Take the 2-minute tour ×
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

It seems that Windows 8 broke Ollydbg as several ntdll functions keep throwing exception 0xC0000008 and crashing my debugger.

I am now using Windbg. But, I am unable to view FS (specifically FS:[0]). How can I get a dump of FS via Windbg? I've tried googling to no avail. I am specifically interested in SEH, but all I can find is dumping TEB or PEB.

share|improve this question
    
0xc0000008 is triggered by a call to CloseHandle() with an invalid handle value, while a debugger is present. It is not a fatal exception, and is a common anti-debugging trick. Why do you think that Windows 8 is responsible? –  peter ferrie Jul 17 at 15:49
    
Debugging the same app under Windows 7 with the same debugger does not cause any problems. I figured it was something with the OS. –  Jason Jul 18 at 7:55
add comment

3 Answers 3

up vote 3 down vote accepted

SEH chain can be viewed in WinDbg by issuing !exchain command.

0:000> !exchain    # display the SEH chain
0012ffb0: wireshark!_except_handler4+0 (00522555)
0012ffe0: kernel32!_except_handler3+0 (7c839ac0)
  CRT scope  0, filter: kernel32!BaseProcessStart+29 (7c843882)
                func:   kernel32!BaseProcessStart+3a (7c843898)
Invalid exception stack at ffffffff

FS:[0] is the pointer to the start of SEH chain. You can walk through the output produced by !exchain to find FS:[0]

share|improve this answer
add comment

If you're looking to find the base address of a segment based on its selector, you can use dg<selector>; in this context you would use dg fs:

0:000> dg fs
                                  P Si Gr Pr Lo
Sel    Base     Limit     Type    l ze an es ng Flags
---- -------- -------- ---------- - -- -- -- -- --------
003B 7ffdf000 00000fff Data RW Ac 3 Bg By P  Nl 000004f3

You can see above that the Base of fs is 7ffdf000, so FS:[0] == [7ffdf000].

0:000> db 7ffdf000
7ffdf000  1c f7 1d 00 00 00 1e 00-00 f0 1c 00 00 00 00 00  ................
7ffdf010  00 1e 00 00 00 00 00 00-00 f0 fd 7f 00 00 00 00  ................
7ffdf020  0c 13 00 00 bc 0f 00 00-00 00 00 00 2c f0 fd 7f  ............,...
7ffdf030  00 a0 fd 7f 00 00 00 00-00 00 00 00 00 00 00 00  ................
7ffdf040  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
7ffdf050  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
7ffdf060  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
7ffdf070  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
share|improve this answer
add comment

If your intersted in viewing SEH, consider using pydbg SEH unwinding for that kind of purposes.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.