From b312973f90dcee248bdd623d47eb71f83baf8670 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Herm=C3=A8s=20B=C3=A9lusca-Ma=C3=AFto?= Date: Tue, 19 Aug 2025 15:39:34 +0200 Subject: [PATCH] ** wip ** Diagnose SEH2 crashes --- ntoskrnl/dbgk/dbgkobj.c | 6 ++++-- subsystems/csr/csrsrv/api.c | 14 ++++++++++++++ 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/ntoskrnl/dbgk/dbgkobj.c b/ntoskrnl/dbgk/dbgkobj.c index 4b480a2cbf9..3eb94e3a7c1 100644 --- a/ntoskrnl/dbgk/dbgkobj.c +++ b/ntoskrnl/dbgk/dbgkobj.c @@ -325,8 +325,10 @@ DbgkForwardException(IN PEXCEPTION_RECORD ExceptionRecord, PVOID Port; BOOLEAN UseLpc = FALSE; PAGED_CODE(); - DBGKTRACE(DBGK_EXCEPTION_DEBUG, - "ExceptionRecord: %p Port: %u\n", ExceptionRecord, DebugPort); + //DBGKTRACE(DBGK_EXCEPTION_DEBUG, + DbgPrint("DbgkForwardException: ExceptionRecord: %p (ExceptionCode: 0x%x, ExceptionAddress: 0x%p), Port: %s, SecondChance: %s\n", + ExceptionRecord, ExceptionRecord->ExceptionCode, ExceptionRecord->ExceptionAddress, + DebugPort ? "TRUE" : "FALSE", SecondChance ? "TRUE" : "FALSE"); /* Setup the API Message */ ApiMessage.h.u1.Length = sizeof(DBGKM_MSG) << 16 | diff --git a/subsystems/csr/csrsrv/api.c b/subsystems/csr/csrsrv/api.c index 07b8db3749c..cff03aa84fb 100644 --- a/subsystems/csr/csrsrv/api.c +++ b/subsystems/csr/csrsrv/api.c @@ -666,6 +666,20 @@ CsrApiRequestThread(IN PVOID Parameter) if (MessageType == LPC_EXCEPTION) { /* Kill the process */ + PDBGKM_EXCEPTION DbgExp = &(((PDBGKM_MSG)&ReceiveMsg)->Exception); + PEXCEPTION_RECORD Record = &DbgExp->ExceptionRecord; + DbgPrint("CsrApiRequestThread() - Got LPC_EXCEPTION with:\n" + " ExceptionCode: 0x%lx, flags 0x%lx, ExceptionAddress: 0x%p ; IsFirstChance: %s\n", + Record->ExceptionCode, + Record->ExceptionFlags, + Record->ExceptionAddress, + DbgExp->FirstChance ? "TRUE" : "FALSE"); + for (DWORD n = 0; n < min(EXCEPTION_MAXIMUM_PARAMETERS, Record->NumberParameters); ++n) + { + DbgPrint(" Info[%u]: 0x%p\n", n, (PVOID)Record->ExceptionInformation[n]); + } + DbgPrint("CsrApiRequestThread() - LPC_EXCEPTION invoking NtTerminateProcess(ProcessHandle 0x%p, %lu)\n", + CsrProcess->ProcessHandle, STATUS_ABANDONED); NtTerminateProcess(CsrProcess->ProcessHandle, STATUS_ABANDONED); /* Destroy it from CSR */ -- 2.46.2.windows.1