x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 2 Activity

Intercept more functions for crashdumps

This commit is contained in:
Nukem 2016-12-02 02:07:07 -05:00
parent 7e9eed4c7f
commit e1bf22fdc9
2 changed files with 31 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
src/exe/crashdump.cpp
View File

@ -2,6 +2,7 @@
#include <dbghelp.h>
#include <stdio.h>
#include <exception>
#include <signal.h>
#include "crashdump.h"
#define PROCESS_CALLBACK_FILTER_ENABLED 0x1
@ -34,7 +35,7 @@ void CrashDumpInitialize()
{
// Get handles to kernel32 and dbghelp
HMODULE hKernel32 = GetModuleHandleA("kernel32.dll");
HMODULE hDbghelp = LoadLibrary("dbghelp.dll");
HMODULE hDbghelp = LoadLibraryA("dbghelp.dll");
if(hDbghelp)
*(FARPROC*)&MiniDumpWriteDumpPtr = GetProcAddress(hDbghelp, "MiniDumpWriteDump");
@ -48,7 +49,6 @@ void CrashDumpInitialize()
if(MiniDumpWriteDumpPtr)
SetUnhandledExceptionFilter(CrashDumpExceptionHandler);
// --- WINDOWS OVERRIDES ---
// Ensure that exceptions are not swallowed when dispatching certain Windows
// messages.
//
@ -62,14 +62,15 @@ void CrashDumpInitialize()
SetProcessUserModeExceptionPolicyPtr(flags & ~PROCESS_CALLBACK_FILTER_ENABLED);
}
// --- CRT OVERRIDES ---
// If building for release mode, redirect the terminate() and
// invalid_parameter() callbacks to force generate a crashdump.
//
#ifndef _DEBUG
_set_invalid_parameter_handler(InvalidParameterHandler);
set_terminate(TerminateHandler);
#endif // ndef _DEBUG
// If not running under a debugger, redirect purecall, terminate, abort, and
// invalid parameter callbacks to force generate a dump.
if(!IsDebuggerPresent())
{
_set_purecall_handler(TerminateHandler); // https://msdn.microsoft.com/en-us/library/t296ys27.aspx
_set_invalid_parameter_handler(InvalidParameterHandler);// https://msdn.microsoft.com/en-us/library/a9yf33zb.aspx
set_terminate(TerminateHandler); // http://en.cppreference.com/w/cpp/error/set_terminate
signal(SIGABRT, AbortHandler); // https://msdn.microsoft.com/en-us/library/xdkz3x12.aspx
}
}
void CrashDumpFatal(const char* Format, ...)
@ -81,22 +82,21 @@ void CrashDumpFatal(const char* Format, ...)
vsnprintf_s(buffer, _TRUNCATE, Format, va);
va_end(va);
MessageBox(nullptr, buffer, "Error", MB_ICONERROR);
MessageBoxA(nullptr, buffer, "Error", MB_ICONERROR);
}
void CrashDumpCreate(EXCEPTION_POINTERS* ExceptionPointers)
{
// Generate a crash dump file in the root directory
// Generate a crash dump file in the minidump directory
wchar_t dumpFile[MAX_PATH];
wchar_t dumpDir[MAX_PATH];
if(!GetCurrentDirectoryW(ARRAYSIZE(dumpDir), dumpDir))
{
CrashDumpFatal("Unable to obtain current directory during crash dump\n");
CrashDumpFatal("Unable to obtain current directory during crash dump");
return;
}
// Create minidump subdirectory if needed
wcscat_s(dumpDir, L"\\minidump");
CreateDirectoryW(dumpDir, nullptr);
@ -118,7 +118,7 @@ void CrashDumpCreate(EXCEPTION_POINTERS* ExceptionPointers)
if(fileHandle == INVALID_HANDLE_VALUE)
{
CrashDumpFatal("Failed to open file path '%ws' while generating crash dump\n", dumpFile);
CrashDumpFatal("Failed to open file path '%ws' while generating crash dump", dumpFile);
return;
}
@ -131,7 +131,7 @@ void CrashDumpCreate(EXCEPTION_POINTERS* ExceptionPointers)
info.ClientPointers = TRUE;
if(!MiniDumpWriteDumpPtr(GetCurrentProcess(), GetCurrentProcessId(), fileHandle, MiniDumpNormal, &info, nullptr, nullptr))
CrashDumpFatal("MiniDumpWriteDump failed. Error: %u\n", GetLastError());
CrashDumpFatal("MiniDumpWriteDump failed. Error: %u", GetLastError());
// Close the file & done
CloseHandle(fileHandle);
@ -139,8 +139,8 @@ void CrashDumpCreate(EXCEPTION_POINTERS* ExceptionPointers)
LONG CALLBACK CrashDumpExceptionHandler(EXCEPTION_POINTERS* ExceptionInfo)
{
// Any "exception" under 0x1000 is usually just a failed RPC call
if(ExceptionInfo && ExceptionInfo->ExceptionRecord->ExceptionCode > 0x00001000)
// Any "exception" under 0x1000 is usually a failed remote procedure call (RPC)
if(ExceptionInfo && ExceptionInfo->ExceptionRecord->ExceptionCode > 0x1000)
{
switch(ExceptionInfo->ExceptionRecord->ExceptionCode)
{
@ -159,21 +159,24 @@ LONG CALLBACK CrashDumpExceptionHandler(EXCEPTION_POINTERS* ExceptionInfo)
void InvalidParameterHandler(const wchar_t* Expression, const wchar_t* Function, const wchar_t* File, unsigned int Line, uintptr_t Reserved)
{
// Notify user
CrashDumpFatal("Invalid parameter passed to CRT function! Program will now crash.\n\nFile: %ws\nFunction: %ws\nExpression: %ws",
CrashDumpFatal("Invalid parameter passed to CRT function! Program will now generate an exception.\n\nFile: %ws\nFunction: %ws\nExpression: %ws",
Function ? Function : L"???",
File ? File : L"???",
Expression ? Expression : L"???");
// Generate exception
throw;
// RaiseException: avoid the use of throw/C++ exceptions and possible __fastfail calls
RaiseException(0x78646267, EXCEPTION_NONCONTINUABLE, 0, nullptr);
}
void TerminateHandler()
{
// Notify user
CrashDumpFatal("Process termination was requested in an unusual way. Program will now crash.");
CrashDumpFatal("Process termination was requested in an unusual way. Program will now generate an exception.");
// Generate exception
throw;
// See InvalidParameterHandler()
RaiseException(0x78646267, EXCEPTION_NONCONTINUABLE, 0, nullptr);
}
void AbortHandler(int Signal)
{
TerminateHandler();
}

3
src/exe/crashdump.h
View File

@ -3,4 +3,5 @@
void CrashDumpInitialize();
LONG CALLBACK CrashDumpExceptionHandler(EXCEPTION_POINTERS* ExceptionInfo);
void InvalidParameterHandler(const wchar_t* Expression, const wchar_t* Function, const wchar_t* File, unsigned int Line, uintptr_t Reserved);
void TerminateHandler();
void TerminateHandler();
void AbortHandler(int Signal);