I have a dump. I am trying to look for objects in memory which contain a specific string. The ClassA->name should be equal to (18750736-6e77-48a7-9dca-8fd,windbg"/>

时间戳

首页 > 解决方案 > windbg 脚本查找是否为 unique_ptr is empty and strings match

I have a dump. I am trying to look for objects in memory which contain a specific string. The ClassA->name should be equal to (18750736-6e77-48a7-9dca-8fd

windbg - windbg 脚本查找是否为 unique_ptr is empty and strings match

I have a dump. I am trying to look for objects in memory which contain a specific string. The ClassA->name should be equal to (18750736-6e77-48a7-9dca-8fd

问题描述

I have a dump. I am trying to look for objects in memory which contain a specific string. The ClassA->name should be equal to (18750736-6e77-48a7-9dca-8fdf041e05d2:132257155499245423) and ClassA->classC object should not be empty and ClassA->name == ClassA->classC->name2 for a valid ClassA object.

ClassA
{
   // at offset 0x30
   wstring name; // looking for ClassC objects which have name == (18750736-6e77-48a7-9dca-8fdf041e05d2:132257155499245423)

   unique_ptr<ClassC> classC; // at offset 0xa8
};


ClassC
{
   wstring name2; // name2 == name in a valid object.
};

What is the best way to achieve this ?

I wrote following script where i am able to get all the location in memory which has specific string.

I have got offset of the classC field. How can i check if the value is empty or not and classC->name2 == classA->name ?

I find writing js script is hard as i don't know of how to interactively debug the issues in script. Is there any other better way to write windbg scripts ?

function log(a1,a2) 
{ 
    host.diagnostics.debugLog(a1 +"    " +a2 + "\n"); 
}

function exec (cmdstr)
{
    return host.namespace.Debugger.Utility.Control.ExecuteCommand(cmdstr);    
}

function runCommandGetAddresses3()
{
    var temp = exec("s -[w]u 0 L?ffffffff`ffffffff \"(18750736-6e77-48a7-9dca-8fdf041e05d2:132257155499245423)\"").Take(2);
    var addresses = [];

    for ( line of temp ) 
    {
        try
        {
            var token = line.split(" ");
            var addressOfClassAName = token[0];
            var t = exec("dx -r1 ((MyDll!std::unique_ptr<ClassC,std::default_delete<ClassC>>*) (0x" + addressOfClassAName + " - 0x30 + 0xa8))");
            addresses.push(t);
            // how to find if `t` is `empty` or has `value` ?
        }
        catch(ex)
        {
            log(ex, "exception");
        }
    }

    return addresses;
}

How to add more fields to aws cost explorer?

In the aws billing dashboard, how to add extra columns(tags added) while generating the report?

When I checked it is only adding the field, total cost.

标签： windbg

解决方案

我无法理解您脚本中的逻辑
1）您搜索宽字符串并获取其地址
，然后您开始直接操作该地址？

我假设你知道 std::wstring 是一个结构
我也假设你知道
上面的搜索结果是 std::wstring.c_str() 的地址

我还假设您对std::wstring 中的短字符串优化有所了解

std::wstring 将并且可以在其自身中嵌入一个短字符串或提供指向该字符串的指针

所以我再次假设你理解这个地址与A类没有关系

您通过搜索地址空间获得的此地址将在 std::wstring 内

（不可能是这种情况，因为您的字符串太长而无法调用 sso）

或指向 std::wstring 在其
构造函数中分配的一些任意内存的指针（可能在 Heap Some where）

减去 0x30 和添加 0xa8 等到这个地址都会导致垃圾

您似乎将此垃圾地址转换为指向 C 类的指针

请更正或编辑您的帖子以阐明您的意图

我做了一个快速的hack来代表你的A类并在windbg中显示看看

0:000> dx Debugger.Utility.Control.ExecuteCommand("s -[w]u 1f0000 l?(285000-1f0000) this").Take(2)

    [0x0]            : 002eb048  0074 0068 0069 0073 0020 0069 0073 0020  t.h.i.s. .i.s. .

0:000> ?? (foo._Mypair._Myval2->Aname._Mypair._Myval2._Bx._Ptr)
wchar_t * 0x002eb048
 "this is Aname's name ANAME"

0:000> dx foo
foo                 : unique_ptr {...} [Type: std::unique_ptr<A,std::default_delete<A> >]
    [<Raw View>]     [Type: std::unique_ptr<A,std::default_delete<A> >]
    [ptr]            : 0x2eaf80 [Type: A *]
    [deleter]        : default_delete [Type: std::_Compressed_pair<std::default_delete<A>,A *,1>]
    [+0x000] bf               : "1337" [Type: char [48]]
    [+0x030] Aname            : "this is Aname's name ANAME" [Type: std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >]
    [+0x048] cf               : ".???" [Type: char [96]]
    [+0x0a8] AnotherClass     : empty [Type: std::unique_ptr<C,std::default_delete<C> >]

foo 的地址是 0x18f9d0 你得到 0x2eb048 用于 wstring 搜索

0:000> dx &foo
&foo                 : 0x18f9d0 : unique_ptr {...} [Type: std::unique_ptr<A,std::default_delete<A> > *]

std::wstring 的地址在 HEAP 中，而 std::unique_ptr foo 在堆栈中

标准::wstring

0:000> !address 0x002eb048

Usage:                  Heap
Base Address:           002e0000
End Address:            002f0000
Region Size:            00010000 (  64.000 kB)
State:                  00001000          MEM_COMMIT
Protect:                00000004          PAGE_READWRITE
Type:                   00020000          MEM_PRIVATE
Allocation Base:        002e0000
Allocation Protect:     00000004          PAGE_READWRITE
More info:              heap owning the address: !heap 0x2e0000
More info:              heap segment
More info:              heap entry containing the address: !heap -x 0x2eb048

0:000> !heap -x 0x002eb048
SEGMENT HEAP ERROR: failed to initialize the extention
Entry     User      Heap      Segment       Size  PrevSize  Unused    Flags
-----------------------------------------------------------------------------
002eb040  002eb048  002e0000  002e0000        58        c8        18  busy extra fill

std::unique_ptr

0:000> !address 0x18f9d0

Usage:                  Stack
Base Address:           0018d000
End Address:            00190000
Region Size:            00003000 (  12.000 kB)
State:                  00001000          MEM_COMMIT
Protect:                00000004          PAGE_READWRITE
Type:                   00020000          MEM_PRIVATE
Allocation Base:        00090000
Allocation Protect:     00000004          PAGE_READWRITE
More info:              ~0k

0:000> ~0k
 # ChildEBP RetAddr  
00 0018f9e0 00216f4c smartptr!main+0x198 smartptr.cpp @ 26 
01 (Inline) -------- smartptr!invoke_main+0x1c 
02 0018fa28 762ced6c smartptr!__scrt_common_main_seh+0xfa 
03 0018fa34 779b37eb kernel32!BaseThreadInitThunk+0xe
04 0018fa74 779b37be ntdll!__RtlUserThreadStart+0x70
05 0018fa8c 00000000 ntdll!_RtlUserThreadStart+0x1b

推荐阅读