bug引入

我们在驱动中引入一个错误，在0x0地址位置写入数据
在用户态这样做，进程会崩溃，但是在驱动里这样写，系统会挂掉
先把符号文件加载到windebug，用分号隔开，勾选reload

#include <ntddk.h>
VOID Unload(IN PDRIVER_OBJECT DriverObject) {
    DbgPrint("driver unload\r\n");
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegisteryPath) {
    PCHAR string;
    DriverObject->DriverUnload = Unload;
    //在 0x0的位置写入 'a'
    string = 0;
    *string = 'a';
    DbgPrint("hello driver\r\n");
    return STATUS_SUCCESS;
}

加载驱动运行调试

加载运行驱动后，执行代码，调试器捕捉到，并中断

分析调试信息

使用 !analyze -v 命令自动分析，需要等一小会

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 94407018, The address that the exception occurred at
Arg3: 807ed8fc, Exception Record Address
Arg4: 807ed360, Context Record Address
Debugging Details:
------------------
DBGHELP: Timeout to store: e:\symbol*http://msdl.microsoft.com/download/symbols
KEY_VALUES_STRING: 1
    Key  : AV.Dereference
    Value: NullPtr
    Key  : AV.Fault
    Value: Write
    Key  : Analysis.CPU.mSec
    Value: 14609
    Key  : Analysis.DebugAnalysisManager
    Value: Create
    Key  : Analysis.Elapsed.mSec
    Value: 181920
    Key  : Analysis.Init.CPU.mSec
    Value: 8046
    Key  : Analysis.Init.Elapsed.mSec
    Value: 840119
    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 68
    Key  : WER.OS.Branch
    Value: win7sp1_ldr_escrow
    Key  : WER.OS.Timestamp
    Value: 2019-02-20T18:00:00Z
    Key  : WER.OS.Version
    Value: 7.1.7601.24384
BUGCHECK_CODE:  7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: ffffffff94407018
BUGCHECK_P3: ffffffff807ed8fc
BUGCHECK_P4: ffffffff807ed360
EXCEPTION_RECORD:  807ed8fc -- (.exr 0xffffffff807ed8fc)
ExceptionAddress: 94407018 (helloDriver!DriverEntry+0x00000018)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 00000000
Attempt to write to address 00000000
CONTEXT:  807ed360 -- (.cxr 0xffffffff807ed360)
eax=85b0d0f8 ebx=00000000 ecx=00000000 edx=00002351 esi=85b0d0f8 edi=86cd7000
eip=94407018 esp=807ed9c4 ebp=807ed9c8 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
helloDriver!DriverEntry+0x18:
94407018 c60161          mov     byte ptr [ecx],61h         ds:0023:00000000=??
Resetting default scope
PROCESS_NAME:  System
WRITE_ADDRESS:  00000000 
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p            0x%p                    %s
EXCEPTION_CODE_STR:  c0000005
EXCEPTION_PARAMETER1:  00000001
EXCEPTION_PARAMETER2:  00000000
EXCEPTION_STR:  0xc0000005
STACK_TEXT:  
807ed9c8 840227b2     85b0d0f8 86cd7000 00000000 helloDriver!DriverEntry+0x18 [E:\codemix\windowsDevelopment\helloDriver\helloDriver\Source.c @ 18] 
807edbac 840262c1     00000001 00000000 807edbd4 nt!IopLoadDriver+0x7ed
807edbf4 83ebdb4b     8d427bd0 855c38c8 855d84c0 nt!IopLoadUnloadDriver+0x70
807edc44 84068b38     00000001 9cdb13d2 00000000 nt!ExpWorkerThread+0x10d
807edc90 83f06301     83ebda3e 00000001 00000000 nt!PspSystemThreadStartup+0x159
00000000 00000000     00000000 00000000 00000000 nt!KiThreadStartup+0x19
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    83eb76a7 - nt!SwapContext_XRstorBegin+2
    [ 89:a9 ]
    83eb794d - nt!EnlightenedSwapContext_XRstorBegin+2 (+0x2a6)
    [ 89:a9 ]
2 errors : !nt (83eb76a7-83eb794d)
MODULE_NAME: memory_corruption
IMAGE_NAME:  memory_corruption
MEMORY_CORRUPTOR:  ONE_BIT_LARGE
STACK_COMMAND:  .cxr 0xffffffff807ed360 ; kb
FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT_LARGE
OS_VERSION:  7.1.7601.24384
BUILDLAB_STR:  win7sp1_ldr_escrow
OSPLATFORM_TYPE:  x86
OSNAME:  Windows 7
FAILURE_ID_HASH:  {31545515-196b-fab5-2300-9ce714226f43}
Followup:     memory_corruption
---------
************* Path validation summary **************
Response                         Time (ms)     Location
OK                                             E:\codemix\windowsDevelopment\helloDriver\helloDriver
************* Path validation summary **************
Response                         Time (ms)     Location
OK                                             E:\codemix\windowsDevelopment\helloDriver\helloDriver
kd> g
Shutdown occurred at (Wed Jul 13 21:01:42.441 2022 (UTC + 8:00))...unloading all symbol tables.
************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*E:\symbol*http://msdl.microsoft.com/download/symbols
Deferred                                       srv*c:\symbols* http://msdl.microsoft.com/download/symbols
OK                                             E:\codemix\windowsDevelopment\helloDriver\Debug
Deferred                                       SRV*E:\symboll* http://msdl.microsoft.com/download/symbols
