用户异常与模拟异常的派发

  1 VOID
  2 KiDispatchException (
  3     IN PEXCEPTION_RECORD ExceptionRecord,
  4     IN PKEXCEPTION_FRAME ExceptionFrame,
  5     IN PKTRAP_FRAME TrapFrame,
  6     IN KPROCESSOR_MODE PreviousMode,
  7     IN BOOLEAN FirstChance
  8     )
  9 
 10 /*++
 11 
 12 Routine Description:
 13 
 14     This function is called to dispatch an exception to the proper mode and
 15     to cause the exception dispatcher to be called. If the previous mode is
 16     kernel, then the exception dispatcher is called directly to process the
 17     exception. Otherwise the exception record, exception frame, and trap
 18     frame contents are copied to the user mode stack. The contents of the
 19     exception frame and trap are then modified such that when control is
 20     returned, execution will commense in user mode in a routine which will
 21     call the exception dispatcher.
 22 
 23 Arguments:
 24 
 25     ExceptionRecord - Supplies a pointer to an exception record.
 26 
 27     ExceptionFrame - Supplies a pointer to an exception frame. For NT386,
 28         this should be NULL.
 29 
 30     TrapFrame - Supplies a pointer to a trap frame.
 31 
 32     PreviousMode - Supplies the previous processor mode.
 33 
 34     FirstChance - Supplies a boolean value that specifies whether this is
 35         the first (TRUE) or second (FALSE) chance for the exception.
 36 
 37 Return Value:
 38 
 39     None.
 40 
 41 --*/
 42 
 43 {
 44     CONTEXT ContextFrame;
 45     EXCEPTION_RECORD ExceptionRecord1, ExceptionRecord2;
 46     LONG Length;
 47     ULONG UserStack1;
 48     ULONG UserStack2;
 49 
 50     //
 51     // Move machine state from trap and exception frames to a context frame,
 52     // and increment the number of exceptions dispatched.
 53     //
 54 
 55     //-------------------------------------//
 56     // 将当前异常分发次数增加1             //
 57     // 修改ContextFrame.ContextFlags标志位 //
 58     //-------------------------------------//
 59     KeGetCurrentPrcb()->KeExceptionDispatchCount += 1;
 60     ContextFrame.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
 61 
 62     //------------------------------------------//
 63     // 对于用户模式异常的处理 or 调试器可以执行 //
 64     // 标记好Context内容                        //
 65     //------------------------------------------//
 66     if ((PreviousMode == UserMode) || KdDebuggerEnabled) {
 67         //
 68         // For usermode exceptions always try to dispatch the floating
 69         // point state.  This allows exception handlers & debuggers to
 70         // examine/edit the npx context if required.  Plus it allows
 71         // exception handlers to use fp instructions without destroying
 72         // the npx state at the time of the exception.
 73         //
 74         // Note: If there‘s no 80387, ContextTo/FromKFrames will use the
 75         // emulator‘s current state.  If the emulator can not give the
 76         // current state, then the context_floating_point bit will be
 77         // turned off by ContextFromKFrames.
 78         //
 79 
 80         ContextFrame.ContextFlags |= CONTEXT_FLOATING_POINT;
 81         if (KeI386XMMIPresent) {
 82             ContextFrame.ContextFlags |= CONTEXT_EXTENDED_REGISTERS;
 83         }
 84     }
 85 
 86     //----------------------------------//
 87     // 将TrapFrame转换为ContextFrame    //
 88     // 接下来都是处理ContextFrame的内容 //
 89     // 这部分零环无意义，三环有意义     //
 90     // 否则修改返回地址不行了。         //
 91     //----------------------------------//
 92     KeContextFromKframes(TrapFrame, ExceptionFrame, &ContextFrame);
 93 
 94     //
 95     // if it is BREAK_POINT exception, we subtract 1 from EIP and report
 96     // the updated EIP to user.  This is because Cruiser requires EIP
 97     // points to the int 3 instruction (not the instruction following int 3).
