Windows用户态调试学习

作者: 超哥__ | 来源:发表于2018-01-19 23:52 被阅读0次

Windows用户态调试学习
2018-08-15 Windows调试和内核
Windbg使用说明书
6.Windows用户态调试模型
qemu调试arm内核--Apple的学习笔记
Windows 保存的共享目录认证信息如何删除？
【Linux】弄懂用户态与内核态
android adb 调试总结
内核态和用户态、
内核态和用户态

layout: post
title: Windows用户态调试学习
categories: Debug
description: windows用户态调试学习
keywords:
url: https://lichao890427.github.io/ https://github.com/lichao890427/

Windows用户态调试学习

一基础知识

MSDN上的介绍：https://msdn.microsoft.com/en-us/library/ms679304(v=vs.85).aspx中的调试事件及调试结构节

调试事件：

WaitForDebugEvent在接收到内核传递的调试信息后会由阻塞态转为激活态，内核会挂起所有线程，直到ContinueDebugEvent执行

Type	Describ	Struct
CREATE_PROCESS_DEBUG_EVENT	创建进程事件	CREATE_PROCESS_DEBUG_INFO
CREATE_THREAD_DEBUG_EVENT	创建线程事件	CREATE_THREAD_DEBUG_INFO
EXCEPTION_DEBUG_EVENT	发生异常	EXCEPTION_DEBUG_INFO
EXIT_PROCESS_DEBUG_EVENT	进程退出	EXIT_PROCESS_DEBUG_INFO
EXIT_THREAD_DEBUG_EVENT	线程退出	EXIT_THREAD_DEBUG_INFO
LOAD_DLL_DEBUG_EVENT	加载DLL	LOAD_DLL_DEBUG_INFO
OUTPUT_DEBUG_STRING_EVENT	输出调试字符串	OUTPUT_DEBUG_STRING_INFO
UNLOAD_DLL_DEBUG_EVENT	卸载DLL	UNLOAD_DLL_DEBUG_INFO
RIP_EVENT	进程不受系统调试器控制的结束	RIP_INFO

调试结构：

CONTEXT：ring3下不能直接读写寄存器，而间接通过设置context结构完成
DEBUG_EVENT：接受的调试事件结构
LDT_ENTRY：用于获得描述符表

调试函数

CheckRemoteDebuggerPresent 检查debug port是否存在
ContinueDebugEvent 继续执行由调试事件打断的线程.
DebugActiveProcess 附加调试
DebugActiveProcessStop 停止附加调试
DebugBreak 在当前进程中产生断点
DebugBreakProcess 在指定进程中产生断点（远程线程注入）
DebugSetProcessKillOnExit 调试器退出时结束进程
FatalExit 退出进程并将执行权交给调试器
FlushInstructionCache 刷新指令缓存（在修改内存指令后使用）
GetThreadContext 获取线程上下文
GetThreadSelectorEntry 获取线程的选择子的描述符表
IsDebuggerPresent 用调试标志检查用户态调试器是否存在
OutputDebugString 输出调试信息给调试器
SetThreadContext 设置线程上下文
WaitForDebugEvent 等待调试事件

二用户态调试模型及相关代码

windows用户态调试器是基于事件模式的，由内核做中介的被调试进程和调试器进程的交互，也就是说被调试者和调试器处于不同进程（见《软件调试》），流程如下：

void main()
 {
         (OpenProcess);
         DebugActiveProcess;
         while(Alive)
         {
                 WaitForDebugEvent;
                 switch(DebugEvent.dwDebugEventCode)
                 {
                         ....
         
