题目furryCTF 2025 赛前热身\MSIC\PassDump解题用WinDbg打开文件加载较慢等待加载完成加载完成分析崩溃转储文件执行命令!analyze-v!analyze -v是 WinDbgWindows 调试器中的一个扩展命令用于自动分析崩溃转储文件并提供详细的错误信息。!analyze这是 WinDbg 的自动化分析引擎会自动检查当前的崩溃转储尝试找出问题的根本原因!前缀表示这是一个扩展命令不是内置命令-v参数v verbose详细模式让分析结果显示最详细的信息不加-v只显示简要摘要加上后显示完整分析报告输出内容解读当运行!analyze -v会得到类似你之前看到的输出Bugcheck Analysis- 错误类型和描述Arguments- 错误的具体参数STACK_TEXT- 调用堆栈SYMBOL_NAME- 出问题的模块FAILURE_BUCKET_ID- 错误分类IDFollowup- 建议的跟进方分析报告Loading unloaded module list......................................... For analysis of this file, run!analyze-vnt!KeBugCheckEx: fffff803b1f00450 48894c2408 mov qword ptr[rsp8],rcx ss:ffffc9821c9677e0000000000000011612: kd!analyze-vLoading Kernel Symbols..Press ctrl-c(cdb, kd, ntsd)or ctrl-break(windbg)to abort symbol loads that take too long. Run!sym noisy before .reload to track down problems loading symbols............................................................................................................................................................................................................................................................................................................Loading User Symbols Loading unloaded module list......................................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* VIDEO_TDR_FAILURE(116)Attempt to reset the display driver and recover fromtimeoutfailed. Arguments: Arg1: ffffe30a4b8cd010, Optional pointer to internal TDR recovery context(TDR_RECOVERY_CONTEXT). Arg2: fffff8035ce14790, The pointer into responsible device driver module(e.g. owner tag). Arg3: ffffffffc000009a, Optional error code(NTSTATUS)of the last failed operation. Arg4: 0000000000000004, Optional internal context dependent data. Debugging Details: ------------------ Unable to load image nvlddmkm.sys, Win32 error 0n2 *** WARNING: Unable to verify timestampfornvlddmkm.sys KEY_VALUES_STRING:1Key:Analysis.CPU.mSec Value:4359Key:Analysis.Elapsed.mSec Value:71395Key:Analysis.IO.Other.Mb Value:0Key:Analysis.IO.Read.Mb Value:1Key:Analysis.IO.Write.Mb Value:1Key:Analysis.Init.CPU.mSec Value:1062Key:Analysis.Init.Elapsed.mSec Value:68685Key:Analysis.Memory.CommitPeak.Mb Value:102Key:Analysis.Version.DbgEng Value:10.0.29507.1001 Key:Analysis.Version.Description Value:10.2511.5.1 amd64fre Key:Analysis.Version.Ext Value:1.2511.5.1 Key:Bugcheck.Code.LegacyAPI Value: 0x116 Key:Bugcheck.Code.TargetModel Value: 0x116 Key:Dump.Attributes.AsUlong Value: 0x21808 Key:Dump.Attributes.DiagDataWrittenToHeader