OpenRCE

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Monday, July 16 2007 10:13.01 CDT

Printer Friendly ...

Python + Microsoft Minidumps

Author: jms

# Views: 2062

As part of my humble PyFault library I have been looking into how to control the core dumps from a process inside of Windows. You know those nice little dialogs like "Hey you wanna send a bunch of useful information to our bug dev team?", the minidumps are the binary files that get submitted to Microsoft for analysis and "quality improvement".

However, sometimes getting the minidump is a pain in the butt, and its not a controlled process without the developer of the software actually writing the hooks, so I set out figuring out how to do this with a remote process. It turned out to be fairly trivial:

1) Write a DLL with a SetUnhandledExceptionFilter() call, to a callback routine.

2) The callback routine receives a pointer to _EXCEPTION_POINTERS which just contains a pointer to a EXCEPTION_RECORD and a pointer to a CONTEXT, which are both structs that get set when an unhandled exception occurs.

3) The dbghelp.dll library provides the interface to do a MiniDumpWriteDump call, which takes some basic thread and process information and writes the dump with the exception information:

http://msdn2.microsoft.com/en-us/library/ms680360.aspx

So once the DLL is injected, using PyFault you can test by using the:

pyfault.raise_accessv(pid)

And you will see a dump get created, load the dump into WinDbg or Visual Studio and you can see all of the information. My code snippet for testing looks like this:



from pyfault import *

import time



pid = 2176



injector = pyfault.pyfault()



injector.setup_minidump(pid)



time.sleep(2)

injector.raise_accessv(pid)

By default I just create a dumper.dmp in C:\ but this will be changed soon. I haven't publicly released this code yet in PyFault, but if anyone is wanting to test it out drop me a message.

There are 31,313 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
hi!	Jul/01
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit