Windows内核分析索引目录：https://www.cnblogs.com/onetrainee/p/11675224.html
用户异常与模拟异常的派发
一、KiDispatchException函数处理流程图
无论用户模拟异常还是CPU异常，经过前面分析，在经过记录之后，最终都会经过KiDispatchException这个派发函数中。
在KiDispatchException中会对CPU异常和用户异常分别进行处理。
CPU异常：首先调用内核调试器，如果调用失败则调用RtlDispatchException（该函数后面会有介绍）分发，
RtlDispatchException函数会检查SEH链中是否有该程序的处理函数，如果有则返回成功，
若RtlDispatchException函数处理异常失败，其会尝试第二次调用内核调试器进行调试处理，如果最终处理不了直接蓝屏。
用户异常：先尝试内核调试器，再尝试用户调试器，如果还不行，直接返回用户代码尝试使用try_catch_语法来进行处理，之后还不行再尝试两次用户调试器。
如果最终还是处理不了异常，该进程会关闭并报出错误。（用户异常不会导致蓝屏出现）
二、RtlDispatchException的函数解析代码
1 VOID 2 KiDispatchException ( 3 IN PEXCEPTION_RECORD ExceptionRecord, 4 IN PKEXCEPTION_FRAME ExceptionFrame, 5 IN PKTRAP_FRAME TrapFrame, 6 IN KPROCESSOR_MODE PreviousMode, 7 IN BOOLEAN FirstChance 8 ) 9 10 /*++ 11 12 Routine Description: 13 14 This function is called to dispatch an exception to the proper mode and 15 to cause the exception dispatcher to be called. If the previous mode is 16 kernel, then the exception dispatcher is called directly to process the 17 exception. Otherwise the exception record, exception frame, and trap 18 frame contents are copied to the user mode stack. The contents of the 19 exception frame and trap are then modified such that when control is 20 returned, execution will commense in user mode in a routine which will 21 call the exception dispatcher. 22 23 Arguments: 24 25 ExceptionRecord - Supplies a pointer to an exception record. 26 27 ExceptionFrame - Supplies a pointer to an exception frame. For NT386, 28 this should be NULL. 29 30 TrapFrame - Supplies a pointer to a trap frame. 31 32 PreviousMode - Supplies the previous processor mode. 33 34 FirstChance - Supplies a boolean value that specifies whether this is 35 the first (TRUE) or second (FALSE) chance for the exception. 36 37 Return Value: 38 39 None. 40 41 --*/ 42 43 { 44 CONTEXT ContextFrame; 45 EXCEPTION_RECORD ExceptionRecord1, ExceptionRecord2; 46 LONG Length; 47 ULONG UserStack1; 48 ULONG UserStack2; 49 50 // 51 // Move machine state from trap and exception frames to a context frame, 52 // and increment the number of exceptions dispatched. 53 // 54 55 //-------------------------------------// 56 // 将当前异常分发次数增加1 // 57 // 修改ContextFrame.ContextFlags标志位 // 58 //-------------------------------------// 59 KeGetCurrentPrcb()->KeExceptionDispatchCount += 1; 60 ContextFrame.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS; 61 62 //------------------------------------------// 63 // 对于用户模式异常的处理 or 调试器可以执行 // 64 // 标记好Context内容 // 65 //------------------------------------------// 66 if ((PreviousMode == UserMode) || KdDebuggerEnabled) { 67 // 68 // For usermode exceptions always try to dispatch the floating 69 // point state. This allows exception handlers & debuggers to 70 // examine/edit the npx context if required. Plus it allows 71 // exception handlers to use fp instructions without destroying 72 // the npx state at the time of the exception. 73 // 74 // Note: If there's no 80387, ContextTo/FromKFrames will use the 75 // emulator's current state. If the emulator can not give the 76 // current state, then the context_floating_point bit will be 77 // turned off by ContextFromKFrames. 78 // 79 80 ContextFrame.ContextFlags |= CONTEXT_FLOATING_POINT; 81 if (KeI386XMMIPresent) { 82 ContextFrame.ContextFlags |= CONTEXT_EXTENDED_REGISTERS; 83 } 84 } 85 86 //----------------------------------// 87 // 将TrapFrame转换为ContextFrame // 88 // 接下来都是处理ContextFrame的内容 // 89 // 这部分零环无意义，三环有意义 // 90 // 否则修改返回地址不行了。 // 91 //----------------------------------// 92 KeContextFromKframes(TrapFrame, ExceptionFrame, &ContextFrame); 93 94 // 95 // if it is BREAK_POINT exception, we subtract 1 from EIP and report 96 // the updated EIP to user. This is because Cruiser requires EIP 97 // points to the int 3 instruction (not the instruction following int 3). 98 // In this case, BreakPoint exception is fatal. Otherwise we will step 99 // on the int 3 over and over again, if user does not handle it 100 // 101 // if the BREAK_POINT occured in V86 mode, the debugger running in the 102 // VDM will expect CS:EIP to point after the exception (the way the 103 // processor left it. this is also true for protected mode dos 104 // app debuggers. We will need a way to detect this. 105 // 106 // 107 108 switch (ExceptionRecord->ExceptionCode) { 109 //-------------------------// 110 // 如果为int3断点异常 // 111 // 则修改eip执行原来的位置 // 112 //-------------------------// 113 case STATUS_BREAKPOINT: 114 ContextFrame.Eip--; 115 break; 116 117 //------------------------------// 118 // 执行权限问题而发生的访问违例 // 119 //------------------------------// 120 case KI_EXCEPTION_ACCESS_VIOLATION: 121 ExceptionRecord->ExceptionCode = STATUS_ACCESS_VIOLATION; 122 if (PreviousMode == UserMode) { 123 if (KiCheckForAtlThunk(ExceptionRecord,&ContextFrame) != FALSE) { 124 goto Handled1; 125 } 126 127 if ((SharedUserData->ProcessorFeatures[PF_NX_ENABLED] == TRUE) && 128 (ExceptionRecord->ExceptionInformation [0] == EXCEPTION_EXECUTE_FAULT)) { 129 130 if (((KeFeatureBits & KF_GLOBAL_32BIT_EXECUTE) != 0) || 131 (PsGetCurrentProcess()->Pcb.Flags.ExecuteEnable != 0) || 132 (((KeFeatureBits & KF_GLOBAL_32BIT_NOEXECUTE) == 0) && 133 (PsGetCurrentProcess()->Pcb.Flags.ExecuteDisable == 0))) { 134 ExceptionRecord->ExceptionInformation [0] = 0; 135 } 136 } 137 } 138 break; 139 } 140 141 // 142 // Select the method of handling the exception based on the previous mode. 143 // 144 145 ASSERT (( 146 !((PreviousMode == KernelMode) && 147 (ContextFrame.EFlags & EFLAGS_V86_MASK)) 148 )); 149 150 //--------------------------// 151 // 如果是内核模式触发的异常 // 152 //--------------------------// 153 if (PreviousMode == KernelMode) { 154 155 // 156 // Previous mode was kernel. 157 // 158 // If the kernel debugger is active, then give the kernel debugger the 159 // first chance to handle the exception. If the kernel debugger handles 160 // the exception, then continue execution. Else attempt to dispatch the 161 // exception to a frame based handler. If a frame based handler handles 162 // the exception, then continue execution. 163 // 164 // If a frame based handler does not handle the exception, 165 // give the kernel debugger a second chance, if it's present. 166 // 167 // If the exception is still unhandled, call KeBugCheck(). 168 // 169 170 //----------------------------------// 171 // 给内核调试器第一次机会来处理异常 // 172 //----------------------------------// 173 if (FirstChance == TRUE) { 174 175 if ((KiDebugRoutine != NULL) && 176 (((KiDebugRoutine) (TrapFrame, 177 ExceptionFrame, 178 ExceptionRecord, 179 &ContextFrame, 180 PreviousMode, 181 FALSE)) != FALSE)) { 182 183 //------------------------------// 184 // 如果处理成功，不进行下面处理 // 185 //------------------------------// 186 goto Handled1; 187 } 188 189 // Kernel debugger didn't handle exception. 