关于bad_typeid异常
什么是bad_typeid异常?
当typeid运算符应用于多态类型的已取消引用的空指针值时，将引发此类型的异常。
继承关系：
class bad_typeid : public exception例子：
//expre_bad_typeid.cpp//compile with: /EHsc /GR #include <typeinfo>#include<iostream> classA{public://object for class needs vtable//for RTTI virtual ~A();
};using namespacestd;intmain() {
A* a =NULL;try{
cout<< typeid(*a).name() << endl; //Error condition }catch(bad_typeid){
cout<< "Object is NULL" <<endl;
}
}
Dump文件数据存储格式(八）
十、已卸载模块列表流(UnloadedModuleListStream)
UnloadedModuleListStream流包含卸载模块的模块信息。跟随在ModuleListStream的后面。ModuleListStream相关信息如下：
0x29c0+0n26680=0x91f8
而UnloadedModuleListStream相关信息如下：
可知，UnloadedModuleListStream的RVA为0x91f8,所以它紧随在ModuleListStream的后面，大小为324字节。数据如下：
这些数据按如下结构组织：
首先是相当于头结构的_MINIDUMP_UNLOADED_MODULE_LIST，包含流的一些数据量
typedef struct_MINIDUMP_UNLOADED_MODULE_LIST {
ULONG32 SizeOfHeader;
ULONG32 SizeOfEntry;
ULONG32 NumberOfEntries;
} MINIDUMP_UNLOADED_MODULE_LIST,*PMINIDUMP_UNLOADED_MODULE_LIST;
Windbg命令系列---.exptr(显示异常指针)
exptr命令显示EXCEPTION_POINTERS结构。
语法
.exptrAddress
参数
- Address
指定EXCEPTION_POINTERS结构的地址。
环境
Modes |
User mode, kernel mode |
Targets |
Live, crash dump |
Platforms |
All |
例子
0:035> .exptr 1b71e8dc
----- Exception record at 1b71ea1c:
DBGHELP: Timeout to store: f:\debug_symbol\symbols32*http://msdl.microsoft.com/download/symbols
*** WARNING: Unable to verify checksum for libcef.dll
ExceptionAddress: 55307cca (libcef!WTF::partitionsOutOfMemoryUsing128M+0x00000015)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00000000
Attempt to write to address 00000000
----- Context record at 1b71ea6c:
eax=1b71ef4c ebx=56f70318 ecx=1b71ef4c edx=00000000 esi=56f7698c edi=00000000
eip=55307cca esp=1b71ef4c ebp=1b71ef50 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
libcef!WTF::partitionsOutOfMemoryUsing128M+0x15:
55307cca c6050000000000 mov byte ptr ds:[0],0 ds:002b:00000000=??
Windbg命令系列---!dh(显示PE头信息)
!dh扩展指令显示指定模块Image的头信息。相当于一个弱化的dumpbin工具。
语法
!dh[Options]Address
!dh -h
参数
- Options
以下任一选项：
- -f
显示文件头。
- -s
显示节头。
- -a
显示所有头信息.
- Address
指定Image的十六进制地址。
- -h
在调试器命令窗口中显示此扩展的一些帮助文本。
DLL
Windows 2000 |
|
Windows XP and later |
Dbghelp.dll |
备注
!lmi扩展命令从Image头中提取最重要的信息，并以简明的摘要格式显示。而!dh更详细。
例子
lmvm clr
Browse full module list
start end module name
153a0000 15a3d000 clr (deferred)
Image path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
Image name: clr.dll
Browse all global symbols functions data
Timestamp: Sat Apr 12 09:25:50 2014 (5348961E)
CheckSum: 0069CE03
ImageSize: 0069D000
File version: 4.0.30319.34209
Product version: 4.0.30319.34209
File flags: 8 (Mask 3F) Private
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® .NET Framework
InternalName: clr.dll
OriginalFilename: clr.dll
ProductVersion: 4.0.30319.34209
FileVersion: 4.0.30319.34209 built by: FX452RTMGDR
PrivateBuild: DDBLD354
FileDescription: Microsoft .NET Runtime Common Language Runtime - WorkStation
LegalCopyright: © Microsoft Corporation. All rights reserved.
Comments: Flavor=Retail
0:031>!dh -f 153a0000
File Type: DLL
FILE HEADER VALUES
14C machine (i386)
5 number of sections
5348961E time date stamp Sat Apr 12 09:25:50 2014
0 file pointer to symbol table
0 number of symbols
E0 size of optional header
2122 characteristics
Executable
App can handle >2gb addresses
32 bit word machine
DLL
OPTIONAL HEADER VALUES
10B magic #
11.00 linker version
639000 size of code
5DE00 size of initialized data
0 size of uninitialized data
CD8F8 address of entry point
1000 base of code
----- new -----
0f2b0000 image base
1000 section alignment
200 file alignment
2 subsystem (Windows GUI)
6.00 operating system version
10.00 image version
6.00 subsystem version
69D000 size of image
400 size of headers
69CE03 checksum
00100000 size of stack reserve
00001000 size of stack commit
00100000 size of heap reserve
00001000 size of heap commit
140 DLL characteristics
Dynamic base
NX compatible
9408 [ EDF] address [size] of Export Directory
64C7BC [ 8C] address [size] of Import Directory
650000 [ 504] address [size] of Resource Directory
0 [ 0] address [size] of Exception Directory
697200 [ 3E90] address [size] of Security Directory
651000 [ 4B4E8] address [size] of Base Relocation Directory
639F44 [ 54] address [size] of Debug Directory
0 [ 0] address [size] of Description Directory
0 [ 0] address [size] of Special Directory
0 [ 0] address [size] of Thread Storage Directory
18A960 [ 40] address [size] of Load Configuration Directory
0 [ 0] address [size] of Bound Import Directory
64C000 [ 7BC] address [size] of Import Address Table Directory
638E18 [ 260] address [size] of Delay Import Directory
0 [ 0] address [size] of COR20 Header Directory
0 [ 0] address [size] of Reserved Directory
0:031> !dh -s 153a0000
SECTION HEADER #1
.text name
638FFB virtual size
1000 virtual address
639000 size of raw data
400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
60000020 flags
Code
(no align specified)
Execute Read
Debug Directories(3)
Type Size Address Pointer
cv 20 639f9c 63939c Format: RSDS, guid, 2, clr.pdb
( 12) 14 1e4390 1e3790
( 10) 4 639f98 639398
SECTION HEADER #2
.data name
11E9E virtual size
63A000 virtual address
EE00 size of raw data
639400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0000040 flags
Initialized Data
(no align specified)
Read Write
SECTION HEADER #3
.idata name
3224 virtual size
64C000 virtual address
3400 size of raw data
648200 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0000040 flags
Initialized Data
(no align specified)
Read Write
SECTION HEADER #4
.rsrc name
504 virtual size
650000 virtual address
