Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Debugging specific access violation in JNI module

I'm trying to debug Access Violation error in C++ components running in process of Java-based service via JNI with WinDBG. There are two problems I currently face:

  1. Java itself uses first-chance access violation exceptions to do some internal thread syncronization (at least that's how it seems), so I can't just break on all first-chance access violations (according to Java bugs database this is intended behavior, so we should not expect any fix)
  2. Exception is handled in outer code (that should protect production environment against misbehaving of C++ code)

Currently I see one way to distinguish between Java's AV and mine - Java's are happening at the addresses that belong to modules that does not have any symbols loaded, or at any other point of the memory, and I'm interested in catching AVs that happen at the places that have symbols loaded.

Seems I have all elements on how to achieve it with WinDbg, but can't assemble them together:

sxe -c ".if (ln) {gN}" av

The problem is I can't specify input of ln command in .if statement (because it expects an expression), and also I'm not sure how to check if output of ln is empty.

like image 704
Alex Z Avatar asked Mar 11 '26 01:03

Alex Z


1 Answers

Interesting case ! I think using ln and check the output will be terrible slow (and don’t know how to do it either). A slightly different approach: The pseudo @$ip should contain the address of the exception

First chance exceptions are reported before any exception handling.
 <cut cut >
 eip=0041625d
 0:000> r @$ip
 $ip=0041625d

Use the rebase utility to change the default load address for your .dll's to a high values and hope they all are loaded up there.

Then you can test on: @$ip > “RebaseAddr”

like image 74
Kjell Gunnar Avatar answered Mar 12 '26 17:03

Kjell Gunnar



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!