a buffer overrun has occurred in...

本文记录了一次使用VS2010进行软件开发时遇到的问题:Release版本下程序出现缓冲区溢出错误,导致程序状态被破坏。通过将strcpy替换为strncpy成功解决了该问题。

今天在写个小的XX工具时,VS2010DEBUG版能正常编译,运行正常,但是转到release版虽能正常编译,但是运行是错误,纠结半天 ,提示信息就是:

A buffer overrun has occurred in XXX.exe which has corrupted the program's internal state. Press Break to debug the program or Continue to terminate the program.纠结半天,看这里,看那里,哎,最后想到有个strcpy,将其换做strncpy,一切风波化解了,罪恶啊罪恶,以此警戒自己。

nt!DbgBreakPointWithStatus: fffff805`7affd0b0 cc int 3 kd> ed nt!Kd_DEFAULT_Mask 0xFFFFFFFF kd> ed nt!Kd_IHVDRIVER_Mask 0xFFFFFFFF kd> g [+] [DriverEntry] 驱动加载开始 [+] [DriverEntry] 驱动加载成功 [+] [ProcessNotifyCallback] 目标进程 oxygen.exe 创建 (PID: 7948) [+] [ProcessNotifyCallback] 工作线程已创建 [+] Worker thread started for hook installation [+] [InstallHook] 找到目标函数地址: FFFFF8057B2EFB60 [PTE_HOOK] 跳板池分配成功: 地址=0xFFFFCF812F9C8000, 大小=32768字节 [PTE_HOOK] 构造跳转指令: 目标地址: 0xFFFFF805802B14E0 跳板位置: 0xFFFFCF812F9C8000 指令大小: 18字节 写入跳板结构到 0xFFFFCF812F9C8000: FF 25 00 00 00 00 00 00 00 00 E0 14 2B 80 05 F8 FF FF 反汇编跳板指令: Break instruction exception - code 80000003 (first chance) nt!KeCheckStackAndTargetAddress+0x53: fffff805`7ae8da03 cc int 3 kd> g KDTARGET: Refreshing KD connection *** Fatal System Error: 0x00000139 (0x0000000000000000,0x0000000000000000,0x0000000000000000,0x0000000000000000) Break instruction exception - code 80000003 (first chance) A fatal system error has occurred. Debugger entered on first try; Bugcheck callbacks have not been invoked. A fatal system error has occurred. For analysis of this file, run !analyze -v nt!DbgBreakPointWithStatus: fffff805`7affd0b0 cc int 3 kd> !analyze -v Connected to Windows 10 19041 x64 target at (Tue Jun 24 23:20:51.742 2025 (UTC + 8:00)), ptr64 TRUE Loading Kernel Symbols .................................... Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long. Run !sym noisy before .reload to track down problems loading symbols. ........................... ................................................................ ..................................................... Loading User Symbols Loading unloaded module list ...... ERROR: FindPlugIns 8007007b ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_SECURITY_CHECK_FAILURE (139) A kernel component has corrupted a critical data structure. The corruption could potentially allow a malicious user to gain control of this machine. Arguments: Arg1: 0000000000000000, A stack-based buffer has been overrun. Arg2: 0000000000000000, Address of the trap frame for the exception that caused the BugCheck Arg3: 0000000000000000, Address of the exception record for the exception that caused the BugCheck Arg4: 0000000000000000, Reserved Debugging Details: ------------------ Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long. Run !sym noisy before .reload to track down problems loading symbols. KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 3750 Key : Analysis.Elapsed.mSec Value: 44828 Key : Analysis.IO.Other.Mb Value: 0 Key : Analysis.IO.Read.Mb Value: 2 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 3625 Key : Analysis.Init.Elapsed.mSec Value: 71532 Key : Analysis.Memory.CommitPeak.Mb Value: 62 Key : Analysis.Version.DbgEng Value: 10.0.27829.1001 Key : Analysis.Version.Description Value: 10.2503.24.01 amd64fre Key : Analysis.Version.Ext Value: 1.2503.24.1 Key : Bugcheck.Code.KiBugCheckData Value: 0x139 Key : Bugcheck.Code.LegacyAPI Value: 0x139 Key : Bugcheck.Code.TargetModel Value: 0x139 Key : Failure.Bucket Value: 0x139_0_LEGACY_GS_VIOLATION_nt!guard_icall_bugcheck Key : Failure.Hash Value: {9bee41a7-2ef9-07ca-7e59-7d5a0c6e2d05} Key : Hypervisor.Enlightenments.Value Value: 12576 Key : Hypervisor.Enlightenments.ValueHex Value: 0x3120 Key : Hypervisor.Flags.AnyHypervisorPresent Value: 1 Key : Hypervisor.Flags.ApicEnlightened Value: 0 Key : Hypervisor.Flags.ApicVirtualizationAvailable Value: 0 Key : Hypervisor.Flags.AsyncMemoryHint Value: 0 Key : Hypervisor.Flags.CoreSchedulerRequested Value: 0 Key : Hypervisor.Flags.CpuManager Value: 0 Key : Hypervisor.Flags.DeprecateAutoEoi Value: 1 Key : Hypervisor.Flags.DynamicCpuDisabled Value: 0 Key : Hypervisor.Flags.Epf Value: 0 Key : Hypervisor.Flags.ExtendedProcessorMasks Value: 0 Key : Hypervisor.Flags.HardwareMbecAvailable Value: 0 Key : Hypervisor.Flags.MaxBankNumber Value: 0 Key : Hypervisor.Flags.MemoryZeroingControl Value: 0 Key : Hypervisor.Flags.NoExtendedRangeFlush Value: 1 Key : Hypervisor.Flags.NoNonArchCoreSharing Value: 0 Key : Hypervisor.Flags.Phase0InitDone Value: 1 Key : Hypervisor.Flags.PowerSchedulerQos Value: 0 Key : Hypervisor.Flags.RootScheduler Value: 0 Key : Hypervisor.Flags.SynicAvailable Value: 1 Key : Hypervisor.Flags.UseQpcBias Value: 0 Key : Hypervisor.Flags.Value Value: 536632 Key : Hypervisor.Flags.ValueHex Value: 0x83038 Key : Hypervisor.Flags.VpAssistPage Value: 1 Key : Hypervisor.Flags.VsmAvailable Value: 0 Key : Hypervisor.RootFlags.AccessStats Value: 0 Key : Hypervisor.RootFlags.CrashdumpEnlightened Value: 0 Key : Hypervisor.RootFlags.CreateVirtualProcessor Value: 0 Key : Hypervisor.RootFlags.DisableHyperthreading Value: 0 Key : Hypervisor.RootFlags.HostTimelineSync Value: 0 Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled Value: 0 Key : Hypervisor.RootFlags.IsHyperV Value: 0 Key : Hypervisor.RootFlags.LivedumpEnlightened Value: 0 Key : Hypervisor.RootFlags.MapDeviceInterrupt Value: 0 Key : Hypervisor.RootFlags.MceEnlightened Value: 0 Key : Hypervisor.RootFlags.Nested Value: 0 Key : Hypervisor.RootFlags.StartLogicalProcessor Value: 0 Key : Hypervisor.RootFlags.Value Value: 0 Key : Hypervisor.RootFlags.ValueHex Value: 0x0 Key : SecureKernel.HalpHvciEnabled Value: 0 Key : WER.OS.Branch Value: vb_release Key : WER.OS.Version Value: 10.0.19041.1 BUGCHECK_CODE: 139 BUGCHECK_P1: 0 BUGCHECK_P2: 0 BUGCHECK_P3: 0 