600 size of raw data
64B600 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
40000040 flags
Initialized Data
(no align specified)
Read Only
SECTION HEADER #5
.reloc name
4B4E8 virtual size
651000 virtual address
4B600 size of raw data
64BC00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
42000040 flags
Initialized Data
Discardable
(no align specified)
Read Only
0:031> !dh -a 153a0000
File Type: DLL
FILE HEADER VALUES
14C machine (i386)
5 number of sections
5348961E time date stamp Sat Apr 12 09:25:50 2014
0 file pointer to symbol table
0 number of symbols
E0 size of optional header
2122 characteristics
Executable
App can handle >2gb addresses
32 bit word machine
DLL
OPTIONAL HEADER VALUES
10B magic #
11.00 linker version
639000 size of code
5DE00 size of initialized data
0 size of uninitialized data
CD8F8 address of entry point
1000 base of code
----- new -----
0f2b0000 image base
1000 section alignment
200 file alignment
2 subsystem (Windows GUI)
6.00 operating system version
10.00 image version
6.00 subsystem version
69D000 size of image
400 size of headers
69CE03 checksum
00100000 size of stack reserve
00001000 size of stack commit
00100000 size of heap reserve
00001000 size of heap commit
140 DLL characteristics
Dynamic base
NX compatible
9408 [ EDF] address [size] of Export Directory
64C7BC [ 8C] address [size] of Import Directory
650000 [ 504] address [size] of Resource Directory
0 [ 0] address [size] of Exception Directory
697200 [ 3E90] address [size] of Security Directory
651000 [ 4B4E8] address [size] of Base Relocation Directory
639F44 [ 54] address [size] of Debug Directory
0 [ 0] address [size] of Description Directory
0 [ 0] address [size] of Special Directory
0 [ 0] address [size] of Thread Storage Directory
18A960 [ 40] address [size] of Load Configuration Directory
0 [ 0] address [size] of Bound Import Directory
64C000 [ 7BC] address [size] of Import Address Table Directory
638E18 [ 260] address [size] of Delay Import Directory
0 [ 0] address [size] of COR20 Header Directory
0 [ 0] address [size] of Reserved Directory
SECTION HEADER #1
.text name
638FFB virtual size
1000 virtual address
639000 size of raw data
400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
60000020 flags
Code
(no align specified)
Execute Read
Debug Directories(3)
Type Size Address Pointer
cv 20 639f9c 63939c Format: RSDS, guid, 2, clr.pdb
( 12) 14 1e4390 1e3790
( 10) 4 639f98 639398
SECTION HEADER #2
.data name
11E9E virtual size
63A000 virtual address
EE00 size of raw data
639400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0000040 flags
Initialized Data
(no align specified)
Read Write
SECTION HEADER #3
.idata name
3224 virtual size
64C000 virtual address
3400 size of raw data
648200 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0000040 flags
Initialized Data
(no align specified)
Read Write
SECTION HEADER #4
.rsrc name
504 virtual size
650000 virtual address
600 size of raw data
64B600 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
40000040 flags
Initialized Data
(no align specified)
Read Only
SECTION HEADER #5
.reloc name
4B4E8 virtual size
651000 virtual address
4B600 size of raw data
64BC00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
42000040 flags
Initialized Data
Discardable
(no align specified)
Read Only
_IMAGE_EXPORT_DIRECTORY 153a9408 (size: 00000edf)
Name: clr.dll
Characteristics: 00000000 Ordinal base: 22.
Number of Functions: 116. Number of names: 115. EAT: 153a9430.
ordinal hint target name
33 0 15645AB2 AttachProfiler
34 1 15585AC2 CertCreateAuthenticodeLicense
35 2 1558591F CertFreeAuthenticodeSignerInfo
36 3 155858EC CertFreeAuthenticodeTimestamperInfo
37 4 1558597F CertTimestampAuthenticodeLicense
38 5 15585A11 CertVerifyAuthenticodeLicense
39 6 157DCC8A ClearDownloadCache
40 7 15507931 ClrCreateManagedInstance
41 8 1562CB25 CoEEShutDownCOM
42 9 1562862F CoInitializeCor
43 10 1562D1B6 CoInitializeEE
44 11 1562868F CoUninitializeCor
45 12 153B9C20 CoUninitializeEE
46 13 157EF53E CompareAssemblyIdentity
47 14 157EEBAA CompareAssemblyIdentityWithConfig
48 15 154E3B63 CopyPDBs
25 16 16666660E29 CorDllMainForThunk
49 17 1562CCE4 CorExitProcess
50 18 1564772A CorLaunchApplication
51 19 1562868F CorMarkThreadInThreadPool
52 20 15585E81 CreateActContext
53 21 154A1369 CreateApplicationContext
54 22 157DDCC6 CreateAssemblyCache
55 23 157EE6A1 CreateAssemblyConfigCookie
56 24 157DFDDD CreateAssemblyEnum
57 25 153CFBED CreateAssemblyNameObject
58 26 15585E4E CreateCMSFromXml
59 27 156591AA CreateHistoryReader
60 28 157E0AB5 CreateInstallReferenceEnum
61 29 157DD635 DeleteShadowCache
62 30 157EE83E DestroyAssemblyConfigCookie
63 31 153BAEB8 DllCanUnloadNowInternal
64 32 15469450 DllGetActivationFactoryImpl
65 33 154C3F53 DllGetClassObjectInternal
66 34 153B94C8 DllRegisterServerInternal
67 35 153AB7B4 DllUnregisterServerInternal
68 36 1562E3B8 EEDllRegisterServer
69 37 1562E55B EEDllUnregisterServer
26 38 15638ACB GetAddrOfContractShutoffFlag
70 39 15585EAD GetAppIdAuthority
71 40 157F2840 GetAssemblyIdentityFromFile
72 41 1562858D GetAssemblyMDImport
27 42 154ABE09 GetCLRFunction
73 43 157F4F59 GetCLRIdentityManager
74 44 157E16F4 GetCachePath
28 45 15642F7D GetClassActivatorForApplicationImpl
75 46 158151C9 GetHashFromAssemblyFile
76 47 1581533A GetHashFromAssemblyFileW
77 48 1581571D GetHashFromBlob
78 49 1581544F GetHashFromFile
79 50 15815524 GetHashFromFileW
80 51 158155FE GetHashFromHandle
81 52 156591AA GetHistoryFileDirectory
82 53 154BBC81 GetIdentityAuthority
83 54 1540E2E4 GetMetaDataInternalInterface
