拿到程序初始化失败的DUMP，一般情况下我们看到的栈是这个样子的：
0:000> kb ChildEBP RetAddr Args to Child 0012fc7c 7c92d9ca 7c972b53 c0000145 00000001 ntdll!KiFastSystemCallRet 0012fc80 7c972b53 c0000145 00000001 00000000 ntdll!NtRaiseHardError+0xc 0012fca4 7c960f9f c0000005 0012fd30 00370034 ntdll!LdrpInitializationFailure+0x2d 0012fd1c 7c92e457 0012fd30 7c920000 00000000 ntdll!_LdrpInitialize+0x1f9 00000000 00000000 00000000 00000000 00000000 ntdll!KiUserApcDispatcher+0x7 0:000> !error c0000145 Error code: (NTSTATUS) 0xc0000145 (3221225797) - {Application Error} The application was unable to start correctly (0x%lx). Click OK to close the application. 0:000> !error c0000005 Error code: (NTSTATUS) 0xc0000005 (3221225477) - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
可以看到最后报错是c0000145，应用程序无法运行。而引起出错的是LdrpInitializationFailure，出错原因内存访问异常。但是具体是哪出错还不无法从此刻的栈看到，我们需要进一步分析。
0:000> dds esp-1000 esp ... 0012f3c0 7c92e920 ntdll!_except_handler3 0012f3c4 00000001 0012f3c8 0012f470 0012f3cc 0012fd0c 0012f3d0 7c953fdc ntdll!RtlDispatchException+0xb1 0012f3d4 0012f470 0012f3d8 0012fd0c 0012f3dc 0012f48c 0012f3e0 0012f444 0012f3e4 7c92e920 ntdll!_except_handler3 0012f3e8 003d3810 someapp!PostMsg+0x27aa0 0012f3ec 0012f470 0012f3f0 b36caf32 0012f3f4 00153960 0012f3f8 7c93e584 ntdll!DbgPrint+0x1c 0012f3fc 00150178 0012f400 000000e8 0012f404 00000668 0012f408 00150000 0012f40c 0012f204 0012f410 7c940571 ntdll!RtlCreateActivationContext+0x2c 0012f414 c0000000 0012f418 00153960 0012f41c 003f0000 0012f420 00000000 0012f424 0012f444 0012f428 7c940610 ntdll!RtlCreateActivationContext+0xed 0012f42c 001539b4 0012f430 00000002 0012f434 00000008 0012f438 00000000 0012f43c 00000000 0012f440 00000000 0012f444 0012f750 0012f448 7c814880 kernel32!CreateActCtxW+0x75c 0012f44c 00130000 0012f450 0012d000 0012f454 00000000 0012f458 0012f76c 0012f45c 7c92e48a ntdll!KiUserExceptionDispatcher+0xe 0012f460 00000000 0012f464 0012f48c 0012f468 0012f470 0012f46c 0012f48c 0012f470 c0000005 0012f474 00000000 0012f478 00000000 0012f47c 7c93ccf2 ntdll!LdrpHandleOneOldFormatImportDescriptor+0x21 0012f480 00000002 0012f484 00000000 0012f488 d16cca32 0012f48c 0001003f ...
这里我们就可以看到异常发生的栈了。
0:000> .exr 0012f470 ExceptionAddress: 7c93ccf2 (ntdll!LdrpHandleOneOldFormatImportDescriptor+0x00000021) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: d16cca32 Attempt to read from address d16cca32 0:000> .cxr 0012f48c eax=003a0000 ebx=00253010 ecx=d132ca32 edx=00033810 esi=b36caf32 edi=003d3810 eip=7c93ccf2 esp=0012f758 ebp=0012f76c iopl=0 nv up ei ng nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010282 ntdll!LdrpHandleOneOldFormatImportDescriptor+0x21: 7c93ccf2 833c0800 cmp dword ptr [eax+ecx],0 ds:0023:d16cca32=???????? 0:000> kb *** Stack trace for last set context - .thread/.cxr resets it ChildEBP RetAddr Args to Child 0012f76c 7c93ccc4 7ffd9000 00020498 00253010 ntdll!LdrpHandleOneOldFormatImportDescriptor+0x21 0012f784 7c93bc1e 7ffd9000 00020498 00253010 ntdll!LdrpHandleOldFormatImportDescriptors+0x1f 0012f800 7c93d216 00020498 00253010 00434398 ntdll!LdrpWalkImportDescriptor+0x19e 0012fa50 7c93cd1d 00020498 004396ca 00400000 ntdll!LdrpLoadImportModule+0x1c8 0012fa80 7c93ccc4 7ffd9000 00020498 00251ec0 ntdll!LdrpHandleOneOldFormatImportDescriptor+0x5e 0012fa98 7c93bc1e 7ffd9000 00020498 00251ec0 ntdll!LdrpHandleOldFormatImportDescriptors+0x1f 0012fb14 7c9418b5 00020498 00251ec0 7ffdf000 ntdll!LdrpWalkImportDescriptor+0x19e 0012fc94 00000000 0012fca0 00000000 0012fd1c ntdll!LdrpInitializeProcess+0xe02 0:000> dt ntdll!