时候AV

本文记录了一次使用VS2003进行调试时遇到的IDE崩溃问题及解决方案。问题表现为在激活unmanaged debugging后,使用F5调试时IDE即刻崩溃,并出现了访问冲突错误。通过Windbg排查发现,问题是由于Data Execution Prevention(DEP)保护导致的。最终通过关闭VS2003的DEP保护解决了该问题。

VS2003 在push edi 的时候AV

原贴地址:
http://eparg.spaces.msn.com/Blog/cns!1pnPgEC6RF6WtiSBWIHdc5qQ!379.entry
原贴时间:
2005-11-1
原贴作者:
eparg

个月做一个case的时候,需要激活vs2003的unmanaged debugging. 激活后用f5调试,程序还没有起来,vs2003 IDE就crash了 :(

当时比较忙,一直留到今天才来仔细观察这个问题. windbg上去后,看到crash的信息如下:
(9ec.dfc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
好,不就是熟悉的AV么,看看EIP:
0:018> u eip
AcSpecfc!NS_NatDbgDM::JumpBuffer:
7150b698 57 push edi
恩,push居然都会AV,没天理阿。仔细想想,有两种可能:
1) IP地址不可读写
2) ESP不可读写
可是:
0:018> !address eip
714d0000 : 7150b000 - 00005000
Type 01000000 MEM_IMAGE
Protect 00000004 PAGE_READWRITE
State 00001000 MEM_COMMIT
Usage RegionUsageImage
FullPath C:\WINDOWS\AppPatch\AcSpecfc.dll
0:018> !address esp
104d0000 : 105cb000 - 00005000
Type 00020000 MEM_PRIVATE
Protect 00000004 PAGE_READWRITE
State 00001000 MEM_COMMIT
Usage RegionUsageStack
Pid.Tid 9ec.dfc
傻了吧。有人知道怎么做么?(提示,该问题在打了win2k3 sp1前不会发生)
==================
解决方法,对vs2003 IDE进程取消"data execution prevention"保护。关于data execution prevention:
不过vs2003居然触发DEP,可以考虑file一个bug了
data execution prevention
.text:100F8C1E ?getFunctionIndirectType@UnDecorator@@CA?AVDName@@ABV2@@Z proc near .text:100F8C1E ; CODE XREF: UnDecorator::getPrimaryDataType(DName const &)+13C↓p .text:100F8C1E ; UnDecorator::getPtrRefType(DName const &,DName const &,char const *)+63↓p .text:100F8C1E .text:100F8C1E var_38 = DName ptr -38h .text:100F8C1E var_30 = DName ptr -30h .text:100F8C1E returnType = DName ptr -28h .text:100F8C1E var_20 = DName ptr -20h .text:100F8C1E rd = DName ptr -18h .text:100F8C1E thisType = DName ptr -10h .text:100F8C1E fitType = DName ptr -8 .text:100F8C1E result = dword ptr 8 .text:100F8C1E superType = dword ptr 0Ch .text:100F8C1E .text:100F8C1E push ebp .text:100F8C1F mov ebp, esp .text:100F8C21 mov ecx, ?gName@UnDecorator@@0PBDB ; char const * const UnDecorator::gName .text:100F8C27 sub esp, 38h .text:100F8C2A mov al, [ecx] .text:100F8C2C test al, al .text:100F8C2E jnz short loc_100F8C48 .text:100F8C30 push [ebp+superType] ; rd .text:100F8C33 push 1 ; st .text:100F8C35 push [ebp+result] ; result .text:100F8C38 call ??H@YA?AVDName@@W4DNameStatus@@ABV0@@Z ; operator+(DNameStatus,DName const &) .text:100F8C3D add esp, 0Ch .text:100F8C40 .text:100F8C40 loc_100F8C40: ; CODE XREF: UnDecorator::getFunctionIndirectType(DName const &)+40↓j .text:100F8C40 mov eax, [ebp+result] .text:100F8C43 jmp loc_100F9023 .text:100F8C48 ; --------------------------------------------------------------------------- .text:100F8C48 .text:100F8C48 loc_100F8C48: ; CODE XREF: UnDecorator::getFunctionIndirectType(DName const &)+10↑j .text:100F8C48 cmp al, 36h ; '6' .text:100F8C4A jl short loc_100F8C50 .text:100F8C4C cmp al, 39h ; '9' .text:100F8C4E jle short