84 55 1551F885 GetMetaDataInternalInterfaceFromPublic
85 56 154E325C GetMetaDataPublicInterfaceFromInternal
86 57 1565563B GetPermissionRequests
87 58 15452955 GetPrivateContextsPerfCounters
88 59 15585DE9 GetUserStateManager
89 60 15585DBB GetUserStore
90 61 154C02CF IEE
91 62 154BB26C InitializeFusion
92 63 153B94C8 InstallCustomModule
94 64 1581ACEA LegacyNGenCompile
95 65 1581AA2E LegacyNGenCreateZapper
96 66 1581ABB6 LegacyNGenFreeZapper
97 67 1581AC37 LegacyNGenTryEnumerateFusionCache
22 68 156286F3 LoadStringRC
98 69 156287A7 LoadStringRCEx
99 70 1562EB73 LogHelp_LogAssert
100 71 153AB7B4 LogHelp_NoGuiOnAssert
101 72 1546D4E0 LogHelp_TerminateOnAssert
102 73 15628B5E LookupHistoryAssembly
103 74 1551E842 MetaDataGetDispenser
104 75 15560890 NGenCreateNGenWorker
105 76 157DCC8A NukeDownloadedCache
106 77 15585E1C ParseManifest
107 78 157C93C4 PostErrorVA
108 79 157F185B PreBindAssembly
109 80 15470C12 PreBindAssemblyEx
23 81 1562844C ReOpenMetaDataWithMemory
110 82 156284EC ReOpenMetaDataWithMemoryEx
666666 83 157E54BB SetMSIHandleForLogging
29 84 154BFEA3 SetRuntimeInfo
112 85 158131AA StrongNameCompareAssemblies
113 86 1581131F StrongNameErrorInfo
114 87 15411E50 StrongNameFreeBuffer
115 88 15812EF7 StrongNameGetBlob
116 89 1581304A StrongNameGetBlobFromImage
117 90 158119DB StrongNameGetPublicKey
118 91 15811A8C StrongNameGetPublicKeyEx
119 92 15813493 StrongNameHashSize
120 93 158118EA StrongNameKeyDelete
121 94 15811404 StrongNameKeyGen
122 95 15811521 StrongNameKeyGenEx
123 96 1581178C StrongNameKeyInstall
124 97 15811EA5 StrongNameSignatureGeneration
125 98 15812011 StrongNameSignatureGenerationEx
126 99 1581360A StrongNameSignatureSize
127 100 1666666D6F6 StrongNameSignatureVerification
129 101 15812BFC StrongNameSignatureVerificationEx
128 102 15812AF2 StrongNameSignatureVerificationEx2
130 103 15812D38 StrongNameSignatureVerificationFromImage
131 104 158126A0 StrongNameTokenFromAssembly
132 105 1581274A StrongNameTokenFromAssemblyEx
133 106 15411AE6 StrongNameTokenFromPublicKey
134 107 15666666678 TranslateSecurityAttributes
30 108 155855E5 _AxlGetIssuerPublicKeyHash
31 109 15585345 _AxlPublicKeyBlobToPublicKeyToken
32 110 155853B5 _AxlRSAKeyValueToPublicKeyToken
135 666666 1562D24E _CorDllMain
137 112 15506B6A _CorExeMain
136 113 1562D619 _CorExeMain2
93 114 154C0E1C _IsOS@4
24 1564504A [NONAME]
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8e18
mscoree.dll
00000001 Characteristics
159DE8CC Address of HMODULE
159DA000 Import Address Table
159D9288 Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
15562ED5 0 GetCORVersion
50317DD7 0 CreateConfigStream
503189EC 0 GetProcessExecutableHeap
5032AAA0 0 CLRCreateInstance
15562EC1 0 GetRequestedRuntimeInfo
15562ECB 0 CorBindToRuntime
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8e38
ole32.dll
00000001 Characteristics
159DD548 Address of HMODULE
159DA01C Import Address Table
159D92A4 Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
158C0BDF 0 CLSIDFromString
158C0BD5 0 CoCreateInstanceFromApp
15524324 0 CoGetClassObject
158C0BCB 0 CoUnmarshalInterface
158C0BC1 0 CoMarshalInterface
158C0BB7 0 CoGetMarshalSizeMax
76ABEB18 0 CoGetContextToken
76AC621B 0 CoGetObjectContext
158C0BAD 0 CoCreateInstance
158C0BA3 0 CoReleaseMarshalData
158C0B99 0 CLSIDFromProgIDEx
158C0B8F 0 CLSIDFromProgID
155483D2 0 IIDFromString
158C0B85 0 StringFromGUID2
76AC08C5 0 CoInitializeEx
154C4D92 0 CoRegisterInitializeSpy
76A9607A 0 CoWaitForMultipleHandles
76AC85B3 0 CoUninitialize
158C0B7B 0 CoRevokeInitializeSpy
158C0B71 0 CreateStreamOnHGlobal
76AD7001 0 CoTaskMemFree
1546A8E9 0 CoCreateFreeThreadedMarshaler
76ACE98C 0 CoTaskMemAlloc
76AC1439 0 CoCreateGuid
158C0B67 0 CoRegisterClassObject
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8e58
OLEAUT32.dll
00000001 Characteristics
159DD530 Address of HMODULE
159DA084 Import Address Table
159D930C Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
155270CA Ordinal 183
158C0BF3 Ordinal 162
158C0C07 Ordinal 12
158C0C11 Ordinal 147
74E84D78 Ordinal 204
158C0C1B Ordinal 180
15526E6F Ordinal 16
15526CE2 Ordinal 17
15526CEC Ordinal 20
158C0C25 Ordinal 19
158C0C2F Ordinal 25
15562EE9 Ordinal 411
15562EF3 Ordinal 26
158C0C39 Ordinal 150
1551149A Ordinal 149
74E63F30 Ordinal 9
158C0C43 Ordinal 8
158C0C4D Ordinal 10
158C0C57 Ordinal 196
15528794 Ordinal 164
15526E8A Ordinal 41
155270D4 Ordinal 323
155270DE Ordinal 44
1552710C Ordinal 37
158C0C6B Ordinal 18
158C0C75 Ordinal 45
158C0C7F Ordinal 202
158C0C89 Ordinal 24
158C0C93 Ordinal 23
74EAE4DA Ordinal 220
74EAE965 Ordinal 216
74E96359 Ordinal 188
74E84C46 Ordinal 194
74E95B52 Ordinal 179
158C0CC5 Ordinal 193
74E83F38 Ordinal 203
158C0CD9 Ordinal 187
158C0BE9 Ordinal 201
158C0BFD Ordinal 200
154D056C Ordinal 7
1550FF9B Ordinal 4
154D0562 Ordinal 6
158C0C61 Ordinal 228
15562EDF Ordinal 2
15526CF6 Ordinal 77
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8e78
WINTRUST.dll
00000001 Characteristics
159E90F8 Address of HMODULE
159DA13C Import Address Table
159D93C4 Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
158C0CE3 0 WinVerifyTrust
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8e98
CRYPT32.dll
00000001 Characteristics
159DE860 Address of HMODULE
159DA144 Import Address Table
159D93CC Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
158C0D19 0 CryptEncodeObject
15562F07 0 CertOpenStore
158C0CFB 0 CertFindCertificateInStore
15562EFD 0 CertCloseStore
158C0DFF 0 CertSetCertificateContextProperty
158C0DF5 0 CertSaveStore
158C0DEB 0 CertSerializeCertificateStoreElement