Value:1Key:Dump.Attributes.ErrorCode Value: 0x0 Key:Dump.Attributes.KernelGeneratedTriageDump Value:1Key:Dump.Attributes.LastLine Value: Dump completed successfully. Key:Dump.Attributes.ProgressPercentage Value:0Key:Failure.Bucket Value: 0x116_IMAGE_nvlddmkm.sys Key:Failure.Exception.IP.Address Value: 0xfffff8035ce14790 Key:Failure.Exception.IP.Module Value: nvlddmkm Key:Failure.Exception.IP.Offset Value: 0x1854790 Key:Failure.Hash Value:{c89bfe8c-ed39-f658-ef27-f2898997fdbd}Key:Faulting.IP.Type Value: Paged Key:Hypervisor.Enlightenments.ValueHex Value: 0x7417df84 Key:Hypervisor.Flags.AnyHypervisorPresent Value:1Key:Hypervisor.Flags.ApicEnlightened Value:0Key:Hypervisor.Flags.ApicVirtualizationAvailable Value:1Key:Hypervisor.Flags.AsyncMemoryHint Value:0Key:Hypervisor.Flags.CoreSchedulerRequested Value:0Key:Hypervisor.Flags.CpuManager Value:1Key:Hypervisor.Flags.DeprecateAutoEoi Value:1Key:Hypervisor.Flags.DynamicCpuDisabled Value:1Key:Hypervisor.Flags.Epf Value:0Key:Hypervisor.Flags.ExtendedProcessorMasks Value:1Key:Hypervisor.Flags.HardwareMbecAvailable Value:1Key:Hypervisor.Flags.MaxBankNumber Value:0Key:Hypervisor.Flags.MemoryZeroingControl Value:0Key:Hypervisor.Flags.NoExtendedRangeFlush Value:0Key:Hypervisor.Flags.NoNonArchCoreSharing Value:1Key:Hypervisor.Flags.Phase0InitDone Value:1Key:Hypervisor.Flags.PowerSchedulerQos Value:0Key:Hypervisor.Flags.RootScheduler Value:0Key:Hypervisor.Flags.SynicAvailable Value:1Key:Hypervisor.Flags.UseQpcBias Value:0Key:Hypervisor.Flags.Value Value:55185662Key:Hypervisor.Flags.ValueHex Value: 0x34a10fe Key:Hypervisor.Flags.VpAssistPage Value:1Key:Hypervisor.Flags.VsmAvailable Value:1Key:Hypervisor.RootFlags.AccessStats Value:1Key:Hypervisor.RootFlags.CrashdumpEnlightened Value:1Key:Hypervisor.RootFlags.CreateVirtualProcessor Value:1Key:Hypervisor.RootFlags.DisableHyperthreading Value:0Key:Hypervisor.RootFlags.HostTimelineSync Value:1Key:Hypervisor.RootFlags.HypervisorDebuggingEnabled Value:0Key:Hypervisor.RootFlags.IsHyperV Value:1Key:Hypervisor.RootFlags.LivedumpEnlightened Value:1Key:Hypervisor.RootFlags.MapDeviceInterrupt Value:1Key:Hypervisor.RootFlags.MceEnlightened Value:1Key:Hypervisor.RootFlags.Nested Value:0Key:Hypervisor.RootFlags.StartLogicalProcessor Value:1Key:Hypervisor.RootFlags.Value Value:1015Key:Hypervisor.RootFlags.ValueHex Value: 0x3f7 Key:WER.System.BIOSRevision Value:1.23.0.0 BUGCHECK_CODE:116BUGCHECK_P1: ffffe30a4b8cd010 BUGCHECK_P2: fffff8035ce14790 BUGCHECK_P3: ffffffffc000009a BUGCHECK_P4:4FILE_IN_CAB: furryCTF.dmp DUMP_FILE_ATTRIBUTES: 0x21808 Kernel Generated Triage Dump FAULTING_THREAD: ffffe30a86af3040 VIDEO_TDR_CONTEXT: dt dxgkrnl!