loc_100F8C60 .text:100F8C50 .text:100F8C50 loc_100F8C50: ; CODE XREF: UnDecorator::getFunctionIndirectType(DName const &)+2C↑j .text:100F8C50 cmp al, 5Fh ; '_' .text:100F8C52 jz short loc_100F8C60 .text:100F8C54 mov ecx, [ebp+result] ; this .text:100F8C57 push 2 ; st .text:100F8C59 call ??0DName@@QAE@W4DNameStatus@@@Z ; DName::DName(DNameStatus) .text:100F8C5E jmp short loc_100F8C40 .text:100F8C60 ; --------------------------------------------------------------------------- .text:100F8C60 .text:100F8C60 loc_100F8C60: ; CODE XREF: UnDecorator::getFunctionIndirectType(DName const &)+30↑j .text:100F8C60 ; UnDecorator::getFunctionIndirectType(DName const &)+34↑j .text:100F8C60 push ebx .text:100F8C61 movsx ebx, al .text:100F8C64 sub ebx, 36h ; '6' .text:100F8C67 inc ecx .text:100F8C68 mov ?gName@UnDecorator@@0PBDB, ecx ; char const * const UnDecorator::gName .text:100F8C6E cmp ebx, 29h ; ')' .text:100F8C71 jnz short loc_100F8CA2 .text:100F8C73 mov al, [ecx] .text:100F8C75 test al, al .text:100F8C77 jz short loc_100F8C90 .text:100F8C79 movsx ebx, al .text:100F8C7C sub ebx, 3Dh ; '=' .text:100F8C7F inc ecx .text:100F8C80 mov ?gName@UnDecorator@@0PBDB, ecx ; char const * const UnDecorator::gName .text:100F8C86 cmp ebx, 4 .text:100F8C89 jl short loc_100F8CAB .text:100F8C8B cmp ebx, 7 .text:100F8C8E jmp short loc_100F8CA9 .text:100F8C90 ; --------------------------------------------------------------------------- .text:100F8C90 .text:100F8C90 loc_100F8C90: ; CODE XREF: UnDecorator::getFunctionIndirectType(DName const &)+59↑j .text:100F8C90 push [ebp+superType] ; rd .text:100F8C93 push 1 ; st .text:100F8C95 push [ebp+result] ; result .text:100F8C98 call ??H@YA?AVDName@@W4DNameStatus@@ABV0@@Z ; operator+(DNameStatus,DName const &) .text:100F8C9D add esp, 0Ch .text:100F8CA0 jmp short loc_100F8CBD .text:100F8CA2 ; --------------------------------------------------------------------------- .text:100F8CA2 .text:100F8CA2 loc_100F8CA2: ; CODE XREF: UnDecorator::getFunctionIndirectType(DName const &)+53↑j .text:100F8CA2 test ebx, ebx .text:100F8CA4 js short loc_100F8CAB .text:100F8CA6 cmp ebx, 3 .text:100F8CA9 .text:100F8CA9 loc_100F8CA9: ; CODE XREF: UnDecorator::getFunctionIndirectType(DName const &)+70↑j .text:100F8CA9 jle short loc_100F8CAE .text:100F8CAB .text:100F8CAB loc_100F8CAB: ; CODE XREF: UnDecorator::getFunctionIndirectType(DName const &)+6B↑j .text:100F8CAB ; UnDecorator::getFunctionIndirectType(DName const &)+86↑j .text:100F8CAB or ebx, 0FFFFFFFFh .text:100F8CAE .text:100F8CAE loc_100F8CAE: ; CODE XREF: UnDecorator::getFunctionIndirectType(DName const &):loc_100F8CA9↑j .text:100F8CAE cmp ebx, 0FFFFFFFFh .text:100F8CB1 jnz short loc_100F8CC5 .text:100F8CB3 mov ecx, [ebp+result] ; this .text:100F8CB6 push 2 ; st .text:100F8CB8 call ??0DName@@QAE@W4DNameStatus@@@Z ; DName::DName(DNameStatus) .text:100F8CBD .text:100F8CBD loc_100F8CBD: ; CODE XREF: UnDecorator::getFunctionIndirectType(DName const &)+82↑j .text:100F8CBD mov eax, [ebp+result] .text:100F8CC0 jmp loc_100F9022 .text:100F8CC5 ; --------------------------------------------------------------------------- .text:100F8CC5 .text:100F8CC5 loc_100F8CC5: ; CODE XREF: UnDecorator::getFunctionIndirectType(DName const &)+93↑j .text:100F8CC5 and [ebp+thisType.node], 0 .text:100F8CC9 and dword ptr [ebp+thisType._bf_4], 0FFFF0000h .text:100F8CD0 push esi .text:100F8CD1 mov esi, [ebp+superType] .text:100F8CD4 push edi .text:100F8CD5 mov edi, ebx .text:100F8CD7 mov eax, [esi] .text:100F8CD9 mov [ebp+fitType.node], eax .text:100F8CDC mov eax, [esi+4] .text:100F8CDF mov dword ptr [ebp+fitType._bf_4], eax .text:100F8CE2 and edi, 2 .text:100F8CE5 jz loc_100F8DD7 .text:100F8CEB cmp byte ptr [ecx], 40h ; '@' .text:100F8CEE jz loc_100F8D96 .text:100F8CF4 lea eax, [ebp+fitType] .text:100F8CF7 push eax ; rd .text:100F8CF8 lea eax, [ebp+rd] .text:100F8CFB push eax ; result .text:100F8CFC push offset asc_10131938 ; "::" .text:100F8D01 lea ecx, [ebp+var_20] ; this .text:100F8D04 call ??0DName@@QAE@PBD@Z ; DName::DName(char const *) .text:100F8D09 mov ecx, eax ; this .text:100F8D0B call ??HDName@@QBE?AV0@ABV0@@Z ; DName::operator+(DName const &) .text:100F8D10 mov eax, [ebp+rd.node] .text:100F8D13 mov [ebp+fitType.node], eax .text:100F8D16 mov eax, dword ptr [ebp+rd._bf_4] .text:100F8D19 mov dword ptr [ebp+fitType._bf_4], eax .text:100F8D1C mov eax, ?gName@UnDecorator@@0PBDB ; char const * const UnDecorator::gName .text:100F8D21 cmp byte ptr [eax], 0 .text:100F8D24 jz short loc_100F8D69 .text:100F8D26 lea eax, [ebp+var_30] .text:100F8D29 push eax ; result .text:100F8D2A call ?getScope@UnDecorator@@CA?AVDName@@XZ ; UnDecorator::getScope(void) .text:100F8D2F pop ecx .text:100F8D30 push eax ; rd .text:100F8D31 lea eax, [ebp+var_20] .text:100F8D34 push eax ; result .text:100F8D35 push 20h ; ' ' ; ch .text:100F8D37 lea ecx, [ebp+var_38] ; this .text:100F8D3A call ??4DName@@QAEAAV0@D@Z ; DName::operator=(char) .text:100F8D3F mov ecx, eax ; this .text:100F8D41 call ??HDName@@QBE?AV0@ABV0@@Z ; DName::operator+(DName const &) .text:100F8D46 mov eax, [ebp+var_20.node] .text:100F8D49 lea ecx, [ebp+rd] ; this .text:100F8D4C mov [ebp+rd.node], eax .text:100F8D4F mov eax, dword ptr [ebp+var_20._bf_4] .text:100F8D52 mov dword ptr [ebp+rd._bf_4], eax .text:100F8D55 lea eax, [ebp+fitType] .text:100F8D58 push eax ; rd .text:100F8D59 call ??YDName@@QAEAAV0@ABV0@@Z ; DName::operator+=(DName const &) .text:100F8D5E mov eax, [ebp+rd.node] .text:100F8D61 mov [ebp+fitType.node], eax .text:100F8D64 mov eax, dword ptr [ebp+rd._bf_4] .text:100F8D67 jmp short loc_100F8D8B 崩溃点在.text:100F8D1C mov eax, ?gName@UnDecorator@@0PBDB ; char const * const UnDecorator::gName 怎么查找崩溃原因 这个跟栈溢出有关系嘛
最新发布
07-06
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值