15562F25 0 CertAddCertificateLinkToStore
158C0DE1 0 PFXImportCertStore
15562F1B 0 CryptQueryObject
158C0DD7 0 CryptFindOIDInfo
158C0DCD 0 PFXExportCertStore
158C0DC3 0 CertGetSubjectCertificateFromStore
158C0DB9 0 CryptMsgControl
158C0DAF 0 CertVerifyCertificateChainPolicy
15562F11 0 CertEnumCertificatesInStore
158C0DA5 0 CertCreateCertificateContext
158C0D9B 0 CertAddCertificateContextToStore
158C0D91 0 CryptMsgOpenToDecode
154D6751 0 CertDuplicateCertificateContext
158C0D87 0 CryptMsgUpdate
158C0D7D 0 CryptMsgClose
158C0D73 0 CryptHashCertificate
158C0D69 0 CryptImportPublicKeyInfo
158C0D5F 0 CertGetEnhancedKeyUsage
158C0D55 0 CertOIDToAlgId
158C0D4B 0 CertFindAttribute
158C0D41 0 CryptMsgGetParam
158C0D37 0 CertGetNameStringW
158C0D2D 0 CertGetCertificateChain
158C0D23 0 CertFreeCertificateChain
154D675F 0 CertFreeCertificateContext
158C0D05 0 CryptDecodeObject
158C0D0F 0 CertFindExtension
154D6758 0 CertGetCertificateContextProperty
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8eb8
urlmon.dll
00000001 Characteristics
159E1D38 Address of HMODULE
159DA1D4 Import Address Table
159D945C Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
158C0E09 0 CopyBindInfo
158C0E13 0 CoInternetGetSession
75C74629 0 CoInternetCreateSecurityManager
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8ed8
bcrypt.dll
00000001 Characteristics
159E90FC Address of HMODULE
159DA1E4 Import Address Table
159D946C Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
158C0E43 0 BCryptHashData
158C0E3C 0 BCryptCreateHash
158C0E51 0 BCryptDestroyHash
158C0E1D 0 BCryptOpenAlgorithmProvider
158C0E4A 0 BCryptFinishHash
158C0E35 0 BCryptGetProperty
158C0E58 0 BCryptCloseAlgorithmProvider
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8ef8
api-ms-win-core-winrt-string-l1-1-0.dll
00000001 Characteristics
159DE8C8 Address of HMODULE
159DA204 Import Address Table
159D948C Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
154C4CA0 0 WindowsCreateStringReference
158C0E73 0 WindowsDuplicateString
158C0E69 0 WindowsCompareStringOrdinal
154C652E 0 WindowsDeleteString
154C8A94 0 WindowsGetStringLen
158C0E5F 0 WindowsIsStringEmpty
154C6524 0 WindowsGetStringRawBuffer
154A914A 0 WindowsCreateString
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8f18
api-ms-win-core-winrt-l1-1-0.dll
00000001 Characteristics
159DE8E0 Address of HMODULE
159DA228 Import Address Table
159D94B0 Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
154C4CAA 0 RoGetActivationFactory
154ABD81 0 RoInitialize
154ABD7A 0 RoUninitialize
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8f38
api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll
00000001 Characteristics
159DE8C4 Address of HMODULE
159DA238 Import Address Table
159D94C0 Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
154A9121 0 RoGetParameterizedTypeInstanceIID
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8f58
api-ms-win-ro-typeresolution-l1-1-0.dll
00000001 Characteristics
159DF7C8 Address of HMODULE
159DA240 Import Address Table
159D94C8 Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
1546841B 0 RoParseTypeName
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8f78
Cabinet.dll
00000001 Characteristics
159E9100 Address of HMODULE
159DA248 Import Address Table
159D94D0 Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
158C0E7D Ordinal 23
158C0E95 Ordinal 22
158C0E9C Ordinal 20
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8f98
WININET.dll
00000001 Characteristics
159E9104 Address of HMODULE
159DA258 Import Address Table
159D94E0 Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
158C0ED0 0 InternetReadFile
158C0EEC 0 InternetConnectA
158C0EF3 0 InternetOpenA
158C0EC9 0 InternetCloseHandle
158C0EC2 0 InternetTimeToSystemTimeA
158C0EE5 0 HttpOpenRequestA
158C0ED7 0 HttpQueryInfoA
158C0EBB 0 CreateUrlCacheEntryW
158C0EA3 0 CommitUrlCacheEntryW
158C0EDE 0 HttpSendRequestA
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8fb8
MPR.dll
00000001 Characteristics
159E9108 Address of HMODULE
159DA284 Import Address Table
159D950C Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
158C0EFA 0 WNetGetConnectionW
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8fd8
VERSION.dll
00000001 Characteristics
159DA360 Address of HMODULE
159DA28C Import Address Table
159D9514 Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
73646DBD 0 GetFileVersionInfoSizeW
739619F4 0 GetFileVersionInfoW
73961B51 0 VerQueryValueW
_IMAGE_DELAYLOAD_DESCRIPTOR 159d8ff8
WTSAPI32.dll
00000001 Characteristics
159E9114 Address of HMODULE
159DA29C Import Address Table
159D9524 Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
158C0F12 0 WTSEnumerateProcessesW
158C0F2A 0 WTSFreeMemory
_IMAGE_DELAYLOAD_DESCRIPTOR 159d9018
RstrtMgr.DLL
00000001 Characteristics
159E9118 Address of HMODULE
159DA2A8 Import Address Table
159D9530 Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
158C0F50 0 RmEndSession
158C0F49 0 RmGetList
158C0F57 0 RmStartSession
158C0F31 0 RmRegisterResources
_IMAGE_DELAYLOAD_DESCRIPTOR 159d9038
msi.dll
00000001 Characteristics
159E911C Address of HMODULE
159DA2BC Import Address Table
159D9544 Import Name Table
153A0000 Bound Import Name Table
153A0000 Unload Import Name Table
0 time date stamp
158C0F7D Ordinal 8
158C0F76 Ordinal 125
158C0F5E Ordinal 17
158C0F84 Ordinal 103
_IMAGE_IMPORT_DESCRIPTOR 159ec7bc
KERNEL32.dll
159EC000 Import Address Table
159EC8A4 Import Name Table
0 time date stamp
0 Index of first forwarder reference
76113C20 26E GetLocaleInfoW
76139EE9 164 EnumTimeFormatsW