_LDR_DATA_TABLE_ENTRY 00253010 +0x000 InLoadOrderLinks : _LIST_ENTRY [ 0x251e9c - 0x252ee0 ] +0x008 InMemoryOrderLinks : _LIST_ENTRY [ 0x251ea4 - 0x252ee8 ] +0x010 InInitializationOrderLinks : _LIST_ENTRY [ 0x0 - 0x0 ] +0x018 DllBase : 0x003a0000 Void +0x01c EntryPoint : 0x003c1ae4 Void +0x020 SizeOfImage : 0x43000 +0x024 FullDllName : _UNICODE_STRING "C:\Program Files\S-dir\Some-dir\someapp.dll" +0x02c BaseDllName : _UNICODE_STRING "someapp.dll" +0x034 Flags : 0x200006 +0x038 LoadCount : 0 +0x03a TlsIndex : 0 +0x03c HashLinks : _LIST_ENTRY [ 0x7c99e2f0 - 0x252a5c ] +0x03c SectionPointer : 0x7c99e2f0 Void +0x040 CheckSum : 0x252a5c +0x044 TimeDateStamp : 0x5618c3dc +0x044 LoadedImports : 0x5618c3dc Void +0x048 EntryPointActivationContext : 0x00153960 Void +0x04c PatchInformation : (null)
可以看到正在加载someapp.dll，并且处理导入表的时候出了错。来看看这个模块的导入表
0:000> !dh someapp -f File Type: DLL FILE HEADER VALUES 14C machine (i386) 6 number of sections 5618C3DC time date stamp Sat Oct 10 15:53:00 2015 0 file pointer to symbol table 0 number of symbols E0 size of optional header 2102 characteristics Executable 32 bit word machine DLL OPTIONAL HEADER VALUES 10B magic # 10.00 linker version 27A00 size of code 15C00 size of initialized data 0 size of uninitialized data 21AE4 address of entry point 1000 base of code ----- new ----- 10000000 image base 1000 section alignment 200 file alignment 2 subsystem (Windows GUI) 5.01 operating system version 0.00 image version 5.01 subsystem version 43000 size of image 400 size of headers 4943E checksum 00100000 size of stack reserve 00001000 size of stack commit 00100000 size of heap reserve 00001000 size of heap commit 140 DLL characteristics Dynamic base NX compatible 34BE0 [ 1E0] address [size] of Export Directory 33810 [ B4] address [size] of Import Directory 3A000 [ 4CC] address [size] of Resource Directory 0 [ 0] address [size] of Exception Directory 0 [ 0] address [size] of Security Directory 3B000 [ 3954] address [size] of Base Relocation Directory 29340 [ 1C] address [size] of Debug Directory 0 [ 0] address [size] of Description Directory 0 [ 0] address [size] of Special Directory 2DD80 [ 18] address [size] of Thread Storage Directory 2DD38 [ 40] address [size] of Load Configuration Directory 0 [ 0] address [size] of Bound Import Directory 29000 [ 2CC] address [size] of Import Address Table Directory 0 [ 0] address [size] of Delay Import Directory 0 [ 0] address [size] of COR20 Header Directory 0 [ 0] address [size] of Reserved Directory 0:000> dc someapp+33810 someapp+33810+B4 003d3810 60325c32 68326432 90326c32 b332af32 2\2`2d2h2l2.2.2. 003d3820 d132ca32 df32db32 0032fc32 30332033 2.2.2.2.2.2.3 30 003d3830 40333833 4c334833 54335033 5c335833 383@3H3L3P3T3X3\ 003d3840 64336033 6c336833 74337033 7c337833 3`3d3h3l3p3t3x3| 003d3850 84338033 8c338833 94339033 ce33b433 3.3.3.3.3.3.3.3. 003d3860 e933d233 f733f333 b134a633 0434e134 3.3.3.3.3.4.4.4. 003d3870 44353935 94357135 d435c935 57361a35 595D5q5.5.5.5.6W 003d3880 be366736 0c36d036 4b374037 b3377b37 6g6.6.6.7@7K7{7. 003d3890 ea37cf37 45380e37 81385e38 a0388a38 7.7.7.8E8^8.8.8. 003d38a0 fb38d338 4b392438 a4399939 0039dd39 8.8.8$9K9.9.9.9. 003d38b0 403a353a c33a863a 2a3ad33a 6b3b3c3b :5:@:.:.:.:*;<;k 003d38c0 cf3b933b 1d3bea3b ;.;.;.;.
所以这样就清楚了，someapp.dll的输入表被破坏了，导致加载他的程序无法运行起来。