Windowsのシステムクラッシュダンプ内の自身のデータ

// // The KeRegisterBugCheckReasonCallback exists for xp sp1 and above. So // check whether this function is defined on the current OS and register // for the bugcheck callback only if this function is defined. // RtlInitUnicodeString(&funcName, L"KeRegisterBugCheckReasonCallback"); funcPtr = (PFN_KE_REGISTER_BUGCHECK_REASON_CALLBACK) MmGetSystemRoutineAddress(&funcName); if (NULL == funcPtr) { goto Done; }
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
     

  // // Initialize the callback record. // KeInitializeCallbackRecord(callbackRecord); // // Register the bugcheck callback. // funcPtr(callbackRecord, FxpLibraryBugCheckCallback, KbCallbackSecondaryDumpData, (PUCHAR)WdfLdrType); ASSERT(callbackRecord->CallbackRoutine != NULL);
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
     

 VOID FxpLibraryBugCheckCallback( __in KBUGCHECK_CALLBACK_REASON Reason, __in PKBUGCHECK_REASON_CALLBACK_RECORD /* Record */, __inout PVOID ReasonSpecificData, __in ULONG ReasonSpecificLength ) /*++ Routine Description: Global (framework-library) BugCheck callback routine for WDF Arguments: Reason - Must be KbCallbackSecondaryData Record - Supplies the bugcheck record previously registered ReasonSpecificData - Pointer to KBUGCHECK_SECONDARY_DUMP_DATA ReasonSpecificLength - Sizeof(ReasonSpecificData) Return Value: None Notes: When a bugcheck happens the kernel bugcheck processor will make two passes of all registered BugCheckCallbackRecord routines. The first pass, called the "sizing pass" essentially queries all the callbacks to collect the total size of the secondary dump data. In the second pass the actual data is captured to the dump. --*/ { PKBUGCHECK_SECONDARY_DUMP_DATA dumpData; ULONG dumpSize; UNREFERENCED_PARAMETER(Reason); UNREFERENCED_PARAMETER(ReasonSpecificLength); ASSERT(ReasonSpecificLength >= sizeof(KBUGCHECK_SECONDARY_DUMP_DATA)); ASSERT(Reason == KbCallbackSecondaryDumpData); dumpData = (PKBUGCHECK_SECONDARY_DUMP_DATA) ReasonSpecificData; dumpSize = FxLibraryGlobals.BugCheckDriverInfoIndex * sizeof(FX_DUMP_DRIVER_INFO_ENTRY); // // See if the bugcheck driver info is more than can fit in the dump // if (dumpData->MaximumAllowed < dumpSize) { dumpSize = EXP_ALIGN_DOWN_ON_BOUNDARY( dumpData->MaximumAllowed, sizeof(FX_DUMP_DRIVER_INFO_ENTRY)); } if (0 == dumpSize) { goto Done; } // // Ok, provide the info about the bugcheck data. // dumpData->OutBuffer = FxLibraryGlobals.BugCheckDriverInfo; dumpData->OutBufferLength = dumpSize; dumpData->Guid = WdfDumpGuid2; Done:; }
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
     

 import os import sys import pykd import struct def print_command(command): if pykd.getDebugOptions() & pykd.debugOptions.PreferDml: pykd.dprint( '<exec cmd="{}">{}</exec>'.format(command, command), dml = True ) else: pykd.dprint( command ) def parse(): buff = bytearray( pykd.loadTaggedBuffer("F87E4A4C-C5A1-4d2f-BFF0-D5DE63A5E4C3") ) entry_type = pykd.typeInfo("Wdf01000!_FX_DUMP_DRIVER_INFO_ENTRY") _struct = struct.Struct( "<{}III".format("Q" if pykd.is64bitSystem() else "L") ) name_offset = entry_type.fieldOffset("DriverName") name_size = entry_type.DriverName.size() entry_size = entry_type.size() if len(buff) % entry_size: raise RuntimeError( "The buffer size ({}) is not a multiple of entry size ({})".format(len(buff), entry_size) ) print("[FxLibraryGlobals.BugCheckDriverInfo]") while len(buff): ptr, mj, mn, build = _struct.unpack_from(buff) name = str(buff[name_offset : name_offset + name_size]).strip("\0") command = "!drvobj {} 7".format(name) print_command( command ) pykd.dprint( " " * (24 - len(name)) ) pykd.dprint( " {:12} ".format("({}.{}.{})".format(mj, mn, build)) ) if ptr: command = "dx ((Wdf01000!{})0x{:x})".format(entry_type.FxDriverGlobals.name(), ptr) print_command( command ) pykd.dprintln( "" ) buff = buff[entry_size:] if __name__ == "__main__": if len(sys.argv) == 1: parse() else: for file_name in sys.argv[1:]: print(file_name) dump_id = pykd.loadDump(file_name) parse() pykd.closeDump(dump_id)