5

It seems that Windows 8 broke Ollydbg as several ntdll functions keep throwing exception 0xC0000008 and crashing my debugger.

I am now using Windbg. But, I am unable to view FS (specifically FS:[0]). How can I get a dump of FS via Windbg? I've tried googling to no avail. I am specifically interested in SEH, but all I can find is dumping TEB or PEB.

  • 0xc0000008 is triggered by a call to CloseHandle() with an invalid handle value, while a debugger is present. It is not a fatal exception, and is a common anti-debugging trick. Why do you think that Windows 8 is responsible? – peter ferrie Jul 17 '14 at 15:49
  • Debugging the same app under Windows 7 with the same debugger does not cause any problems. I figured it was something with the OS. – Jason Jul 18 '14 at 7:55
7

SEH chain can be viewed in WinDbg by issuing !exchain command.

0:000> !exchain    # display the SEH chain
0012ffb0: wireshark!_except_handler4+0 (00522555)
0012ffe0: kernel32!_except_handler3+0 (7c839ac0)
  CRT scope  0, filter: kernel32!BaseProcessStart+29 (7c843882)
                func:   kernel32!BaseProcessStart+3a (7c843898)
Invalid exception stack at ffffffff

FS:[0] is the pointer to the start of SEH chain. You can walk through the output produced by !exchain to find FS:[0]

12

If you're looking to find the base address of a segment based on its selector, you can use dg<selector>; in this context you would use dg fs:

0:000> dg fs
                                  P Si Gr Pr Lo
Sel    Base     Limit     Type    l ze an es ng Flags
---- -------- -------- ---------- - -- -- -- -- --------
003B 7ffdf000 00000fff Data RW Ac 3 Bg By P  Nl 000004f3

You can see above that the Base of fs is 7ffdf000, so FS:[0] == [7ffdf000].

0:000> db 7ffdf000
7ffdf000  1c f7 1d 00 00 00 1e 00-00 f0 1c 00 00 00 00 00  ................
7ffdf010  00 1e 00 00 00 00 00 00-00 f0 fd 7f 00 00 00 00  ................
7ffdf020  0c 13 00 00 bc 0f 00 00-00 00 00 00 2c f0 fd 7f  ............,...
7ffdf030  00 a0 fd 7f 00 00 00 00-00 00 00 00 00 00 00 00  ................
7ffdf040  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
7ffdf050  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
7ffdf060  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
7ffdf070  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
0

If your intersted in viewing SEH, consider using pydbg SEH unwinding for that kind of purposes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.