                 }
                 ContinueDebugEvent;
         }
 }

&emsp;&emsp;无疑这里最重要的函数就是DebugActiveProcess和ContinueDebugEvent，是调试器最表层的接口，而调试器源码位于ntos/dbgk文件夹下，dbgkobj.c dbgkp.h dbgkport.c dbgkproc.c

```Txt
DebugActiveProcess->NtDebugActiveProcess->DbgkpPostFakeProcessCreateMessages DbgkpSetProcessDebugObject
ContinueDebugEvent->NtDebugContinue->DbgkpWakeTarget->DbgkpFreeDebugEvent
DbgkpPostFakeProcessCreateMessages->DbgkpPostFakeThreadMessages DbgkpPostFakeModuleMessages

DbgkpSendApiMessage 调试消息函数，在某些内核api操作中会将调试事件添加到队列中
DbgkpSuspendProcess 挂起进程
DbgkpResumeProcess 恢复线程

默认下windows只能支持一个调试器，绑定到进程peb的debugport成员中，由于内核代码已经写死了，因此想支持多个调试器同时调试一个进程，只能另寻办法，我的构想是将调试器和内核之间的通信，中间插入一个中介调试器进行协调，同时一个调试器的行为生效则刷新到所有调试器，这样就需要中介调试器hook一些调试api，并完成和这些调试器的通信，而中介调试器直接接收内核发出的调试信息。正在深入研究调试源码并完善设计思路。

//DbgSsReserved[0]->PDBGSS_THREAD_DATA*
//DbgSsReserved[1]->DebugObjectHandle
BOOL WINAPI ContinueDebugEvent(DWORD dwProcessId, DWORD dwThreadId, DWORD dwContinueStatus)
{
    ClientId.UniqueProcess = (HANDLE)dwProcessId;
    ClientId.UniqueThread = (HANDLE)dwThreadId;
    ZwDebugContinue(NtCurrentTeb()->DbgSsReserved[1], ClientId, dwContinueStatus);
    //移除进程线程句柄
    ThreadData = (PDBGSS_THREAD_DATA*)NtCurrentTeb()->DbgSsReserved;
    ThisData = *ThreadData;
    while(ThisData)
    {
        if ((ThisData->HandleMarked) && ((ThisData->ProcessId == dwProcessId) || (ThisData->ThreadId == dwThreadId)))
        {
            if (ThisData->ThreadHandle) CloseHandle(ThisData->ThreadHandle);
            if (ThisData->ProcessHandle) CloseHandle(ThisData->ProcessHandle);
            *ThreadData = ThisData->Next;
            RtlFreeHeap(RtlGetProcessHeap(), 0, ThisData);
        }
        else
        {
            ThreadData = &ThisData->Next;
        }
        ThisData = *ThreadData;
    }
}

BOOL WINAPI DebugActiveProcess(DWORD dwProcessId)
{
    //创建调试对象
    InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, 0);
    Status = ZwCreateDebugObject(&NtCurrentTeb()->DbgSsReserved[1], DEBUG_OBJECT_ALL_ACCESS, &ObjectAttributes, DBGK_KILL_PROCESS_ON_EXIT);
    //OpenProcess获取进程句柄
    ClientId.UniqueThread = NULL;
    ClientId.UniqueProcess = UlongToHandle(dwProcessId);
    InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);
    Status = NtOpenProcess(&Handle, PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ 
        | PROCESS_SUSPEND_RESUME | PROCESS_QUERY_INFORMATION, &ObjectAttributes, &ClientId);
    Status = NtDebugActiveProcess(Process, NtCurrentTeb()->DbgSsReserved[1]);
    //注入并设置int 3
    NtClose(Handle);
}

BOOL WINAPI DebugActiveProcessStop(DWORD dwProcessId)
{
    //OpenProcess获取进程句柄
    ClientId.UniqueThread = NULL;
    ClientId.UniqueProcess = UlongToHandle(dwProcessId);
    InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);
    Status = NtOpenProcess(&Handle, PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ 
        | PROCESS_SUSPEND_RESUME | PROCESS_QUERY_INFORMATION, &ObjectAttributes, &ClientId);
    //关闭所有进程句柄
    ThreadData = (PDBGSS_THREAD_DATA*)NtCurrentTeb()->DbgSsReserved;
    ThisData = *ThreadData;
    while(ThisData)
    {
        if (ThisData->ProcessId == dwProcessId)
        {
            if (ThisData->ThreadHandle) CloseHandle(ThisData->ThreadHandle);
            if (ThisData->ProcessHandle) CloseHandle(ThisData->ProcessHandle);
            *ThreadData = ThisData->Next;