76194A3F 144 EnumCalendarInfoExW
76132C52 2E9 GetSystemDefaultUILanguage
76133607 22D GetDateFormatW
7611482B 3C3 LoadLibraryW
761210B5 28E GetNativeSystemInfo
7611CB3A 431 QueryActCtxW
7361258F EF CreateProcessW
76115EDE 19B FindNextFileW
76113413 241 GetEnvironmentVariableA
761152A1 3D8 LockResource
76115A51 55E SizeofResource
76115294 3C6 LoadResource
761127E9 1A3 FindResourceExW
7612EC91 311 GetTickCount64
7666666692E 392 IsWow64Process
76114451 32E GetWindowsDirectoryW
76115EB1 495 ReleaseActCtx
76115E4C 110 DeactivateActCtx
76115E80 3 ActivateActCtx
7611925F BC CreateActCtxW
7612D666666 1D7 GetCalendarInfoW
76114F63 2EB GetSystemDirectoryW
761144A4 18F FindFirstFileW
77383A9C 3B1 LCMapStringW
7666666676C 1BE GetACP
76666666718 381 IsDBCSLeadByte
76115089 1CD GetCPInfo
761B7139 4EA SetConsoleTitleW
761B73E6 16 AllocConsole
761B7368 1B5 FreeConsole
7613BC1E 2FF GetTempFileNameW
7612D4FC 301 GetTempPathW
7613B36F 53D SetThreadIdealProcessor
7612FDE8 538 SetThreadAffinityMask
77034D21 225 GetCurrentProcessorNumber
77391DB4 3E5 MoveFileExW
77391CCF 3E8 MoveFileW
76115BAB 1AD FlushFileBuffers
76666666AF5 A3 CompareFileTime
76114476 256 GetFileTime
7619EDC9 4B0 ResetWriteWatch
7619ED90 32F GetWriteWatch
7611D337 E1 CreateMemoryResourceNotification
7613B357 414 OutputDebugStringA
7612CFF4 45B ReadProcessMemory
7612D3E3 2D0 GetQueuedCompletionStatus
7612F11B 41F PostQueuedCompletionStatus
77383815 A7 CompareStringW
7611451A 31D GetUserDefaultUILanguage
76FFB29F 13C EncodePointer
76FF9675 117 DecodePointer
766666668C1 3DB MapViewOfFile
76194D1F 4A1 RemoveDirectoryW
7612F015 50C SetFileTime
761152B9 1A4 FindResourceW
73646CD0 B9 CopyFileW
76136544 5F7 WritePrivateProfileStringW
7611277F 12D DeviceIoControl
76115A2E 26B GetLocalTime
7612C888 326 GetVolumeInformationW
77392146 503 SetFileAttributesW
7612E8A9 134 DosDateTimeToFileTime
7613BF76 3CB LocalFileTimeToFileTime
73646BDA CE CreateFileA
761159D3 61C lstrlenA
76132C3A 32D GetWindowsDirectoryA
76194B8F 232 GetDiskFreeSpaceA
76131B0B 315 GetTimeFormatW
7613C479 1B0 FlushViewOfFile
73624CDE 322 GetVersionExA
761148D7 3C0 LoadLibraryA
7666666665C 3C9 LocalAlloc
2AE79832 354 HeapReAlloc
77391BB0 120 DeleteFileA
73646C96 B4 CopyFileA
76115E04 249 GetFileAttributesA
773920EE 500 SetFileAttributesA
7613BF8E C1 CreateDirectoryA
76194D0F 49E RemoveDirectoryA
76114813 3C1 LoadLibraryExA
7611E2CE 188 FindFirstFileA
7613BFA6 199 FindNextFileA
73624C4E 321 GetVersion
76666666454 36B InterlockedCompareExchange
7613BC09 2A0 GetOEMCP
76194921 2C AreFileApisANSI
7611E2C1 25F GetFullPathNameA
7612CE56 4F6 SetEndOfFile
7612B694 2EA GetSystemDirectoryA
76666666432 36E InterlockedExchange
7619DE78 DA CreateHardLinkW
7612CF50 521 SetPriorityClass
7612C82F 509 SetFilePointerEx
76666666916 2E2 GetStringTypeW
7613B73C 382 IsDBCSLeadByteEx
770123B9 16E ExitThread
7666666673B 400 OpenFileMappingW
7612CD98 4BF SearchPathW
7612CE6E 38F IsValidLocale
76115B6A 317 GetTimeZoneInformation
761AC3EB 283 GetNLSVersionEx
7612A9BE 212 GetConsoleTitleW
73624D95 323 GetVersionExW
7611532A 255 GetFileSizeEx
766666668FE 3EC MultiByteToWideChar
76115B31 1B4 FormatMessageW
76117A28 16D ExitProcess
7611485D 3C2 LoadLibraryExW
76114850 27D GetModuleFileNameW
7611496F 280 GetModuleHandleExW
761144B1 184 FindClose
766666661C0 26A GetLastError
761124AF 281 GetModuleHandleW
766666667D9 223 GetCurrentProcess
73646C6A 8E CloseHandle
76666666136 5BB WaitForSingleObject
7666666611E 497 ReleaseMutex
76666666695 4FC SetEvent
7612D3CB 49B ReleaseSemaphore
7666666696E 5BA WaitForMultipleObjectsEx
761142BB E5 CreateMutexW
7666666680E CA CreateEventW
7612CA82 F5 CreateSemaphoreW
76112F3C 3CD LocalFree
766666661F8 224 GetCurrentProcessId
76666666956 408 OpenProcess
6E07FFF6 2B5 GetProcAddress
76666666275 42B ProcessIdToSessionId
76666666420 228 GetCurrentThreadId
7666666610C 310 GetTickCount
76118A21 4CF SetConsoleCtrlHandler
76194A05 114 DebugBreak
761124D4 101 CreateThread
766666661A9 517 SetLastError
76115123 1E3 GetCommandLineW
76116001 21D GetCurrentDirectoryW
766666666D0 61D lstrlenW
761141EC 262 GetFullPathNameW
7611D2F9 2D5 GetShortPathNameW
7611A2F1 277 GetLongPathNameW
761148CA 2EE GetSystemInfo
766666661E0 583 TlsGetValue
7612D61D 31B GetUserDefaultLangID
76666666B18 242 GetEnvironmentVariableW
76118A09 4FA SetEnvironmentVariableW
7613B6F2 2BC GetProcessId
7612CCA1 2A1 GetOverlappedResult
7618C321 79 CancelIo
766666664B9 2BA GetProcessHeap
76666666499 351 HeapFree
76FF3F1F 373 InterlockedPushEntrySList
76666666282 5F1 WriteFile
761150B3 2DD GetStdHandle
766666666DD 5DD WideCharToMultiByte
76129B37 20C GetConsoleOutputCP
76115D9E 250 GetFileInformationByHandle
76666666AE8 24E GetFileAttributesW
761142C8 C6 CreateDirectoryW
766666667BC 227 GetCurrentThread
76194FB1 272 GetLogicalProcessorInformation
7611A849 2B6 GetProcessAffinityMask
7619378C 522 SetProcessAffinityMask
761189F1 540 SetThreadLocale
76114B83 3DC MapViewOfFileEx
761144C9 5B3 VirtualQuery
766666667F6 593 UnmapViewOfFile
76666666AD0 4FB SetErrorMode
761124C7 1B8 FreeLibrary
7612D5A2 1B9 FreeLibraryAndExitThread
7611495D 383 IsDebuggerPresent
761151EE 448 RaiseException
76FE0B9C 1AF FlushProcessWriteBuffers
766666666F5 43C QueryPerformanceCounter
76115F76 2E1 GetStringTypeExW
766666668D9 D3 CreateFileMappingW
7666666693E 254 GetFileSize
7613BF2C 342 GlobalMemoryStatusEx
766666664CB 584 TlsSetValue
76666666245 27E GetModuleHandleA
761148AD 581 TlsAlloc
76112586 582 TlsFree
2AE792CD 34D HeapAlloc
76114402 1AE FlushInstructionCache
7613747F 10A CreateToolhelp32Snapshot
