5

It seems that Windows 8 broke Ollydbg as several ntdll functions keep throwing exception 0xC0000008 and crashing my debugger.

I am now using Windbg. But, I am unable to view FS (specifically FS:[0]). How can I get a dump of FS via Windbg? I've tried googling to no avail. I am specifically interested in SEH, but all I can find is dumping TEB or PEB.

Improve this question
2
  • 0xc0000008 is triggered by a call to CloseHandle() with an invalid handle value, while a debugger is present. It is not a fatal exception, and is a common anti-debugging trick. Why do you think that Windows 8 is responsible?
    – peter ferrie
    Jul 17, 2014 at 15:49
  • Debugging the same app under Windows 7 with the same debugger does not cause any problems. I figured it was something with the OS.
    – Jason
    Jul 18, 2014 at 7:55

3 Answers 3

Reset to default
7

SEH chain can be viewed in WinDbg by issuing !exchain command.

0:000> !exchain    # display the SEH chain
0012ffb0: wireshark!_except_handler4+0 (00522555)
0012ffe0: kernel32!_except_handler3+0 (7c839ac0)
  CRT scope  0, filter: kernel32!BaseProcessStart+29 (7c843882)
                func:   kernel32!BaseProcessStart+3a (7c843898)
Invalid exception stack at ffffffff

FS:[0] is the pointer to the start of SEH chain. You can walk through the output produced by !exchain to find FS:[0]

Improve this answer
16

If you're looking to find the base address of a segment based on its selector, you can use dg<selector>; in this context you would use dg fs:

0:000> dg fs
                                  P Si Gr Pr Lo
Sel    Base     Limit     Type    l ze an es ng Flags
---- -------- -------- ---------- - -- -- -- -- --------
003B 7ffdf000 00000fff Data RW Ac 3 Bg By P  Nl 000004f3

You can see above that the Base of fs is 7ffdf000, so FS:[0] == [7ffdf000].

0:000> db 7ffdf000
7ffdf000  1c f7 1d 00 00 00 1e 00-00 f0 1c 00 00 00 00 00  ................
7ffdf010  00 1e 00 00 00 00 00 00-00 f0 fd 7f 00 00 00 00  ................
7ffdf020  0c 13 00 00 bc 0f 00 00-00 00 00 00 2c f0 fd 7f  ............,...
7ffdf030  00 a0 fd 7f 00 00 00 00-00 00 00 00 00 00 00 00  ................
7ffdf040  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
7ffdf050  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
7ffdf060  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
7ffdf070  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
Improve this answer
0

If your intersted in viewing SEH, consider using pydbg SEH unwinding for that kind of purposes.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.