            RtlFreeHeap(RtlGetProcessHeap(), 0, ThisData);
        }
        else
        {
            ThreadData = &ThisData->Next;
        }
        ThisData = *ThreadData;
    }
    Status = NtRemoveProcessDebug(Process, NtCurrentTeb()->DbgSsReserved[1]);
    NtClose(Handle);
}

BOOL WINAPI DebugSetProcessKillOnExit(BOOL KillOnExit)
{
    STATE = KillOnExit != 0;
    Handle = NtCurrentTeb()->DbgSsReserved[1];
    Status = NtSetInformationDebugObject(Handle, DebugObjectKillProcessOnExitInformation, &State, sizeof(State), NULL);
}

BOOL WINAPI WaitForDebugEvent(LPDEBUG_EVENT lpDebugEvent, DWORD dwMilliseconds)
{
    do
    {
        Status = NtWaitForDebugEvent(NtCurrentTeb()->DbgSsReserved[1], TRUE, TimeOut, &WaitStateChange);
    } while ((Status == STATUS_ALERTED) || (Status == STATUS_USER_APC));

    lpDebugEvent->dwProcessId = (DWORD)WaitStateChange->AppClientId.UniqueProcess;
    lpDebugEvent->dwThreadId = (DWORD)WaitStateChange->AppClientId.UniqueThread;

    switch (WaitStateChange->NewState)
    {
    case DbgCreateThreadStateChange:
        DebugEvent->dwDebugEventCode = CREATE_THREAD_DEBUG_EVENT;
        DebugEvent->u.CreateThread.hThread = WaitStateChange->StateInfo.CreateThread.HandleToThread;
        DebugEvent->u.CreateThread.lpStartAddress = WaitStateChange->StateInfo.CreateThread.NewThread.StartAddress;
        Status = NtQueryInformationThread(WaitStateChange->StateInfo.CreateThread.HandleToThread, ThreadBasicInformation, &ThreadBasicInfo, sizeof(ThreadBasicInfo), NULL);
        DebugEvent->u.CreateThread.lpThreadLocalBase = ThreadBasicInfo.TebBaseAddress;
        break;

    case DbgCreateProcessStateChange:
        DebugEvent->dwDebugEventCode = CREATE_PROCESS_DEBUG_EVENT;
        DebugEvent->u.CreateProcessInfo.hProcess = WaitStateChange->StateInfo.CreateProcessInfo.HandleToProcess;
        DebugEvent->u.CreateProcessInfo.hThread = WaitStateChange->StateInfo.CreateProcessInfo.HandleToThread;
        DebugEvent->u.CreateProcessInfo.hFile = WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.FileHandle;
        DebugEvent->u.CreateProcessInfo.lpBaseOfImage = WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.BaseOfImage;
        DebugEvent->u.CreateProcessInfo.dwDebugInfoFileOffset = WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.DebugInfoFileOffset;
        DebugEvent->u.CreateProcessInfo.nDebugInfoSize = WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.DebugInfoSize;
        DebugEvent->u.CreateProcessInfo.lpStartAddress = WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.InitialThread.StartAddress;
        Status = NtQueryInformationThread(WaitStateChange->StateInfo.CreateProcessInfo.HandleToThread, ThreadBasicInformation,
            &ThreadBasicInfo, sizeof(ThreadBasicInfo), NULL);
        DebugEvent->u.CreateProcessInfo.lpThreadLocalBase = ThreadBasicInfo.TebBaseAddress;
        DebugEvent->u.CreateProcessInfo.lpImageName = NULL;
        DebugEvent->u.CreateProcessInfo.fUnicode = TRUE;
        break;

    case DbgExitThreadStateChange:
        DebugEvent->dwDebugEventCode = EXIT_THREAD_DEBUG_EVENT;
        DebugEvent->u.ExitThread.dwExitCode = WaitStateChange->StateInfo.ExitThread.ExitStatus;
        break;

    case DbgExitProcessStateChange:
        DebugEvent->dwDebugEventCode = EXIT_PROCESS_DEBUG_EVENT;