 98     // In this case, BreakPoint exception is fatal. Otherwise we will step
 99     // on the int 3 over and over again, if user does not handle it
100     //
101     // if the BREAK_POINT occured in V86 mode, the debugger running in the
102     // VDM will expect CS:EIP to point after the exception (the way the
103     // processor left it.  this is also true for protected mode dos
104     // app debuggers.  We will need a way to detect this.
105     //
106     //
107 
108     switch (ExceptionRecord->ExceptionCode) {
109         //-------------------------//
110         // 如果为int3断点异常      //
111         // 则修改eip执行原来的位置 //
112         //-------------------------//
113         case STATUS_BREAKPOINT:
114             ContextFrame.Eip--;
115             break;
116 
117         //------------------------------//
118         // 执行权限问题而发生的访问违例 //
119         //------------------------------//
120         case KI_EXCEPTION_ACCESS_VIOLATION:
121             ExceptionRecord->ExceptionCode = STATUS_ACCESS_VIOLATION;
122             if (PreviousMode == UserMode) {
123                 if (KiCheckForAtlThunk(ExceptionRecord,&ContextFrame) != FALSE) {
124                     goto Handled1;
125                 }
126 
127                 if ((SharedUserData->ProcessorFeatures[PF_NX_ENABLED] == TRUE) &&
128                     (ExceptionRecord->ExceptionInformation [0] == EXCEPTION_EXECUTE_FAULT)) {
129                     
130                     if (((KeFeatureBits & KF_GLOBAL_32BIT_EXECUTE) != 0) ||
131                         (PsGetCurrentProcess()->Pcb.Flags.ExecuteEnable != 0) ||
132                         (((KeFeatureBits & KF_GLOBAL_32BIT_NOEXECUTE) == 0) &&
133                          (PsGetCurrentProcess()->Pcb.Flags.ExecuteDisable == 0))) {
134                         ExceptionRecord->ExceptionInformation [0] = 0;
135                     }
136                 }
137             }
138             break;
139     }
140 
141     //
142     // Select the method of handling the exception based on the previous mode.
143     //
144 
145     ASSERT ((
146              !((PreviousMode == KernelMode) &&
147              (ContextFrame.EFlags & EFLAGS_V86_MASK))
148            ));
149 
150     //--------------------------//
151     // 如果是内核模式触发的异常 //
152     //--------------------------//
153     if (PreviousMode == KernelMode) {
154 
155         //
156         // Previous mode was kernel.
157         //
158         // If the kernel debugger is active, then give the kernel debugger the
159         // first chance to handle the exception. If the kernel debugger handles
160         // the exception, then continue execution. Else attempt to dispatch the
161         // exception to a frame based handler. If a frame based handler handles
162         // the exception, then continue execution.
163         //
164         // If a frame based handler does not handle the exception,
165         // give the kernel debugger a second chance, if it‘s present.
166         //
167         // If the exception is still unhandled, call KeBugCheck().
168         //
169 
170         //----------------------------------//
171         // 给内核调试器第一次机会来处理异常 //
172         //----------------------------------//
173         if (FirstChance == TRUE) {
174 
175             if ((KiDebugRoutine != NULL) &&
176                (((KiDebugRoutine) (TrapFrame,
177                                    ExceptionFrame,
178                                    ExceptionRecord,
179                                    &ContextFrame,
180                                    PreviousMode,
181                                    FALSE)) != FALSE)) {
182                                    
183                 //------------------------------//
184                 // 如果处理成功，不进行下面处理 //
185                 //------------------------------//
186                 goto Handled1;
187             }
188 
189             // Kernel debugger didn‘t handle exception.
190 
191             //--------------------------------------//
192             // 如果第一次调试器不成功，则派发异常   //
193             // 当派发成功之后，也不会处理第二次异常 //
194             //--------------------------------------//
195             if (RtlDispatchException(ExceptionRecord, &ContextFrame) == TRUE) {
196                 goto Handled1;
197             }
198         }
199 
200         //
201         // This is the second chance to handle the exception.
202         //
203 
204         //--------------------------------//
205         // 第二次机会来调用调试器处理异常 //
206         //--------------------------------//
207         if ((KiDebugRoutine != NULL) &&
208             (((KiDebugRoutine) (TrapFrame,
209                                 ExceptionFrame,
210                                 ExceptionRecord,
211                                 &ContextFrame,
212                                 PreviousMode,
213                                 TRUE)) != FALSE)) {
214 
215             //------------------//
216             // 第二次也处理成功 //
217             //------------------//
218             goto Handled1;
219         }
220 
221         
222         //------------------------------------------------//
223         // 如果两次调试器处理和派发都不成功，系统直接蓝屏 //
224         //------------------------------------------------//
225         KeBugCheckEx(
226             KERNEL_MODE_EXCEPTION_NOT_HANDLED,
227             ExceptionRecord->ExceptionCode,
228             (ULONG)ExceptionRecord->ExceptionAddress,
229             (ULONG)TrapFrame,
230             0);
231 
232     } else {
233         //--------------//
234         // 用户模式异常 //
235         //--------------//
236 
237         //
238         // Previous mode was user.
239         //
240         // If this is the first chance and the current process has a debugger
241         // port, then send a message to the debugger port and wait for a reply.
242         // If the debugger handles the exception, then continue execution. Else
243         // transfer the exception information to the user stack, transition to
244         // user mode, and attempt to dispatch the exception to a frame based
245         // handler. If a frame based handler handles the exception, then continue
246         // execution with the continue system service. Else execute the
247         // NtRaiseException system service with FirstChance == FALSE, which
248         // will call this routine a second time to process the exception.
249         //
250         // If this is the second chance and the current process has a debugger
251         // port, then send a message to the debugger port and wait for a reply.
252         // If the debugger handles the exception, then continue execution. Else
253         // if the current process has a subsystem port, then send a message to
254         // the subsystem port and wait for a reply. If the subsystem handles the
255         // exception, then continue execution. Else terminate the process.
256         //
257 
258 
259         if (FirstChance == TRUE) {
260 
261             //
262             // This is the first chance to handle the exception.
263             //
264 
265             //-------------------------------------------------------------------------------//
266             // 调用内核调试器有两个条件:                                                     //
267             // 1. 当前存在一个调试器                                                         //
268             // 2. (当前进程的调试器端口为NULL && 不忽略异常) or 可以得到当前 ContextFrame )  //
269             //-------------------------------------------------------------------------------//
270             if ((KiDebugRoutine != NULL)  &&
271 
272                 //---------------------------------------------------------------//
273                 // 三环调试器最终会建立一个调试对象，挂在被调试进程的DebugPort处 //
274                 //---------------------------------------------------------------//
275                 ((PsGetCurrentProcess()->DebugPort == NULL &&
276                   !KdIgnoreUmExceptions) ||
277                 //-------------------------------------//
278                 //  判断R3层的INT3是否能进入内核调试器 //
279                 //-------------------------------------//
280                  (KdIsThisAKdTrap(ExceptionRecord, &ContextFrame, UserMode)))) {
281                 //
282                 // Now dispatch the fault to the kernel debugger.
283                 //
284 
285                 //------------------------//
286                 // 先尝试第一次调试器处理 //
287                 //------------------------//
288                 if ((((KiDebugRoutine) (TrapFrame,
289                                         ExceptionFrame,
290                                         ExceptionRecord,
291                                         &ContextFrame,
292                                         PreviousMode,
293                                         FALSE)) != FALSE)) {
294 
295                     goto Handled1;
296                 }
297             }
298 
299             
300             //---------------------------------------------------//
301             // 如果零环调试器无法处理 会调用三环调试器来进行处理 //
302             //---------------------------------------------------//
303             if (DbgkForwardException(ExceptionRecord, TRUE, FALSE)) {
304                 goto Handled2;
305             }
306 
307             //
308             // Transfer exception information to the user stack, transition
309             // to user mode, and attempt to dispatch the exception to a frame
310             // based handler.