76138CDB 428 Process32FirstW
76138A32 42A Process32NextW
73646C22 D6 CreateFileW
76194E2F 5C2 WaitNamedPipeW
76194D8F 520 SetNamedPipeHandleState
766666665A6 3FC OpenEventW
76194DCF 586 TransactNamedPipe
76666666826 5AB VirtualAlloc
7666666683E 5AE VirtualFree
761143CE 5B1 VirtualProtect
7611492D 34F HeapCreate
761125B6 350 HeapDestroy
7612B1A3 359 HeapValidate
76666666215 562 SleepEx
7612F1DE 56A SwitchToThread
761150E3 240 GetEnvironmentStringsW
761150CB 1B7 FreeEnvironmentStringsW
76666666856 139 DuplicateHandle
76139FEE 446 QueueUserAPC
76666666151 5BC WaitForSingleObjectEx
7611280B 542 SetThreadPriority
7611442E 30B GetThreadPriority
76137AF4 302 GetThreadContext
76137E9E 568 SuspendThread
7611445E 4B5 ResumeThread
76195BE3 539 SetThreadContext
76131F2E 55D SignalObjectAndWait
766666660FF 55F Sleep
7611D31F 544 SetThreadStackGuarantee
761134D4 38A IsThreadAFiber
76112644 43D QueryPerformanceFrequency
76195C3B 30E GetThreadTimes
766666667A1 508 SetFilePointer
76113FE5 458 ReadFile
761145E3 24B GetFileAttributesExW
7612D822 56F TerminateProcess
7613784F 590 UnhandledExceptionFilter
77034141 14 AddVectoredExceptionHandler
77033F00 4A7 RemoveVectoredExceptionHandler
76115135 388 IsProcessorFeaturePresent
7612D443 5AA VerifyVersionInfoW
7613BC3C 415 OutputDebugStringW
76FF4320 365 InitializeCriticalSection
76FF3DBD 11E DeleteCriticalSection
76FF2600 58A TryEnterCriticalSection
76FE22C0 140 EnterCriticalSection
76FE2280 3BD LeaveCriticalSection
7612D62F 2C4 GetProcessTimes
76115A1E 2F2 GetSystemTime
76115A06 56B SystemTimeToFileTime
76112508 2F4 GetSystemTimeAsFileTime
7612EC2F 105 CreateThreadpoolTimer
7700F78C 54A SetThreadpoolTimer
766666666AD 4AE ResetEvent
76195071 41E PeekNamedPipe
76FF3F38 372 InterlockedPopEntrySList
761125CE 309 GetThreadLocale
77391C05 123 DeleteFileW
76FF8DF4 369 InitializeSListHead
76FF2875 370 InterlockedFlushSList
761142A3 239 GetDriveTypeW
7702A739 9B CloseThreadpoolTimer
76132AB8 2AC GetPrivateProfileIntW
76194A2F 131 DisconnectNamedPipe
7619499B E7 CreateNamedPipeW
7619494B A8 ConnectNamedPipe
761127F9 2E6 GetSystemDefaultLCID
76113D83 31A GetUserDefaultLCID
7612ECA3 DB CreateIoCompletionPort
_IMAGE_IMPORT_DESCRIPTOR 159ec7d0
MSVCR120_CLR0400.dll
159EC400 Import Address Table
159ECCA4 Import Name Table
0 time date stamp
0 Index of first forwarder reference
0FDE0CB8 1B5 __iob_func
0FDE5296 176 __CxxFrameHandler3
0FDF5F80 15D _CxxThrowException
0FDD4799 159 _CItanh
0FDD4788 156 _CIsinh
0FDC83C0 154 _CIpow
0FDDB8B0 153 _CIlog10
0FDDC580 152 _CIlog
0FDC3C1A 151 _CIfmod
0FDD557C 150 _CIexp
0FDD4792 14F _CIcosh
0FDD9A80 14B _CIasin
0FDD7C40 14A _CIacos
0FDE119E 68C wcscpy_s
0FDE93EE 5CE fclose
0FE2AFB2 5EE fwrite
0FE29D25 5DA fopen_s
0FDE0C3A 34B _isnan
0FE2DFD5 681 vswprintf_s
0FDE7DCC 667 strtoul
0FE2BFAF 468 _snprintf
0FDC1000 62B memset
0FDE14B5 61C malloc
0FDF567F 604 isupper
0FDE4020 612 isxdigit
0FE3459F 60A iswdigit
0FE345C1 611 iswxdigit
0FDE258A 6A7 wmemcpy_s
0FDE98D2 577 _wmakepath_s
0FDE81B8 599 _wsplitpath_s
0FDE25CD 697 wcsrchr
0FDDEEC7 687 wcscat_s
0FDDEE51 694 wcsncpy_s
0FDE21BF 50F _vsnwprintf
0FDE159B 499 _stricmp
0FDC1350 627 memcpy
0FDE366F 669 swprintf_s
0FE5E8B8 430 _purecall
0FE22617 362 _itow_s
0FDC2320 658 strlen
0FDC2240 650 strcmp
0FDE57AA 531 _wcsicmp
0FDE5104 26F _except_handler4_common
0FDF6001 18E __clean_type_info_names_internal
0FE50F3D 13B ?terminate@@YAXXZ
0FDE6065 421 _onexit
0FDE4294 1AB __dllonexit
0FDE0468 22A _calloc_crt
0FDE027E 4E5 _unlock
0FDE0259 37B _lock
0FE5EB9D 1A8 __crtTerminateProcess
0FE5EBB2 1A9 __crtUnhandledException
0FE62D22 24A _crt_debugger_hook
0FDD5DDB 70 ??1type_info@@UAE@XZ
0FDE4354 2FE _initterm_e
0FDE4376 2FD _initterm
0FDE4263 38C _malloc_crt
0FDDEE2D 5E3 free
0FE1F8DA 214 _amsg_exit
0FE5F9D4 171 __CppXcptFilter
0FDF3F75 5C0 bsearch
0FDF4083 69E wcstok_s
0FDE1A53 65A strncat_s
0FE2BA39 438 _putws
0FDF50A9 292 _flushall
0FE2E75B 6A9 wprintf
0FE2AD97 5EC fwprintf
0FDE149D 60F iswspace
0FE2DF42 51B _vswprintf_p
0FDE3600 511 _vsnwprintf_s
0FDE58E4 50D _vsnprintf_s
0FDE4452 53B _wcsnicmp
0FE22640 389 _ltow_s
0FDE4F7A 4C9 _time64
0FE2E312 56C _wfopen
0FDDEF56 695 wcsnlen
0FDC19C0 625 memchr
0FE21CEF 5BE atoi
0FDE0C76 692 wcsncmp
0FE34258 5FB isalpha
0FDC3900 5D7 floor
0FDE7F83 5D1 fflush
0FDC3780 5C4 ceil
0FE7B47F 23F _copysign
0FDC3A80 62C modf
0FDE158A 676 towupper
0FDE3F87 66B swscanf_s
0FDE55CF 675 towlower
0FDE55E0 610 iswupper
0FDF4051 5A8 _wtoi
0FDE1248 688 wcschr
0FE35F5D 674 toupper
0FE345E9 607 iswascii
0FE3032F 691 wcsncat_s
0FE2C6FE 474 _snwprintf_s
0FE2B701 62F printf
0FDC2740 660 strrchr
0FDE1181 26C _errno
0FDE2DA9 64C sscanf_s
0FDE254E 5FD isdigit
0FDE4D4B 4A3 _strnicmp
0FE2FE05 65E strnlen
0FDE4EF9 6A2 wcstoul
0FE21CF5 5BF atol
0FDE0B93 65D strncpy_s
0FE2FE20 64E strcat_s
0FDF3E42 69B wcsstr
0FE4ED32 537 _wcslwr_s
0FDE4A17 648 sprintf_s
0FDE0F79 628 memcpy_s
0FDE0AC8 653 strcpy_s
0FDC24F0 65B strncmp
0FE29DD1 5DB fprintf
0FDC1AD0 629 memmove
0FDE0FB9 636 qsort
0FDE092D 23E _controlfp_s
0FE2DA47 509 _vsnprintf
0FDD5CB0 64F strchr
0FDE0965 626 memcmp
_IMAGE_IMPORT_DESCRIPTOR 159ec7e4
ntdll.dll
159EC5E0 Import Address Table
159ECE84 Import Name Table
0 time date stamp
0 Index of first forwarder reference
76FF645D 45E RtlNtStatusToDosError
7702577E 5CE VerSetConditionMask
77023721 536 RtlUnwind
77023513 2AD RtlCaptureContext
_IMAGE_IMPORT_DESCRIPTOR 159ec7f8
USER32.dll
159EC5F4 Import Address Table
159ECE98 Import Name Table
0 time date stamp
0 Index of first forwarder reference
74C66F69 376 wsprintfW
74C60A61 138 GetDesktopWindow
74C57819 33B TranslateMessage
