I’m doing a Windows kernel dump analysis in Windbg and would like to write script that can find all occurrences of any threads call stacks from any processes that involve a specific driver module name, e.g. mydriver.sys.
It would be great if anyone can provide a sample script that can do above.
I have tried and was not able to write a script myself.
1
This is Not a Realistic requirement
a dump does not have all the kernel stack resident
any query that tries to read a non resident stack might return an error
your elusive driver might be in one of those call stacks.
there may be no symbols
results that shows an address like 0xffbbeeaa`12345678 might belong to your hiding beauty.
any way to answer your query you can adapt the following command and try your luck.
insert a substring of your Driver Name in Contains() where i am looking for “ndis”
make sure you copy paste the command in a single line
( i have broken it because of horizontal scroll)
dx Debugger.Sessions.First().Processes.SelectMany(a=>a.Threads).SelectMany
(a=>a.Stack.Frames.Where(a=>a.ToDisplayString("s").Contains("ndis") == true))
it should yield something like below if you are lucky enough
0: kd> dx Debugger.Sessions.First().Processes.SelectMany(a=>a.Threads).SelectMany(a=>a.Stack.Frames.Where(a=>a.ToDisplayString("s").Contains("ndis") == true))
Debugger.Sessions.First().Processes.SelectMany(a=>a.Threads).SelectMany(a=>a.Stack.Frames.Where(a=>a.ToDisplayString("s").Contains("ndis") == true))
[0x0] : ndis!ndisWaitForKernelObject + 0x21 [Switch To]
[0x1] : ndis!ndisReceiveWorkerThread + 0x20af7 [Switch To]
[0x2] : ndis!ndisWaitForKernelObject + 0x21 [Switch To]
[0x3] : ndis!ndisReceiveWorkerThread + 0x20af7 [Switch To]
[0x4] : ndis!ndisWaitForKernelObject + 0x21 [Switch To]
[0x5] : ndis!ndisReceiveWorkerThread + 0x20af7 [Switch To]
[0x6] : ndis!ndisWaitForKernelObject + 0x21 [Switch To]
[0x7] : ndis!ndisReceiveWorkerThread + 0x20af7 [Switch To]
[0x8] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0x9] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0xa] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0xb] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0xc] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0xd] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0xe] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0xf] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0x10] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0x11] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0x12] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0x13] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0x14] : ndis!NdisMSleep + 0x67 [Switch To]
[0x15] : ndis!NdisWaitEvent + 0x3f [Switch To]
[0x16] : ndis!NdisWaitEvent + 0x3f [Switch To]
tracking back from a flattened output to Frame,Stack,Thread,And Process might be a pain
you should probably resort to .logopen ;!process 0 3f ;.logclose
and text parse the logged output with awk,sed and grep
also keep in mind looking for needle in haystack is a time consuming hit and miss job
in a small 4 Gb dump
E:>dir fool.dmp | grep -i "bytes$"
1 File(s) 4,168,441,856 bytes
you can expect to encounter hundreds of process , thousands of threads, and tens of thousands of call stacks all of which can potentially err with non resident stacks, symbol file missing error and make it very time and resource consuming job.
see below for some sample counts on the above dump file
"use strict";
function test()
{
var prc = host.currentSession.Processes.Count()
var trc = host.currentSession.Processes.SelectMany(a=>a.Threads).Count()
var frc = host.currentSession.Processes.SelectMany(a=>a.Threads).SelectMany(a=>a.Stack.Frames).Count()
host.diagnostics.debugLog( "processes Count = " + prc + "n")
host.diagnostics.debugLog( "threads Count = " + trc + "n")
host.diagnostics.debugLog( "Frame Count = " + frc + "n")
}
running this script yields the following stats
0: kd> dx @$scriptContents.test()
WARNING: corrupted linked list found.
cut off
Invalid thread @ ffff8106`2dfa6040 type - context unchanged.
cut off
WARNING: corrupted linked list found.
processes Count = 262
threads Count = 1616
Frame Count = 13080
@$scriptContents.test()