        DebugEvent->u.ExitProcess.dwExitCode = WaitStateChange->StateInfo.ExitProcess.ExitStatus;
        break;

    case DbgExceptionStateChange:
    case DbgBreakpointStateChange:
    case DbgSingleStepStateChange:
        if (WaitStateChange->StateInfo.Exception.ExceptionRecord.ExceptionCode == DBG_PRINTEXCEPTION_C)
        {
            DebugEvent->dwDebugEventCode = OUTPUT_DEBUG_STRING_EVENT;
            DebugEvent->u.DebugString.lpDebugStringData = (PVOID)WaitStateChange->StateInfo.Exception.ExceptionRecord.ExceptionInformation[1];
            DebugEvent->u.DebugString.nDebugStringLength = WaitStateChange->StateInfo.Exception.ExceptionRecord.ExceptionInformation[0];
            DebugEvent->u.DebugString.fUnicode = FALSE;
        }
        else if (WaitStateChange->StateInfo.Exception.ExceptionRecord.ExceptionCode == DBG_RIPEXCEPTION)
        {
            DebugEvent->dwDebugEventCode = RIP_EVENT;
            DebugEvent->u.RipInfo.dwType = WaitStateChange->StateInfo.Exception.ExceptionRecord.ExceptionInformation[1];
            DebugEvent->u.RipInfo.dwError = WaitStateChange->StateInfo.Exception.ExceptionRecord.ExceptionInformation[0];
        }
        else
        {
            DebugEvent->dwDebugEventCode = EXCEPTION_DEBUG_EVENT;
            DebugEvent->u.Exception.ExceptionRecord = WaitStateChange->StateInfo.Exception.ExceptionRecord;
            DebugEvent->u.Exception.dwFirstChance = WaitStateChange->StateInfo.Exception.FirstChance;
        }
        break;

    case DbgLoadDllStateChange:
        DebugEvent->dwDebugEventCode = LOAD_DLL_DEBUG_EVENT;
        DebugEvent->u.LoadDll.lpBaseOfDll = WaitStateChange->StateInfo.LoadDll.BaseOfDll;
        DebugEvent->u.LoadDll.hFile = WaitStateChange->StateInfo.LoadDll.FileHandle;
        DebugEvent->u.LoadDll.dwDebugInfoFileOffset = WaitStateChange->StateInfo.LoadDll.DebugInfoFileOffset;
        DebugEvent->u.LoadDll.nDebugInfoSize = WaitStateChange->StateInfo.LoadDll.DebugInfoSize;
        InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);
        Status = NtOpenThread(&ThreadHandle, THREAD_QUERY_INFORMATION, &ObjectAttributes, &WaitStateChange->AppClientId);
        Status = NtQueryInformationThread(ThreadHandle, ThreadBasicInformation, &ThreadBasicInfo, sizeof(ThreadBasicInfo), NULL);
        NtClose(ThreadHandle);
        DebugEvent->u.LoadDll.lpImageName = ((PTEB)ThreadBasicInfo.TebBaseAddress)->NtTib.ArbitraryUserPointer;
        DebugEvent->u.LoadDll.fUnicode = TRUE;
        break;

    case DbgUnloadDllStateChange:
        DebugEvent->dwDebugEventCode = UNLOAD_DLL_DEBUG_EVENT;
        DebugEvent->u.UnloadDll.lpBaseOfDll = WaitStateChange->StateInfo.UnloadDll.BaseAddress;
        break;

    default: 
        return STATUS_UNSUCCESSFUL;
    }

    switch (lpDebugEvent->dwDebugEventCode)
    {
    case CREATE_THREAD_DEBUG_EVENT:
        SaveThreadHandle(lpDebugEvent->dwProcessId, lpDebugEvent->dwThreadId, lpDebugEvent->u.CreateThread.hThread);
        break;
    case CREATE_PROCESS_DEBUG_EVENT:
        SaveProcessHandle(lpDebugEvent->dwProcessId, lpDebugEvent->u.CreateProcessInfo.hProcess);
        SaveThreadHandle(lpDebugEvent->dwProcessId, lpDebugEvent->dwThreadId, lpDebugEvent->u.CreateProcessInfo.hThread);
        break;
    case EXIT_PROCESS_DEBUG_EVENT:
        MarkProcessHandle(lpDebugEvent->dwProcessId);
    case EXIT_THREAD_DEBUG_EVENT:
        MarkThreadHandle(lpDebugEvent->dwThreadId);