311 
312             ExceptionRecord1.ExceptionCode = 0; // satisfy no_opt compilation
313 
314         //---------------------------------------------------------//
315         // 当内核调试器/用户调试器都处理不了该异常时               //
316         // 返回R3层的用户代码，尝试交给自定的try.catch. 来进行处理 //
317         // 对栈的存储跟APC操作类似                                 //
318         //---------------------------------------------------------//
319         repeat:
320             try {
321 
322                 //
323                 // If the SS segment is not 32 bit flat, there is no point
324                 // to dispatch exception to frame based exception handler.
325                 //
326 
327                 
328                 if (TrapFrame->HardwareSegSs != (KGDT_R3_DATA | RPL_MASK) ||
329                     TrapFrame->EFlags & EFLAGS_V86_MASK ) {
330                     //-----------------------------------//
331                     // 如果TrapFrame保存的不是用户层地址 //
332                     // 直接出触发二次异常                //
333                     //-----------------------------------//
334                     ExceptionRecord2.ExceptionCode = STATUS_ACCESS_VIOLATION;
335                     ExceptionRecord2.ExceptionFlags = 0;
336                     ExceptionRecord2.NumberParameters = 0;
337                     ExRaiseException(&ExceptionRecord2);
338                 }
339 
340                 //
341                 // Compute length of context record and new aligned user stack
342                 // pointer.
343                 //
344 
345                 //--------------------------------------//
346                 // 计算"对齐并提高用户栈的大小"后的指针 //
347                 //--------------------------------------//
348                 UserStack1 = (ContextFrame.Esp & ~CONTEXT_ROUND) - CONTEXT_ALIGNED_SIZE;
349 
350                 //
351                 // Probe user stack area for writability and then transfer the
352                 // context record to the user stack.
353                 //
354 
355                 //--------------------------------------------------------------------//
356                 // ProbeForWrite 检测是否可写入，如果可以写入则写入内存，否则抛出异常 //
357                 // 将Context结构保存到三环栈帧中，为进入零环时恢复三环的环境做准备    //                             //
358                 //--------------------------------------------------------------------//
359                 ProbeForWrite((PCHAR)UserStack1, CONTEXT_ALIGNED_SIZE, CONTEXT_ALIGN);
360                 RtlCopyMemory((PULONG)UserStack1, &ContextFrame, sizeof(CONTEXT));
361 
362                 //
363                 // Compute length of exception record and new aligned stack
364                 // address.
365                 //
366 
367                 //----------------------------//
368                 // 计算放入异常参数后栈的大小 //
369                 //----------------------------//
370                 Length = (sizeof(EXCEPTION_RECORD) - (EXCEPTION_MAXIMUM_PARAMETERS -
371                          ExceptionRecord->NumberParameters) * sizeof(ULONG) +3) &
372                          (~3);
373                 UserStack2 = UserStack1 - Length;
374 
375                 //
376                 // Probe user stack area for writeability and then transfer the
377                 // context record to the user stack area.
378                 // N.B. The probing length is Length+8 because there are two
379                 //      arguments need to be pushed to user stack later.
380                 //
381 
382                 //----------------------------------------------//
383                 // 将参数放入内核中 这里提升8因为后面还需要参数 //
384                 //----------------------------------------------//
385                 ProbeForWrite((PCHAR)(UserStack2 - 8), Length + 8, sizeof(ULONG));
386                 RtlCopyMemory((PULONG)UserStack2, ExceptionRecord, Length);
387 
388                 //
389                 // Push address of exception record, context record to the
390                 // user stack.  They are the two parameters required by
391                 // _KiUserExceptionDispatch.
392                 //
393 
394                 //----------------------------------------------------------------------//
395                 // 将上述两个栈地址压入栈中，将该参数是 _KiUserExceptionDispatch 需要的 //
396                 //----------------------------------------------------------------------//
397                 *(PULONG)(UserStack2 - sizeof(ULONG)) = UserStack1;
398                 *(PULONG)(UserStack2 - 2*sizeof(ULONG)) = UserStack2;
399 
400                 //
401                 // Set new stack pointer to the trap frame.