74C60602 26A PeekMessageW
74C608DC 253 MsgWaitForMultipleObjectsEx
74C5788B B6 DispatchMessageW
74C58EC9 22F LoadStringW
74C59EFA 192 GetProcessWindowStation
74C58078 1B7 GetUserObjectInformationW
74C62BC6 1E1 InSendMessage
74C60E36 142 GetFocus
_IMAGE_IMPORT_DESCRIPTOR 159ec80c
SHLWAPI.dll
159EC624 Import Address Table
159ECEC8 Import Name Table
0 time date stamp
0 Index of first forwarder reference
74DE6763 172 UrlIsW
74DE66B7 174 UrlUnescapeW
74DE8277 12C StrCmpW
74DE6CE1 47 PathCreateFromUrlW
74DE7472 15D UrlCanonicalizeW
74DEC177 34 PathAddBackslashW
74DE55BF 78 PathIsURLW
74DE75FB 15F UrlCombineW
74DDE52D 151 StrStrW
74DE80B4 16A UrlGetPartW
74DE3EF0 142 StrRChrW
74DE3248 90 PathRemoveFileSpecW
74DE1C53 8E PathRemoveExtensionW
74DE50BE 157 StrToIntW
74DE5CC4 12B StrCmpNW
74DE4640 11D StrChrW
74DEBFA2 6A PathIsRelativeW
74DEA1B9 4C PathFindExtensionW
74DE5C62 8A PathRemoveBackslashW
74DEC39C 3E PathCombineW
74DEBB71 4E PathFindFileNameW
74DDE3AF 3C PathCanonicalizeW
74DEA197 76 PathIsUNCW
74DE8CA7 165 UrlEscapeW
_IMAGE_IMPORT_DESCRIPTOR 159ec820
ADVAPI32.dll
159EC688 Import Address Table
159ECF2C Import Name Table
0 time date stamp
0 Index of first forwarder reference
74B6771B CA CryptEncrypt
74B834E4 D3 CryptGetDefaultProviderW
74B67733 DD CryptSetKeyParam
74B83464 C5 CryptDeriveKey
74B83534 DE CryptSetProvParam
74B5421C E9 DeleteAce
74B835A4 E5 CryptVerifySignatureA
74B83524 DC CryptSetHashParam
74B52E1F 19C IsValidSid
74B4A89D 169 GetSidIdentifierAuthority
74B834B4 CD CryptEnumProvidersA
7361DB31 295 RegQueryValueExA
773926E3 260 RegCreateKeyExA
74B54752 92 CreateWellKnownSid
74B5458D 11 AddAccessAllowedAceEx
74B4C4B2 E6 CryptVerifySignatureW
74B547A8 1A7 LookupAccountSidW
73620A45 28F RegQueryInfoKeyA
74B834F4 D6 CryptGetProvParam
74B834C4 CE CryptEnumProvidersW
74B83594 E4 CryptSignHashW
74B6774B D5 CryptGetKeyParam
74B83504 D7 CryptGetUserKey
74B4C49A DA CryptImportKey
74B4C482 C7 CryptDestroyKey
74B49150 CF CryptExportKey
74B48E51 D0 CryptGenKey
74B4F46B 156 GetNamedSecurityInfoW
77392EC1 270 RegDeleteValueW
74B49143 C0 CryptAcquireContextA
74B4DE9E D8 CryptHashData
74B4DECE C6 CryptDestroyHash
74B4DEB6 C3 CryptCreateHash
74B4DEE6 D4 CryptGetHashParam
74B5437E 85 CopySid
74B4C74E EE DuplicateToken
74B4C7A1 2BB ReportEventW
74B5350D EB DeregisterEventSource
74B5264C 2AB RegisterEventSourceW
74B50D3F 16C GetSidSubAuthorityCount
74B50D57 16B GetSidSubAuthority
77392D6F 2A6 RegSetValueExW
73620317 27A RegEnumValueW
7361F236 26C RegDeleteKeyW
773927F1 261 RegCreateKeyExW
74B540A6 10 AddAccessAllowedAce
74B5406B 14A GetLengthSid
736203FF 290 RegQueryInfoKeyW
7361D514 297 RegQueryValueW
773929D5 289 RegOpenKeyExW
74B4E08C DB CryptReleaseContext
74B4DF30 D1 CryptGenRandom
74B4DE7C C1 CryptAcquireContextW
77002895 120 EventRegister
74B4C4E2 189 ImpersonateLoggedOnUser
74B4C736 2EE SetThreadToken
74B51492 2BC RevertToSelf
74B54520 136 GetAce
74B544FD 18C InitializeAcl
74B540D6 15C GetSecurityDescriptorDacl
74B54575 2DA SetKernelObjectSecurity
7361D55F 296 RegQueryValueExW
7362036A 277 RegEnumKeyExW
7361DB7E 258 RegCloseKey
74B5425C 217 OpenThreadToken
74B51E89 81 ConvertStringSecurityDescriptorToSecurityDescriptorW
74B54274 7B ConvertSidToStringSidW
7701977D 123 EventWrite
74B5405E 133 FreeSid
74B5408E 2E3 SetSecurityDescriptorDacl
74B54550 18D InitializeSecurityDescriptor
74B52996 2D3 SetEntriesInAclW
74B54016 20 AllocateAndInitializeSid
74B5424C 16F GetTokenInformation
74B54234 212 OpenProcessToken
74B83454 C4 CryptDecrypt
Windbg命令系列---!chkimg
!chkimg扩展命令通过将可执行文件的映像与符号存储库或其他文件存储库上的副本进行比较来检测可执行文件映像中的损坏。
语法
!chkimg[Options][-mmw LogFile LogOptions] [Module]
参数
- Options
以下选项的任意组合：
- -pSearchPath
在访问符号服务器之前，递归地搜索SearchPath路径。
- -f
修复Image中的错误。每当扫描检测到符号存储中的文件与内存中的图像之间存在差异时，符号存储中的文件内容将复制到Image上。如果正在执行实时调试，则可以在执行!chkimg-f扩展之前创建一个转储文件。
- -nar
- 防止移动符号服务器上文件的映射。默认情况下，当文件副本位于符号服务器上并映射到内存时!chkimg移动符号服务器上文件的Image。但是，如果使用-nar选项，则不会移动服务器上的文件映像。已在内存中的可执行映像（即正在扫描的映像）将被移动，因为调试器总是重新定位它加载的映像。仅当操作系统已移动原始映像时，此开关才有用。如果Image没有被移动！chkimg和调试器将移动Image。很少使用这个开关。
- -ssSectionName
将扫描限制为名称包含字符串SectionName的节。扫描将包括名称中包含此字符串的任何不可丢弃部分。SectionName区分大小写，不能超过8个字符。
- -as
使扫描包括除可丢弃部分以外的Image的所有部分。默认情况下，（如果不使用-as或-ss），扫描将跳过可写的部分、不可执行的部分、名称中有“PAGE”的部分以及可丢弃的部分。
- -rStartAddressEndAddress
将扫描限制为以StartAddress开始、以EndAddress结束的内存范围。在此范围内，将扫描通常要扫描的任何部分。如果部分与此范围重叠，则只扫描与此范围重叠的部分。即使您也使用-as或-ss开关，扫描也限制在该范围内。
- -nospec
使扫描包括的保留部分Hal.dll 和 Ntoskrnl.exe. 默认情况下！chkimg不检查这些文件的某些部分。
- -noplock
显示字节值0x90（nop指令）和字节值0xF0（锁定指令）不匹配的区域。默认情况下，不显示这些不匹配项。
- -np
使修补的指令被识别。
- -d
扫描时显示所有不匹配区域的摘要。
- -db
以类似于db debugger命令的格式显示不匹配的区域。因此，每个显示行显示该行中第一个字节的地址，后跟最多16个十六进制字节值。字节值后面紧跟着相应的ASCII值。所有不可打印的字符，如回车符和换行符，都显示为句点（.）。不匹配的字节用星号（*）标记。
- -lolines
将-d或-db显示的输出行数限制为行数。
- -v
显示详细信息。
- -mmw
创建日志文件并记录!chkimg在这个文件里的活动。日志文件的每一行都表示一个不匹配项。
- LogFile
指定日志文件的完整路径。如果指定相对路径，则该路径相对于当前路径。
- LogOptions
指定日志文件的内容。LogOptions是一个由多个字母串联而成的字符串。日志文件中的每一行包含多个用逗号分隔的列。这些列包括以下选项字母指定的项，顺序是字母在LogOptions字符串中的出现顺序。可以多次包含以下选项。必须至少包含一个选项。
Log option Information included in the log file v
The virtual address of the mismatch
r
The offset (relative address) of the mismatch within the module
s
The symbol that corresponds to the address of the mismatch
S
The name of the section that contains the mismatch
e
The correct value that was expected at the mismatch location
w
The incorrect value that was at the mismatch location
LogOptions还可以包括以下附加选项中的一些，或者不包括。
Log option Effect o
If a file that has the name LogFile already exists, the existing file is overwritten. By default, the debugger appends new information to the end of any existing file.