Waiting to reconnect...
BD: Boot Debugger Initialized
Connected to Windows Boot Debugger 7601 x86 compatible target at (Wed Jul 13 21:01:54.082 2022 (UTC + 8:00)), ptr64 FALSE
Kernel Debugger connection established.
************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*E:\symbol*http://msdl.microsoft.com/download/symbols
Deferred                                       srv*c:\symbols* http://msdl.microsoft.com/download/symbols
OK                                             E:\codemix\windowsDevelopment\helloDriver\Debug
Deferred                                       SRV*E:\symboll* http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*E:\symbol*http://msdl.microsoft.com/download/symbols;srv*c:\symbols* http://msdl.microsoft.com/download/symbols;E:\codemix\windowsDevelopment\helloDriver\Debug;SRV*E:\symboll* http://msdl.microsoft.com/download/symbols
Executable search path is: 
ReadVirtual() failed in GetXStateConfiguration() first read attempt (error == 0.)
Windows Boot Debugger Kernel Version 7601 UP Free x86 compatible
Machine Name:
Primary image base = 0x00539000 Loaded module list = 0x005dbd60
System Uptime: not available
************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*E:\symbol*http://msdl.microsoft.com/download/symbols
Deferred                                       srv*c:\symbols* http://msdl.microsoft.com/download/symbols
OK                                             E:\codemix\windowsDevelopment\helloDriver\Debug
Deferred                                       SRV*E:\symboll* http://msdl.microsoft.com/download/symbols
************* Path validation summary **************
Response                         Time (ms)     Location
OK                                             E:\codemix\windowsDevelopment\helloDriver\helloDriver
winload!DbgLoadImageSymbols+0x44:
0056f93d cc              int     3
kd> g
Shutdown occurred at (Wed Jul 13 21:02:18.377 2022 (UTC + 8:00))...unloading all symbol tables.
************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*E:\symbol*http://msdl.microsoft.com/download/symbols
Deferred                                       srv*c:\symbols* http://msdl.microsoft.com/download/symbols
OK                                             E:\codemix\windowsDevelopment\helloDriver\Debug
Deferred                                       SRV*E:\symboll* http://msdl.microsoft.com/download/symbols
Waiting to reconnect...
Connected to Windows 7 7601 x86 compatible target at (Wed Jul 13 21:02:19.339 2022 (UTC + 8:00)), ptr64 FALSE
Kernel Debugger connection established.
************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*E:\symbol*http://msdl.microsoft.com/download/symbols
Deferred                                       srv*c:\symbols* http://msdl.microsoft.com/download/symbols
OK                                             E:\codemix\windowsDevelopment\helloDriver\Debug
Deferred                                       SRV*E:\symboll* http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*E:\symbol*http://msdl.microsoft.com/download/symbols;srv*c:\symbols* http://msdl.microsoft.com/download/symbols;E:\codemix\windowsDevelopment\helloDriver\Debug;SRV*E:\symboll* http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 MP (1 procs) Free x86 compatible
Edition build lab: 7601.24384.x86fre.win7sp1_ldr_escrow.190220-1800
Machine Name:
Kernel base = 0x83e4c000 PsLoadedModuleList = 0x83fa1730
System Uptime: not available
************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*E:\symbol*http://msdl.microsoft.com/download/symbols
Deferred                                       srv*c:\symbols* http://msdl.microsoft.com/download/symbols
OK                                             E:\codemix\windowsDevelopment\helloDriver\Debug
Deferred                                       SRV*E:\symboll* http://msdl.microsoft.com/download/symbols
************* Path validation summary **************
Response                         Time (ms)     Location
OK                                             E:\codemix\windowsDevelopment\helloDriver\helloDriver
nt!DbgLoadImageSymbols+0x47:
83e64d0e cc              int     3

报错参数

arg1 ：错误代码 c000005
arg2：94407018 发生错误的内存地址

报错位置

发生错误的代码在 helloDriver!DriverEntry+0x00000018 的位置
错误码：c0000005 (Access violation)
原因，尝试在0x0 地址写入数据：Attempt to write to address 00000000

寄存器状态

寄存器状态：

发生错误代码

94407018 c60161          mov     byte ptr [ecx],61h         ds:0023:00000000=??

调用栈

在E:\codemix\windowsDevelopment\helloDriver\helloDriver\Source.c @ 18 第18行发生错误

二进制安全

调试驱动