402                 //
403 
404                 //-------------------------------------------//
405                 // 修改_KTRAP_FRAME中寄存器ss与esp寄存器的值 //
406                 // 这样返回用户层时栈帧就是修改栈帧的数据了  //
407                 //-------------------------------------------//
408                 KiSegSsToTrapFrame(TrapFrame, KGDT_R3_DATA);
409                 KiEspToTrapFrame(TrapFrame, (UserStack2 - sizeof(ULONG)*2));
410 
411                 //
412                 // Force correct R3 selectors into TrapFrame.
413                 //
414 
415                 //-------------------------//
416                 // 修改 TrapFrame后的数据  //
417                 //-------------------------//
418                 TrapFrame->SegCs = SANITIZE_SEG(KGDT_R3_CODE, PreviousMode);
419                 TrapFrame->SegDs = SANITIZE_SEG(KGDT_R3_DATA, PreviousMode);
420                 TrapFrame->SegEs = SANITIZE_SEG(KGDT_R3_DATA, PreviousMode);
421                 TrapFrame->SegFs = SANITIZE_SEG(KGDT_R3_TEB, PreviousMode);
422                 TrapFrame->SegGs = 0;
423 
424                 //
425                 // Set the address of the exception routine that will call the
426                 // exception dispatcher and then return to the trap handler.
427                 // The trap handler will restore the exception and trap frame
428                 // context and continue execution in the routine that will
429                 // call the exception dispatcher.
430                 //
431 
432                 //--------------------------------------//
433                 // 修改到返回三环的地址                 //
434                 // KeUserExceptionDispathcer 这个函数中 //
435                 //--------------------------------------//
436                 TrapFrame->Eip = (ULONG)KeUserExceptionDispatcher;
437                 return;
438 
439             } except (KiCopyInformation(&ExceptionRecord1,
440                         (GetExceptionInformation())->ExceptionRecord)) {
441 
442                 //
443                 // If the exception is a stack overflow, then attempt
444                 // to raise the stack overflow exception. Otherwise,
445                 // the user‘s stack is not accessible, or is misaligned,
446                 // and second chance processing is performed.
447                 //
448 
449                 if (ExceptionRecord1.ExceptionCode == STATUS_STACK_OVERFLOW) {
450                     ExceptionRecord1.ExceptionAddress = ExceptionRecord->ExceptionAddress;
451                     RtlCopyMemory((PVOID)ExceptionRecord,
452                                   &ExceptionRecord1, sizeof(EXCEPTION_RECORD));
453                     goto repeat;
454                 }
455             }
456         }
457 
458         //
459         // This is the second chance to handle the exception.
460         //
461 
462         if (DbgkForwardException(ExceptionRecord, TRUE, TRUE)) {
463             goto Handled2;
464         } else if (DbgkForwardException(ExceptionRecord, FALSE, TRUE)) {
465             goto Handled2;
466         } else {
467             ZwTerminateProcess(NtCurrentProcess(), ExceptionRecord->ExceptionCode);
468             KeBugCheckEx(
469                 KERNEL_MODE_EXCEPTION_NOT_HANDLED,
470                 ExceptionRecord->ExceptionCode,
471                 (ULONG)ExceptionRecord->ExceptionAddress,
472                 (ULONG)TrapFrame,
473                 0);
474         }
475     }
476 
477     //
478     // Move machine state from context frame to trap and exception frames and
479     // then return to continue execution with the restored state.
480     //
481 
482 Handled1:
483 
484     KeContextToKframes(TrapFrame, ExceptionFrame, &ContextFrame,
485                        ContextFrame.ContextFlags, PreviousMode);
486 
487     //
488     // Exception was handled by the debugger or the associated subsystem
489     // and state was modified, if necessary, using the get state and set
490     // state capabilities. Therefore the context frame does not need to
491     // be transferred to the trap and exception frames.
492     //
493 
494 Handled2:
495     return;
496 }