_TDR_RECOVERY_CONTEXT ffffe30a4b8cd010 Symbol dxgkrnl!_TDR_RECOVERY_CONTEXT not found. PROCESS_OBJECT: 0000000000000004 BLACKBOXACPI:1(!blackboxacpi)BLACKBOXBSD:1(!blackboxbsd)BLACKBOXNTFS:1(!blackboxntfs)BLACKBOXPNP:1(!blackboxpnp)BLACKBOXWINLOGON:1(!blackboxwinlogon)PROCESS_NAME: System IP_IN_PAGED_CODE: nvlddmkm1854790 fffff8035ce14790 488b05b9f28dff mov rax,qword ptr[nvlddmkm0x1133a50(fffff8035c6f3a50)]STACK_TEXT: ffffc9821c9677d8 fffff80343a2375d:0000000000000116 ffffe30a4b8cd010 fffff8035ce14790 ffffffffc000009a:nt!KeBugCheckEx ffffc9821c9677e0 fffff80343c97be6:fffff8035ce14790 ffffe30a5b80b5a0 0000000000000004 ffffe30a4b8cd010:dxgkrnl!TdrBugcheckOnTimeout0x101 ffffc9821c967820 fffff80343a324be:0000000000000000 0000000000002000 0000000000000004 0000000000000004:dxgkrnl!ADAPTER_RENDER::Reset0x232 ffffc9821c967850 fffff80343a69375:ffffe30a00000100 0000000000000000 ffffc98200000000 0000000000000000:dxgkrnl!DXGADAPTER::Reset0x59a ffffc9821c9678e0 fffff80343a694d2:fffff803b290ce60 0000000000000000 ffffb881c42d1100 fffff803b29cfbc0:dxgkrnl!TdrResetFromTimeout0x15 ffffc9821c967910 fffff803b1c3072c:ffffe30a86af3040 ffffe30a478ddae0 ffffe30a478dda00 fffff80344b52750:dxgkrnl!TdrResetFromTimeoutWorkItem0x22 ffffc9821c967950 fffff803b1ea007a:ffffe30a86af3040 ffffe30a86af3040 fffff803b1c30140 ffffe30a478ddae0:nt!ExpWorkerThread0x5ec ffffc9821c967b30 fffff803b20a5db4:ffffb881c42d1180 ffffe30a86af3040 fffff803b1ea0020 000000000e5f57dc:nt!PspSystemThreadStartup0x5a ffffc9821c967b80 0000000000000000:ffffc9821c968000 ffffc9821c961000 0000000000000000 0000000000000000:nt!KiStartSystemThread0x34 SYMBOL_NAME: nvlddmkm1854790 MODULE_NAME: nvlddmkm IMAGE_NAME: nvlddmkm.sys STACK_COMMAND: .process /r /p 0xffffe30a476cb040;.thread 0xffffe30a86af3040;kb FAILURE_BUCKET_ID: 0x116_IMAGE_nvlddmkm.sys OSPLATFORM_TYPE: x64 OSNAME: Windows10FAILURE_ID_HASH:{c89bfe8c-ed39-f658-ef27-f2898997fdbd}Followup: MachineOwner ---------这是一个Windows蓝屏崩溃转储文件的分析结果解释其中的关键内容错误概述错误代码:VIDEO_TDR_FAILURE (116)- 显卡驱动超时恢复失败问题本质: 显卡驱动在指定时间内没有响应系统尝试重置驱动但失败了崩溃参数含义Arg1: ffffe30a4b8cd010 - TDR恢复上下文的内存地址 Arg2: fffff8035ce14790 - 出问题的驱动模块地址指向nvlddmkm.sys Arg3: ffffffffc000009a - 错误码STATUS_DEVICE_DATA_ERROR设备数据错误 Arg4: 0000000000000004 - 内部上下文数据涉及模块nvlddmkm.sys-NVIDIA显卡驱动导致崩溃的驱动系统无法加载此驱动的符号文件Win32 error 0n2 