190 191 //--------------------------------------// 192 // 如果第一次调试器不成功，则派发异常 // 193 // 当派发成功之后，也不会处理第二次异常 // 194 //--------------------------------------// 195 if (RtlDispatchException(ExceptionRecord, &ContextFrame) == TRUE) { 196 goto Handled1; 197 } 198 } 199 200 // 201 // This is the second chance to handle the exception. 202 // 203 204 //--------------------------------// 205 // 第二次机会来调用调试器处理异常 // 206 //--------------------------------// 207 if ((KiDebugRoutine != NULL) && 208 (((KiDebugRoutine) (TrapFrame, 209 ExceptionFrame, 210 ExceptionRecord, 211 &ContextFrame, 212 PreviousMode, 213 TRUE)) != FALSE)) { 214 215 //------------------// 216 // 第二次也处理成功 // 217 //------------------// 218 goto Handled1; 219 } 220 221 222 //------------------------------------------------// 223 // 如果两次调试器处理和派发都不成功，系统直接蓝屏 // 224 //------------------------------------------------// 225 KeBugCheckEx( 226 KERNEL_MODE_EXCEPTION_NOT_HANDLED, 227 ExceptionRecord->ExceptionCode, 228 (ULONG)ExceptionRecord->ExceptionAddress, 229 (ULONG)TrapFrame, 230 0); 231 232 } else { 233 //--------------// 234 // 用户模式异常 // 235 //--------------// 236 237 // 238 // Previous mode was user. 239 // 240 // If this is the first chance and the current process has a debugger 241 // port, then send a message to the debugger port and wait for a reply. 242 // If the debugger handles the exception, then continue execution. Else 243 // transfer the exception information to the user stack, transition to 244 // user mode, and attempt to dispatch the exception to a frame based 245 // handler. If a frame based handler handles the exception, then continue 246 // execution with the continue system service. Else execute the 247 // NtRaiseException system service with FirstChance == FALSE, which 248 // will call this routine a second time to process the exception. 249 // 250 // If this is the second chance and the current process has a debugger 251 // port, then send a message to the debugger port and wait for a reply. 252 // If the debugger handles the exception, then continue execution. Else 253 // if the current process has a subsystem port, then send a message to 254 // the subsystem port and wait for a reply. If the subsystem handles the 255 // exception, then continue execution. Else terminate the process. 256 // 257 258 259 if (FirstChance == TRUE) { 260 261 // 262 // This is the first chance to handle the exception. 263 // 264 265 //-------------------------------------------------------------------------------// 266 // 调用内核调试器有两个条件: // 267 // 1. 当前存在一个调试器 // 268 // 2. (当前进程的调试器端口为NULL && 不忽略异常) or 可以得到当前 ContextFrame ) // 269 //-------------------------------------------------------------------------------// 270 if ((KiDebugRoutine != NULL) && 271 272 //---------------------------------------------------------------// 273 // 三环调试器最终会建立一个调试对象，挂在被调试进程的DebugPort处 // 274 //---------------------------------------------------------------// 275 ((PsGetCurrentProcess()->DebugPort == NULL && 276 !KdIgnoreUmExceptions) || 277 //-------------------------------------// 278 // 判断R3层的INT3是否能进入内核调试器 // 279 //-------------------------------------// 280 (KdIsThisAKdTrap(ExceptionRecord, &ContextFrame, UserMode)))) { 281 // 282 // Now dispatch the fault to the kernel debugger. 