        break;
    case EXCEPTION_DEBUG_EVENT:
    case LOAD_DLL_DEBUG_EVENT:
    case UNLOAD_DLL_DEBUG_EVENT:
    case OUTPUT_DEBUG_STRING_EVENT:
    case RIP_EVENT:
        break;
    default:
        return FALSE;
    }
}

#define DbgSsSetThreadData(d) NtCurrentTeb()->DbgSsReserved[0] = d
#define DbgSsGetThreadData() ((PDBGSS_THREAD_DATA)NtCurrentTeb()->DbgSsReserved[0])

VOID WINAPI SaveThreadHandle(DWORD dwProcessId, DWORD dwThreadId, HANDLE hThread)
{
    PDBGSS_THREAD_DATA ThreadData;
    ThreadData = RtlAllocateHeap(RtlGetProcessHeap(), 0, sizeof(DBGSS_THREAD_DATA));
    ThreadData->ThreadHandle = hThread;
    ThreadData->ProcessId = dwProcessId;
    ThreadData->ThreadId = dwThreadId;
    ThreadData->ProcessHandle = NULL;
    ThreadData->HandleMarked = FALSE;
    ThreadData->Next = DbgSsGetThreadData();
    DbgSsSetThreadData(ThreadData);
}

VOID WINAPI SaveProcessHandle(DWORD dwProcessId, HANDLE hProcess)
{
    PDBGSS_THREAD_DATA ThreadData;
    ThreadData = RtlAllocateHeap(RtlGetProcessHeap(), 0, sizeof(DBGSS_THREAD_DATA));
    ThreadData->ProcessHandle = hProcess;
    ThreadData->ProcessId = dwProcessId;
    ThreadData->ThreadId = 0;
    ThreadData->ThreadHandle = NULL;
    ThreadData->HandleMarked = FALSE;
    ThreadData->Next = DbgSsGetThreadData();
    DbgSsSetThreadData(ThreadData);
}

VOID WINAPI MarkProcessHandle(DWORD dwProcessId)
{
    PDBGSS_THREAD_DATA ThreadData;
    for (ThreadData = DbgSsGetThreadData(); ThreadData; ThreadData = ThreadData->Next)
    {
        if ((ThreadData->ProcessId == dwProcessId) && !(ThreadData->ThreadId))
        {
            ThreadData->HandleMarked = TRUE;
            break;
        }
    }
}

VOID WINAPI MarkThreadHandle(DWORD dwThreadId)
{
    PDBGSS_THREAD_DATA ThreadData;
    for (ThreadData = DbgSsGetThreadData(); ThreadData; ThreadData = ThreadData->Next)
    {
        if (ThreadData->ThreadId == dwThreadId)
        {
            ThreadData->HandleMarked = TRUE;
            break;
        }
    }
}

可见作为内核接口的api有：

ZwDebugContinue
ZwCreateDebugObject
NtDebugActiveProcess
NtRemoveProcessDebug
NtSetInformationDebugObject
NtWaitForDebugEvent

Windows用户态调试学习
layout: posttitle: Windows用户态调试学习categories: Debugdescrip...
2018-08-15 Windows调试和内核
Windows调试软件调试分类。按目标代码的执行模式：内核态调试，用户态调试；按调试器与调试目标的相对位置：本机...
Windbg使用说明书
术语、缩略语 windbg windows平台下，强大的用户态和内核态调试工具。 dmp 内存映像文件，一般是系统...
6.Windows用户态调试模型
从xp开始的用户态调试模型: 上面的右侧是调试器进程(Debugger Process),左侧是被调试进程(Deb...
qemu调试arm内核--Apple的学习笔记
前言昨天做了用户态的调试环境，本来今天想做ko模块和内核的Kgdb调试环境，结果Kgdb等待是可行的，但是tar...
Windows 保存的共享目录认证信息如何删除？
调试 Samba 服务的用户登录时，需要在 Windows 下尝试使用不同的用户名和密码登录 Samba 共享目录...
【Linux】弄懂用户态与内核态
在学习线程池的时候，相信大家都听过这样的话：“创建线程需要从用户态切换到内核态，用户态和内核态切换的开销大”。那这...
android adb 调试总结
一 windows 上搭配adb 调试环境下面以windows 7 /10 为例说明如何创建adb调试环境。其...
内核态和用户态、
内核态和用户态的区别内核态切换用户态耗时的原因
内核态和用户态
内核态和用户态是操作系统的两种运行级别，内核态权限高，用户态权限低。用户程序从用户态切换到内核态：系统调用（软中...

Windows用户态调试学习

Windows用户态调试学习

一基础知识

调试事件：

调试结构：

调试函数

二用户态调试模型及相关代码

相关文章

Windows用户态调试学习

2018-08-15 Windows调试和内核

Windbg使用说明书

6.Windows用户态调试模型

qemu调试arm内核--Apple的学习笔记

Windows 保存的共享目录认证信息如何删除？

【Linux】弄懂用户态与内核态

android adb 调试总结

内核态和用户态、

内核态和用户态

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读

Windows用户态调试学习

Windows用户态调试学习

一 基础知识

调试事件：

调试结构：

调试函数

二 用户态调试模型及相关代码

相关文章

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读

一基础知识

二用户态调试模型及相关代码