新建一个c#控制工程,就用自动生成的代码,不用补任何代码,如下:
using System; using System.Collections.Generic; using System.Linq; using System.Text; namespace ConsoleApplication1 { class Program { static void Main(string[] args) { } } }
工程配置如下
编译,在windbg里加载运行
当调试器中断时,在事件过滤器里添加异常0x04242420方便抛出时跟踪
在命令行输入g命令让程序执行,然后中断
可以看到,抛出了异常0x04242420,调试器中断,输入.exr -1,观察下异常信息
0:000> .exr -1
ExceptionAddress: 762819b2 (KERNELBASE!RaiseException+0x00000062)
ExceptionCode: 04242420
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 31415927
Parameter[1]: 721a0000
Parameter[2]: 00b7f3b0
输入kv观察调用栈
0:000> kv
# ChildEBP RetAddr Args to Child
00 00b7f330 72706c26 04242420 00000000 00000003 KERNELBASE!RaiseException+0x62 (FPO: [4,22,0])
01 00b7f3a4 7230aec4 00b7f3b0 00000c38 0000015c clr!Debugger::SendRawEvent+0x5d (FPO: [Non-Fpo])
02 00b7f7e0 72302a5b b1c50dba 00f140a0 723029d0 clr!Debugger::RaiseStartupNotification+0x36 (FPO: [0,268,0])
03 00b7f858 72302b3a b1c50d62 00ed6f38 72307ca0 clr!Debugger::Startup+0x76 (FPO: [Non-Fpo])
04 00b7f880 722f68db b1c50c3a 00000000 00000001 clr!InitializeDebugger+0x80 (FPO: [Non-Fpo])
05 00b7f9d8 722f58ca b1c50fc2 00000000 00000001 clr!EEStartupHelper+0x658 (FPO: [Non-Fpo])
06 00b7fa20 72316b9d b1c50f8a 00000000 00000000 clr!EEStartup+0x1e (FPO: [Non-Fpo])
07 00b7fa68 722c75ac b1c50f4a 00000000 723117c0 clr!EnsureEEStarted+0xd9 (FPO: [Non-Fpo])
08 00b7faa8 723117e5 b1c50f06 00000000 723117c0 clr!_CorExeMainInternal+0x8f (FPO: [Non-Fpo])
09 00b7fae4 7295fa84 5f72de49 729f43f0 7295fa20 clr!_CorExeMain+0x4d (FPO: [Non-Fpo])
0a 00b7fb1c 729ee80e 729f43f0 72950000 00b7fb44 mscoreei!_CorExeMain+0xd6 (FPO: [Non-Fpo])
0b 00b7fb2c 729f43f8 729f43f0 74c00419 0091e000 MSCOREE!ShellShim__CorExeMain+0x9e (FPO: [Non-Fpo])
0c 00b7fb34 74c00419 0091e000 74c00400 00b7fba0 MSCOREE!_CorExeMain_Exported+0x8 (FPO: [0,0,4])
0d 00b7fb44 76f2662d 0091e000 a984cad0 00000000 KERNEL32!BaseThreadInitThunk+0x19 (FPO: [Non-Fpo])
0e 00b7fba0 76f265fd ffffffff 76f451bb 00000000 ntdll!__RtlUserThreadStart+0x2f (FPO: [SEH])
0f 00b7fbb0 00000000 729f43f0 0091e000 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])
这里就可以看到该异常的抛出过程了,.net执行引擎EE启动,初始化clr调试器(clr!InitializeDebugger),clr调试器启动(clr!Debugger::Startup),引发启动通知(clr!Debugger::RaiseStartupNotification),发送原始通知clr!Debugger::SendRawEvent,引发异常04242420(KERNELBASE!RaiseException)
输入uf clr!Debugger::SendRawEvent看下异常信息传递过程
0:000> uf clr!Debugger::SendRawEvent
clr!Debugger::SendRawEvent:
7230ae4e 6a40 push 40h
7230ae50 b8d6288672 mov eax,offset clr! ?? ::FNODOBFM::`string‘+0x6f6c9 (728628d6)
7230ae55 e8ef49eaff call clr!_EH_prolog3_catch_GS (721af849)
7230ae5a 8b4d08 mov ecx,dword ptr [ebp+8]//将最后一个附加参数调试器IPC事件指针
放入ecx
7230ae5d c785e0ffffff27594131 mov dword ptr [ebp-20h],31415927h//局部变量保存第一个附加参数常量
7230ae67 a13c6e8e72 mov eax,dword ptr [clr!g_pMSCorEE (728e6e3c)]
7230ae6c 8985e4ffffff mov dword ptr [ebp-1Ch],eax
7230ae72 898de8ffffff mov dword ptr [ebp-18h],ecx
7230ae78 ff15e0628f72 call dword ptr [clr!_imp__IsDebuggerPresent (728f62e0)]
7230ae7e 85c0 test eax,eax
7230ae80 0f855cbd3f00 jne clr!Debugger::SendRawEvent+0x2b (72706be2) Branch
clr!Debugger::SendRawEvent+0x7c:
7230ae86 e8f748eaff call clr!_EH_epilog3_catch_GS (721af782)
7230ae8b c20400 ret 4
clr!Debugger::SendRawEvent+0x2b:
72706be2 e80d80aaff call clr!GetThread (721aebf4)
72706be7 50 push eax
72706be8 8d8dc4ffffff lea ecx,[ebp-3Ch]
72706bee e859b0aaff call clr!CLRException::HandlerState::HandlerState (721b1c4c)
72706bf3 83a5fcffffff00 and dword ptr [ebp-4],0
72706bfa c685fcffffff01 mov byte ptr [ebp-4],1
72706c01 8bc1 mov eax,ecx
72706c03 8985dcffffff mov dword ptr [ebp-24h],eax//最后一个附加参数放到附加参数数组里
72706c09 c685fcffffff02 mov byte ptr [ebp-4],2
72706c10 8d85e0ffffff lea eax,[ebp-20h]//取附件参数首地址放入eax
72706c16 50 push eax//附件参数首地址入栈
72706c17 6a03 push 3//附件参数个数入栈
72706c19 6a00 push 0//异常标志入栈
72706c1b 6820242404 push 4242420h//异常代码入栈
72706c20 ff15e4628f72 call dword ptr [clr!_imp__RaiseException (728f62e4)]//抛出异常
72706c26 c685fcffffff01 mov byte ptr [ebp-4],1
72706c2d 8d8dc4ffffff lea ecx,[ebp-3Ch]
72706c33 e8edafaaff call clr!CLRException::HandlerState::CleanupTry (721b1c25)
72706c38 83a5fcffffff00 and dword ptr [ebp-4],0
72706c3f 838dfcffffffff or dword ptr [ebp-4],0FFFFFFFFh
72706c46 f685c4ffffff02 test byte ptr [ebp-3Ch],2
72706c4d 0f843342c0ff je clr!Debugger::SendRawEvent+0x7c (7230ae86) Branch
原文地址:https://www.cnblogs.com/yilang/p/12063660.html