283 // 284 285 //------------------------// 286 // 先尝试第一次调试器处理 // 287 //------------------------// 288 if ((((KiDebugRoutine) (TrapFrame, 289 ExceptionFrame, 290 ExceptionRecord, 291 &ContextFrame, 292 PreviousMode, 293 FALSE)) != FALSE)) { 294 295 goto Handled1; 296 } 297 } 298 299 300 //---------------------------------------------------// 301 // 如果零环调试器无法处理 会调用三环调试器来进行处理 // 302 //---------------------------------------------------// 303 if (DbgkForwardException(ExceptionRecord, TRUE, FALSE)) { 304 goto Handled2; 305 } 306 307 // 308 // Transfer exception information to the user stack, transition 309 // to user mode, and attempt to dispatch the exception to a frame 310 // based handler. 311 312 ExceptionRecord1.ExceptionCode = 0; // satisfy no_opt compilation 313 314 //---------------------------------------------------------// 315 // 当内核调试器/用户调试器都处理不了该异常时 // 316 // 返回R3层的用户代码，尝试交给自定的try.catch. 来进行处理 // 317 // 对栈的存储跟APC操作类似 // 318 //---------------------------------------------------------// 319 repeat: 320 try { 321 322 // 323 // If the SS segment is not 32 bit flat, there is no point 324 // to dispatch exception to frame based exception handler. 325 // 326 327 328 if (TrapFrame->HardwareSegSs != (KGDT_R3_DATA | RPL_MASK) || 329 TrapFrame->EFlags & EFLAGS_V86_MASK ) { 330 //-----------------------------------// 331 // 如果TrapFrame保存的不是用户层地址 // 332 // 直接出触发二次异常 // 333 //-----------------------------------// 334 ExceptionRecord2.ExceptionCode = STATUS_ACCESS_VIOLATION; 335 ExceptionRecord2.ExceptionFlags = 0; 336 ExceptionRecord2.NumberParameters = 0; 337 ExRaiseException(&ExceptionRecord2); 338 } 339 340 // 341 // Compute length of context record and new aligned user stack 342 // pointer. 343 // 344 345 //--------------------------------------// 346 // 计算"对齐并提高用户栈的大小"后的指针 // 347 //--------------------------------------// 348 UserStack1 = (ContextFrame.Esp & ~CONTEXT_ROUND) - CONTEXT_ALIGNED_SIZE; 349 350 // 351 // Probe user stack area for writability and then transfer the 352 // context record to the user stack. 353 // 354 355 //--------------------------------------------------------------------// 356 // ProbeForWrite 检测是否可写入，如果可以写入则写入内存，否则抛出异常 // 357 // 将Context结构保存到三环栈帧中，为进入零环时恢复三环的环境做准备 // // 358 //--------------------------------------------------------------------// 359 ProbeForWrite((PCHAR)UserStack1, CONTEXT_ALIGNED_SIZE, CONTEXT_ALIGN); 360 RtlCopyMemory((PULONG)UserStack1, &ContextFrame, sizeof(CONTEXT)); 361 362 // 363 // Compute length of exception record and new aligned stack 364 // address. 365 // 366 367 //----------------------------// 368 // 计算放入异常参数后栈的大小 // 369 //----------------------------// 370 Length = (sizeof(EXCEPTION_RECORD) - (EXCEPTION_MAXIMUM_PARAMETERS - 371 ExceptionRecord->NumberParameters) * sizeof(ULONG) +3) & 372 (~3); 373 UserStack2 = UserStack1 - Length; 374 375 // 376 // Probe user stack area for writeability and then transfer the 377 // context record to the user stack area. 378 // N.B. The probing length is Length+8 because there are two 379 // arguments need to be pushed to user stack later. 380 // 381 382 //----------------------------------------------// 383 // 将参数放入内核中 这里提升8因为后面还需要参数 // 384 //----------------------------------------------// 385 ProbeForWrite((PCHAR)(UserStack2 - 8), Length + 8, sizeof(ULONG)); 386 RtlCopyMemory((PULONG)UserStack2, ExceptionRecord, Length); 387 388 // 389 // Push address of exception record, context record to the 390 // user stack. They are the two parameters required by 391 // _KiUserExceptionDispatch. 