BUGCHECK_P4: 0 FAULTING_THREAD: ffffbd046bee5080 TRAP_FRAME: ffff800000000000 -- (.trap 0xffff800000000000) Unable to read trap frame at ffff8000`00000000 Resetting default scope EXCEPTION_RECORD: 0000000000000000 -- (.exr 0x0) Cannot read Exception record @ 0000000000000000 PROCESS_NAME: System STACK_TEXT: fffffc89`cb028028 fffff805`7b111882 : fffffc89`cb028190 fffff805`7af7c940 00000000`00000100 00000000`00000000 : nt!DbgBreakPointWithStatus fffffc89`cb028030 fffff805`7b110e66 : 00000000`00000003 fffffc89`cb028190 fffff805`7b00a0c0 00000000`00000139 : nt!KiBugCheckDebugBreak+0x12 fffffc89`cb028090 fffff805`7aff5317 : fffff805`7ac00000 00000000`00000001 fffffc89`cb029a38 fffff805`7aea29a5 : nt!KeBugCheck2+0x946 fffffc89`cb0287a0 fffff805`7affdd1b : 00000000`00000139 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx+0x107 fffffc89`cb0287e0 fffff805`7ae8da0c : fffffc89`cb028878 fffffc89`cb0288b8 00000000`00000000 fffffc89`cb028920 : nt!guard_icall_bugcheck+0x1b fffffc89`cb028810 fffff805`7afcbe6b : fffff805`7aea29a5 fffff805`7acd158c 00000000`00000000 00000000`00000000 : nt!KeCheckStackAndTargetAddress+0x5c fffffc89`cb028840 fffff805`7affe0d2 : fffff805`7acd158c fffffc89`cb028e20 fffff805`7afcbe30 00000000`00000000 : nt!_C_specific_handler+0x3b fffffc89`cb0288b0 fffff805`7ae52db7 : fffffc89`cb028e20 00000000`00000000 fffffc89`cb029c10 fffff805`7aea29a5 : nt!RtlpExecuteHandlerForException+0x12 fffffc89`cb0288e0 fffff805`7ae519a6 : fffffc89`cb0297f8 fffffc89`cb029530 fffffc89`cb0297f8 fffffc89`cb029a9a : nt!RtlDispatchException+0x297 fffffc89`cb029000 fffff805`7b0072ac : 00000000`00001000 fffffc89`cb0298a0 ffff8000`00000000 00000000`00000000 : nt!KiDispatchException+0x186 fffffc89`cb0296c0 fffff805`7b003443 : fffffc89`cb029a48 fffffc89`cb029990 fffffc89`cb0299a0 fffff805`7affd0d5 : nt!KiExceptionDispatch+0x12c fffffc89`cb0298a0 00000000`00000000 : fffff805`802b19e9 fffff805`802b2ce0 00000000`000000b8 00000000`00000000 : nt!KiPageFault+0x443 SYMBOL_NAME: nt!guard_icall_bugcheck+1b MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe STACK_COMMAND: .process /r /p 0xffffbd046545f1c0; .thread 0xffffbd046bee5080 ; kb BUCKET_ID_FUNC_OFFSET: 1b FAILURE_BUCKET_ID: 0x139_0_LEGACY_GS_VIOLATION_nt!guard_icall_bugcheck OS_VERSION: 10.0.19041.1 BUILDLAB_STR: vb_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {9bee41a7-2ef9-07ca-7e59-7d5a0c6e2d05} Followup: MachineOwner --------- kd> u FFFFCF812F9C8000 ffffcf81`2f9c8000 ff2500000000 jmp qword ptr [ffffcf81`2f9c8006] ffffcf81`2f9c8006 0000 add byte ptr [rax],al ffffcf81`2f9c8008 0000 add byte ptr [rax],al ffffcf81`2f9c800a e014 loopne ffffcf81`2f9c8020 ffffcf81`2f9c800c 2b8005f8ffff sub eax,dword ptr [rax-7FBh] ffffcf81`2f9c8012 dd75f5 fnsave [rbp-0Bh] ffffcf81`2f9c8015 5d pop rbp ffffcf81`2f9c8016 7df7 jge ffffcf81`2f9c800f这是什么错误?写入时候的错误还是执行hook内容的错误?
06-25
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值