0

Following a specific address, i can't see the content on that address because i am getting "??" on memory section, which isn't an issue because it's supposed to be an invalid address in the context where i am actually, more info about why i am getting "??" on https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/d--da--db--dc--dd--dd--df--dp--dq--du--dw--dw--dyb--dyd--display-memor#remarks

The issue starts when i am placing a write breakpoint on the address where i want get content, i place too read breakpoint out of the range of the first one(breakpoint) for not rewrite the breakpoint operation(for haven't conflict issues).

This both breakpoints are working on all contexts, which should hit at some point. After execute g command, it hits the read operation and loads the contents on the address where i was getting "??" as explained.

The purpose is know who is writing to this address.

The steps i am following for be on the context where the address i need with the mysterious origin content:

0: kd> bu /p ffffc90eed4a4080 fffff801`4e2be679
0: kd> bu /p ffffc90eed4a4080 fffff801`4e2bfe78
0: kd> bu /p ffffc90eed4a4080 fffff801`4e2bfff6
0: kd> bu /p ffffc90eeccf8080 fffff801`4e258041
0: kd> g
Breakpoint 0 hit
nt!AlpcpDispatchReplyToPort+0x2d1:
fffff801`4e2be679 e8f279f5ff      call    nt!AlpcpCompleteDispatchMessage (fffff801`4e216070)
3: kd> g
Breakpoint 1 hit
nt!AlpcpExposeViewAttributeInSenderContext+0xd8:
fffff801`4e2bfe78 e8b3000000      call    nt!AlpcpCreateView (fffff801`4e2bff30)
3: kd> g
Breakpoint 2 hit
nt!AlpcpCreateView+0xc6:
fffff801`4e2bfff6 4c8d4558        lea     r8,[rbp+58h]
3: kd> g
Breakpoint 3 hit
nt!MiFindEmptyAddressRange+0x141:
fffff801`4e258041 488908          mov     qword ptr [rax],rcx
3: kd> dc rcx
000001fc`8d0e0000  ???????? ???????? ???????? ????????  ????????????????
000001fc`8d0e0010  ???????? ???????? ???????? ????????  ????????????????
000001fc`8d0e0020  ???????? ???????? ???????? ????????  ????????????????
000001fc`8d0e0030  ???????? ???????? ???????? ????????  ????????????????
000001fc`8d0e0040  ???????? ???????? ???????? ????????  ????????????????
000001fc`8d0e0050  ???????? ???????? ???????? ????????  ????????????????
000001fc`8d0e0060  ???????? ???????? ???????? ????????  ????????????????
000001fc`8d0e0070  ???????? ???????? ???????? ????????  ????????????????

It's very well known that this address will have(or have) the content that i need. Placing both breakpoints:

3: kd> ba w 1 000001fc`8d0e0000+60
3: kd> ba r 1 000001fc`8d0e0000+80

Executing g command and getting the next:

3: kd> g
Breakpoint 5 hit
0033:00007fff`21258d61 4881c180000000  add     rcx,80h
2: kd> dc 000001fc`8d0e0000
000001fc`8d0e0000  00000001 00000000 0000000c 00000000  ................
000001fc`8d0e0010  00000000 00000001 00000000 00000000  ................
000001fc`8d0e0020  00000001 00000000 cd8e8b50 0000025c  ........P...\...
000001fc`8d0e0030  00000000 00000000 00000000 00000000  ................
000001fc`8d0e0040  00000000 00000001 00000000 00000000  ................
000001fc`8d0e0050  00001318 00000000 00000001 00001318  ................
000001fc`8d0e0060  72657355 72657355 50746457 00001300  UserUserWdtP....
000001fc`8d0e0070  00420058 0033004c 0030002e 00780020  X.B.L.3...0. .x.

Breakpoint list at this point:

2: kd> bl
     0 d Enable Clear  fffff801`4e2be679     0001 (0001) nt!AlpcpDispatchReplyToPort+0x2d1
     Match process data ffffc90e`ed4a4080
     1 d Enable Clear  fffff801`4e2bfe78     0001 (0001) nt!AlpcpExposeViewAttributeInSenderContext+0xd8
     Match process data ffffc90e`ed4a4080
     2 d Enable Clear  fffff801`4e2bfff6     0001 (0001) nt!AlpcpCreateView+0xc6
     Match process data ffffc90e`ed4a4080
     3 d Enable Clear  fffff801`4e258041     0001 (0001) nt!MiFindEmptyAddressRange+0x141
     Match process data ffffc90e`eccf8080
     4 e Disable Clear  000001fc`8d0e0060 w 1 0001 (0001) 
     5 e Disable Clear  000001fc`8d0e0080 r 1 0001 (0001) 

As theories i am having right now are, the content is written even before than fffff801`4e258041(i don't think so, but can be).

The breakpoints aren't set correctly in this scenario.

The !vtop extension not resolves on fffff801`4e258041 but does on 00007fff`21258d61, with memory content as "??".

2: kd> !vtop 11df6c000 000001fc8d0e0000
Amd64VtoP: Virt 000001fc8d0e0000, pagedir 000000011df6c000
Amd64VtoP: PML4E 000000011df6c018
Amd64VtoP: PDPE 000000013738af90
Amd64VtoP: PDE 000000020ad8b340
Amd64VtoP: PTE 00000002b1368700
Amd64VtoP: Mapped phys 0000000273b4f000
Virtual address 1fc8d0e0000 translates to physical address 273b4f000.
2: kd> dc 273b4f000
00000002`73b4f000  ???????? ???????? ???????? ????????  ????????????????
00000002`73b4f010  ???????? ???????? ???????? ????????  ????????????????
00000002`73b4f020  ???????? ???????? ???????? ????????  ????????????????
00000002`73b4f030  ???????? ???????? ???????? ????????  ????????????????
00000002`73b4f040  ???????? ???????? ???????? ????????  ????????????????
00000002`73b4f050  ???????? ???????? ???????? ????????  ????????????????
00000002`73b4f060  ???????? ???????? ???????? ????????  ????????????????
00000002`73b4f070  ???????? ???????? ???????? ????????  ????????????????

I was trying the !vtop extension for check if i place it(breakpoint) on the physical address directly, can avoid the issue i am having with write operation, but can't transalate it on the point where i want.

I tried .pagein on the address where i was on fffff801`4e258041(no success for get content), as possible cause the address is invalid as mentioned.

Thanks for take the time for read!

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.