392 // 393 394 //----------------------------------------------------------------------// 395 // 将上述两个栈地址压入栈中，将该参数是 _KiUserExceptionDispatch 需要的 // 396 //----------------------------------------------------------------------// 397 *(PULONG)(UserStack2 - sizeof(ULONG)) = UserStack1; 398 *(PULONG)(UserStack2 - 2*sizeof(ULONG)) = UserStack2; 399 400 // 401 // Set new stack pointer to the trap frame. 402 // 403 404 //-------------------------------------------// 405 // 修改_KTRAP_FRAME中寄存器ss与esp寄存器的值 // 406 // 这样返回用户层时栈帧就是修改栈帧的数据了 // 407 //-------------------------------------------// 408 KiSegSsToTrapFrame(TrapFrame, KGDT_R3_DATA); 409 KiEspToTrapFrame(TrapFrame, (UserStack2 - sizeof(ULONG)*2)); 410 411 // 412 // Force correct R3 selectors into TrapFrame. 413 // 414 415 //-------------------------// 416 // 修改 TrapFrame后的数据 // 417 //-------------------------// 418 TrapFrame->SegCs = SANITIZE_SEG(KGDT_R3_CODE, PreviousMode); 419 TrapFrame->SegDs = SANITIZE_SEG(KGDT_R3_DATA, PreviousMode); 420 TrapFrame->SegEs = SANITIZE_SEG(KGDT_R3_DATA, PreviousMode); 421 TrapFrame->SegFs = SANITIZE_SEG(KGDT_R3_TEB, PreviousMode); 422 TrapFrame->SegGs = 0; 423 424 // 425 // Set the address of the exception routine that will call the 426 // exception dispatcher and then return to the trap handler. 427 // The trap handler will restore the exception and trap frame 428 // context and continue execution in the routine that will 429 // call the exception dispatcher. 430 // 431 432 //--------------------------------------// 433 // 修改到返回三环的地址 // 434 // KeUserExceptionDispathcer 这个函数中 // 435 //--------------------------------------// 436 TrapFrame->Eip = (ULONG)KeUserExceptionDispatcher; 437 return; 438 439 } except (KiCopyInformation(&ExceptionRecord1, 440 (GetExceptionInformation())->ExceptionRecord)) { 441 442 // 443 // If the exception is a stack overflow, then attempt 444 // to raise the stack overflow exception. Otherwise, 445 // the user's stack is not accessible, or is misaligned, 446 // and second chance processing is performed. 447 // 448 449 if (ExceptionRecord1.ExceptionCode == STATUS_STACK_OVERFLOW) { 450 ExceptionRecord1.ExceptionAddress = ExceptionRecord->ExceptionAddress; 451 RtlCopyMemory((PVOID)ExceptionRecord, 452 &ExceptionRecord1, sizeof(EXCEPTION_RECORD)); 453 goto repeat; 454 } 455 } 456 } 457 458 // 459 // This is the second chance to handle the exception. 460 // 461 462 if (DbgkForwardException(ExceptionRecord, TRUE, TRUE)) { 463 goto Handled2; 464 } else if (DbgkForwardException(ExceptionRecord, FALSE, TRUE)) { 465 goto Handled2; 466 } else { 467 ZwTerminateProcess(NtCurrentProcess(), ExceptionRecord->ExceptionCode); 468 KeBugCheckEx( 469 KERNEL_MODE_EXCEPTION_NOT_HANDLED, 470 ExceptionRecord->ExceptionCode, 471 (ULONG)ExceptionRecord->ExceptionAddress, 472 (ULONG)TrapFrame, 473 0); 474 } 475 } 476 477 // 478 // Move machine state from context frame to trap and exception frames and 479 // then return to continue execution with the restored state. 480 // 481 482 Handled1: 483 484 KeContextToKframes(TrapFrame, ExceptionFrame, &ContextFrame, 485 ContextFrame.ContextFlags, PreviousMode); 486 487 // 488 // Exception was handled by the debugger or the associated subsystem 489 // and state was modified, if necessary, using the get state and set 490 // state capabilities. Therefore the context frame does not need to 491 // be transferred to the trap and exception frames. 492 // 493 494 Handled2: 495 return; 496 }