OpenRCE_jms
November 24th, 2007, 18:50
As part of my humble PyFault library I have been looking into how to control the core dumps from a process inside of Windows. You know those nice little dialogs like "Hey you wanna send a bunch of useful information to our bug dev team?", the minidumps are the binary files that get submitted to Microsoft for analysis and "quality improvement".
However, sometimes getting the minidump is a pain in the butt, and its not a controlled process without the developer of the software actually writing the hooks, so I set out figuring out how to do this with a remote process. It turned out to be fairly trivial:
1) Write a DLL with a SetUnhandledExceptionFilter() call, to a callback routine.
2) The callback routine receives a pointer to _EXCEPTION_POINTERS which just contains a pointer to a EXCEPTION_RECORD and a pointer to a CONTEXT, which are both structs that get set when an unhandled exception occurs.
3) The dbghelp.dll library provides the interface to do a MiniDumpWriteDump call, which takes some basic thread and process information and writes the dump with the exception information:
http://msdn2.microsoft.com/en-us/library/ms680360.aspx
So once the DLL is injected, using PyFault you can test by using the:
And you will see a dump get created, load the dump into WinDbg or Visual Studio and you can see all of the information. My code snippet for testing looks like this:
By default I just create a dumper.dmp in C:\ but this will be changed soon. I haven't publicly released this code yet in PyFault, but if anyone is wanting to test it out drop me a message.
https://www.openrce.org/blog/view/817/Python_+_Microsoft_Minidumps
However, sometimes getting the minidump is a pain in the butt, and its not a controlled process without the developer of the software actually writing the hooks, so I set out figuring out how to do this with a remote process. It turned out to be fairly trivial:
1) Write a DLL with a SetUnhandledExceptionFilter() call, to a callback routine.
2) The callback routine receives a pointer to _EXCEPTION_POINTERS which just contains a pointer to a EXCEPTION_RECORD and a pointer to a CONTEXT, which are both structs that get set when an unhandled exception occurs.
3) The dbghelp.dll library provides the interface to do a MiniDumpWriteDump call, which takes some basic thread and process information and writes the dump with the exception information:
http://msdn2.microsoft.com/en-us/library/ms680360.aspx
So once the DLL is injected, using PyFault you can test by using the:
Code:
pyfault.raise_accessv(pid)
And you will see a dump get created, load the dump into WinDbg or Visual Studio and you can see all of the information. My code snippet for testing looks like this:
Code:
from pyfault import *
import time
pid = 2176
injector = pyfault.pyfault()
injector.setup_minidump(pid)
time.sleep(2)
injector.raise_accessv(pid)
By default I just create a dumper.dmp in C:\ but this will be changed soon. I haven't publicly released this code yet in PyFault, but if anyone is wanting to test it out drop me a message.
https://www.openrce.org/blog/view/817/Python_+_Microsoft_Minidumps