悬挂指针 - 找出对象何时被创建

Question

我正在使用 windbg 调试软件 Use-After-Free 错误（无法访问源代码）。

哪里

An Object Created --(do something)--> Object Deleted  --(do something)--> Object Reference Re-used [App. CRASHHHH!!!]

使用 windbg 和 'PageHeap' 我可以很容易地找出该对象何时被释放 (!heap -p -a 0xXXXXXXX) 和重新使用。

我的问题是，有什么方法可以找出该对象的创建时间。

感谢

Answer 1

您可以采用的一个巧妙技巧是使用（好吧，也许是滥用）泄漏跟踪来保存分配堆栈跟踪并在调试器中查看它们。

由于您已经启用了页面堆，这应该很容易解释。

打开 gflags.exe（Windbg 附带）并更改进程图像文件的标志。
选中 Enable page heap 和 Create user mode stack trace database 的框，然后单击应用。
关闭并重新启动您的应用程序以使新设置生效。
附加 Windbg 和运行 !heap -p -a <allocation address you want the callstack of>

我运行它在 notepad.exe 堆栈中的堆分配之一上得到了这个：

0:000> !heap -p -a 00000261`1a43b6c8
    address 000002611a43b6c8 found in
    _DPH_HEAP_ROOT @ 26119821000
    in busy allocation (  DPH_HEAP_BLOCK:         UserAddr         UserSize -         VirtAddr         VirtSize)
                             26119847750:      2611a43b6c0              938 -      2611a43b000             2000
          COMDLG32!CFileOpenSave::`vftable'
    00007ffa890622c7 ntdll!RtlDebugAllocateHeap+0x0000000000000047
    00007ffa88ff79ce ntdll!RtlpAllocateHeap+0x00000000000000ee
    00007ffa88ff595f ntdll!RtlpAllocateHeapInternal+0x000000000000064f
    00007ffa884c0f38 COMDLG32!CFileOpenSave::s_CreateInstance+0x0000000000000088
    00007ffa884d6750 COMDLG32!`CommonPrintDialogTelemetry::Instance'::`2'::`dynamic atexit destructor for 'wrapper''+0x00000000000103c0
    00007ffa886ffee7 combase!CServerContextActivator::CreateInstance+0x0000000000000207 [d:\th\com\combase\objact\actvator.cxx @ 872]
    00007ffa8876c0b3 combase!ActivationPropertiesIn::DelegateCreateInstance+0x00000000000000e3 [d:\th\com\combase\actprops\actprops.cxx @ 1926]
    00007ffa88700687 combase!CApartmentActivator::CreateInstance+0x00000000000000c7 [d:\th\com\combase\objact\actvator.cxx @ 2168]
    00007ffa886ff3e9 combase!CProcessActivator::CCICallback+0x0000000000000079 [d:\th\com\combase\objact\actvator.cxx @ 1631]
    00007ffa886ff504 combase!CProcessActivator::AttemptActivation+0x0000000000000064 [d:\th\com\combase\objact\actvator.cxx @ 1518]
    00007ffa886ff5e0 combase!CProcessActivator::ActivateByContext+0x00000000000000b0 [d:\th\com\combase\objact\actvator.cxx @ 1364]
    00007ffa886ff900 combase!CProcessActivator::CreateInstance+0x0000000000000090 [d:\th\com\combase\objact\actvator.cxx @ 1262]
    00007ffa8876c104 combase!ActivationPropertiesIn::DelegateCreateInstance+0x0000000000000134 [d:\th\com\combase\actprops\actprops.cxx @ 1926]
    00007ffa8876929a combase!CClientContextActivator::CreateInstance+0x000000000000015a [d:\th\com\combase\objact\actvator.cxx @ 561]
    00007ffa8876c0c6 combase!ActivationPropertiesIn::DelegateCreateInstance+0x00000000000000f6 [d:\th\com\combase\actprops\actprops.cxx @ 1978]
    00007ffa88760c61 combase!ICoCreateInstanceEx+0x0000000000000c91 [d:\th\com\combase\objact\objact.cxx @ 1817]
    00007ffa8875fea7 combase!CComActivator::DoCreateInstance+0x0000000000000147 [d:\th\com\combase\objact\immact.hxx @ 376]
    00007ffa8875fd0c combase!CoCreateInstance+0x000000000000019c [d:\th\com\combase\objact\actapi.cxx @ 120]
    00007ff6d5321be8 notepad!InvokeOpenDialog+0x000000000000004c
    00007ff6d53225d7 notepad!NPCommand+0x00000000000003b7
    00007ff6d53238a9 notepad!NPWndProc+0x0000000000000509
    00007ffa88a41169 USER32!UserCallWinProcCheckWow+0x00000000000001f9
    00007ffa88a40c97 USER32!DispatchMessageWorker+0x00000000000001a7
    00007ff6d5323ba1 notepad!WinMain+0x0000000000000269
    00007ff6d53390b5 notepad!WinMainCRTStartup+0x00000000000001c5
    00007ffa866c8102 KERNEL32!BaseThreadInitThunk+0x0000000000000022
    00007ffa8902c2e4 ntdll!RtlUserThreadStart+0x0000000000000034

如果您没有获得堆栈跟踪，可以尝试增加堆栈回溯数据库的大小。

悬挂指针 - 找出对象何时被创建

Dangling Pointer - Find Out when The Object is being Created

debugging

reverse-engineering

windbg

dangling-pointer