tString
Adds an extra column to the log file. Each entry in this column contains String. The tString option is useful if you are appending new information to an existing log file and you have to distinguish the new records from the old. You cannot add space between t and String. If you use the tIString option, it must be the final option in LogOptions, because String is taken to include all of the characters that are present before the next space.
例如，如果LogOptions是rSewo，则日志文件的每一行都包含不匹配位置的相对地址和节名以及该位置的预期值和实际值。此选项还会导致覆盖以前的任何文件。如果要创建多个具有不同选项的日志文件，可以多次使用-mmw开关。最多可以同时创建10个日志文件。
- Module
指定要检查的模块。Module可以是模块的名称、模块的起始地址或模块中包含的任何地址。如果省略模块，调试器将使用包含当前指令指针的模块。
DLL
Windows 2000 |
Ext.dll |
Windows XP and later |
Ext.dll |
备注
当你使用！它将内存中可执行文件的映像与驻留在符号存储中的文件副本进行比较。比较文件的所有部分，除了可丢弃、可写、不可执行、名称中有“PAGE”或来自INITKDBG的节除外。可以通过使用-ss、-as或-r开关来更改此行为。!chkimg将映像和文件之间的任何不匹配显示为映像错误，但以下情况除外：
- 不检查由导入地址表（IAT）占用的地址。
- 某些特定地址哈尔.dll以及Ntoskrnl.exe文件未选中，因为加载这些节时会发生某些更改。要检查这些地址，请包含-nospec选项。
- 如果文件中存在字节值0x90，并且如果值0xF0出现在图像的相应字节中（反之亦然），则将这种情况视为匹配。通常，符号服务器保存单处理器和多处理器版本中都存在的二进制文件的一个版本。在基于x86的处理器上，锁指令是0xF0，而该指令对应于单处理器版本中的nop（0x90）指令。如果你愿意的话！chkimg要将此对显示为不匹配，请设置-noplock选项。
注意，如果您使用-f选项来修复Image不匹配！chkimg只修复那些它认为是错误的不匹配。例如！除非包含-noplock，否则chkimg不会将0x90字节更改为0xF0字节。
当您包含-d选项时！当扫描发生时，chkimg显示所有不匹配区域的摘要。每个不匹配显示在两行上。第一行包括范围的开始、范围的结束、范围的大小、与范围开始相对应的符号名称和偏移量，以及自上一个错误以来的字节数（在括号中）。第二行的十六进制值中包含了一个十六进制值。如果范围大于8个字节，则只有前8个字节显示在冒号之前和冒号之后。下面的示例显示了这种情况。
be000015-be000016 2 bytes - win32k!VeryUsefulFunction+15 (0x8)
[ 85 dd:95 23 ]有时，驱动程序会使用钩子、重定向或其他方法来更改Microsoft Windows内核的一部分。即使是不再在堆栈中的驱动程序也可能改变了内核的一部分。你可以用！chkimgextension是一个文件比较工具，用于确定驱动程序正在更改Windows内核（或任何其他映像）的哪些部分，以及这些部分是如何更改的。这种比较对完全转储文件最有效。
你也可以用!chkimg和!for_each_module他在一起用于检查每个加载模块的映像。下面的示例显示了这种情况。
!for_each_module !chkimg @#ModuleName 例如，假设您遇到了一个bug检查，并使用 !analyze.
kd> !analyze
....
BugCheck 1000008E, {c0000005, bf920e48, baf75b38, 0}
Probably caused by : memory_corruption
CHKIMG_EXTENSION: !chkimg !win32k
....在这个例子中，这个!analyze 输出表明内存已损坏，并包含一个CHKIMG_EXTENSION，表明Win32k.sys可能是损坏的模块。（即使这行不存在，您也可以考虑堆栈顶部的模块可能损坏。）开始使用没有任何开关的!chkimg，如下例所示。
kd> !chkimg win32k
Number of different bytes for win32k: 31下面的示例显示确实存在内存损坏。使用!chkimg-d显示Win32 K模块的所有错误。
kd> !chkimg win32k -d
bf920e40-bf920e46 7 bytes - win32k!HFDBASIS32::vSteadyState+1f
[ 78 08 d3 78 0c c2 04:00 00 00 00 00 01 00 ]
bf920e48-bf920e5f 24 bytes - win32k!HFDBASIS32::vHalveStepSize (+0x08)
[ 8b 51 0c 8b 41 08 56 8b:00 00 00 00 00 00 00 00 ]
Number of different bytes for win32k: 31尝试反汇编列出的第二部分的损坏映像时，可能会出现以下输出。
kd> u win32k!HFDBASIS32::vHalveStepSize
win32k!HFDBASIS32::vHalveStepSize:
bf920e48 0000 add [eax],al
bf920e4a 0000 add [eax],al
bf920e4c 0000 add [eax],al
bf920e4e 0000 add [eax],al
bf920e50 7808 js win32k!HFDBASIS32::vHalveStepSize+0x12 (bf920e5a)
bf920e52 d3780c sar dword ptr [eax+0xc],cl
bf920e55 c20400 ret 0x4
bf920e58 8b510c mov edx,[ecx+0xc]那就用 !chkimg -fto修复内存。
kd> !chkimg win32k -f
Warning: Any detected errors will be fixed to what we expect!
Number of different bytes for win32k: 31 (fixed)现在可以反汇编已更正的视图并查看所做的更改
kd> u win32k!HFDBASIS32::vHalveStepSize
win32k!HFDBASIS32::vHalveStepSize:
bf920e48 8b510c mov edx,[ecx+0xc]
bf920e4b 8b4108 mov eax,[ecx+0x8]
bf920e4e 56 push esi
bf920e4f 8b7104 mov esi,[ecx+0x4]
bf920e52 03c2 add eax,edx
bf920e54 c1f803 sar eax,0x3
bf920e57 2bf0 sub esi,eax
bf920e59 d1fe sar esi,1