文件找不到崩溃进程PROCESS_NAME: System- 崩溃发生在系统进程中说明是内核级别的显卡问题堆栈跟踪分析堆栈显示调用链nt!KeBugCheckEx- 系统发出崩溃检查dxgkrnl!TdrBugcheckOnTimeout- DirectX图形内核检测到TDR超时nvlddmkm1854790- NVIDIA驱动的特定代码位置触发了问题最后几行含义解释SYMBOL_NAME: nvlddmkm1854790符号名称指示崩溃发生在NVIDIA驱动模块的偏移量0x1854790处这是驱动内的具体函数位置MODULE_NAME: nvlddmkm出问题的模块是NVIDIA显卡驱动IMAGE_NAME: nvlddmkm.sys导致崩溃的具体文件是NVIDIA驱动的系统文件FAILURE_BUCKET_ID: 0x116_IMAGE_nvlddmkm.sys微软用于分类错误的唯一标识表明这是由NVIDIA驱动引起的TDR错误类型Followup: MachineOwner建议由计算机所有者通常是设备制造商或微软跟进处理问题根源总结NVIDIA显卡驱动(nvlddmkm.sys)超时导致系统尝试重置显卡但重置过程也失败了。这通常与以下因素有关显卡驱动版本不兼容或损坏显卡硬件问题过热、供电不足DirectX图形处理超时建议操作使用DDU完全卸载当前NVIDIA驱动安装最新稳定版NVIDIA驱动如果问题持续可能是显卡硬件故障查看最后一次编译时间使用lm v m nvlddmkm命令查看 NVIDIA 驱动模块详细信息的输出。lmvm nvlddmkm12: kdlmvm nvlddmkm Browse full module list start end module name fffff8035b5c0000 fffff803612ff000 nvlddmkm T(no symbols)Loaded symbol image file: nvlddmkm.sys Image path: nvlddmkm.sys Image name: nvlddmkm.sys Browse all global symbols functions data Symbol Reload Timestamp: Tue Feb1113:40:162025(67AAE2C0)CheckSum: 05B57FA7 ImageSize: 05D3F000 Mapping Form: Loaded Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 Information from resource tables:命令解析lm- List Modules列出模块v- verbose详细模式m nvlddmkm- match匹配名称只显示 nvlddmkm 模块模块基本信息start end module name fffff8035b5c0000 fffff803612ff000 nvlddmkm T (no symbols)start/end: 模块在内存中的起始和结束地址起始:fffff8035b5c0000结束:fffff803612ff000大小: 约 93.7 MB (0x5D3F000 字节)T: 表示这是内核模块(Kernel mode)(no symbols):没有加载符号文件意味着无法看到函数名等调试信息文件信息Loaded symbol image file: nvlddmkm.sys # 实际加载的镜像文件 Image path: nvlddmkm.sys # 文件路径当前目录 Image name: nvlddmkm.sys # 文件名时间戳Timestamp: Tue Feb 11 13:40:16 2025 (67AAE2C0)这是驱动编译的时间戳这个驱动是2025年2月11日编译的括号内是16进制时间戳值校验信息CheckSum: 05B57FA7 # 文件校验和用于验证完整性 ImageSize: 05D3F000 # 镜像大小十六进制CheckSum: 文件的理论校验值ImageSize: 0x5D3F000 ≈ 97.7 MB格式信息Mapping Form: Loaded # 映射方式已加载 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 # 字符集转换信息Translations: 表示支持的语言编码04b0: Unicode04e4: 其他编码0409: 美国英语“(no symbols)” 的含义调试器没有找到这个驱动的符号文件.pdb意味着只能看到内存地址看不到函数名原因可能是符号文件不存在符号路径配置错误这是第三方驱动公共符号不完整对调试的影响有符号文件时可以显示nvlddmkm!DriverEntry0x100 # 显示函数名无符号文件时只能显示nvlddmkm0x1854790 # 只有偏移地址如何解决符号问题# 设置符号路径微软公共符号服务器.sympath SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols# 重新加载符号.reload /f nvlddmkm.sys这个命令输出告诉我们这是一个2025年2月编译的NVIDIA驱动目前位于内存地址fffff8035b5c0000到fffff803612ff000之间但因为缺少符号文件无法看到内部的函数名称。构造正确的 flag1. 出现问题的文件从IMAGE_NAME: nvlddmkm.sys可知出问题的文件是nvlddmkm.sys。2. 蓝屏错误代码从BUGCHECK_CODE: 116可知错误代码为0x116。3. 该文件的最后一次编译时间lm v m nvlddmkm输出里有Timestamp: Tue Feb 11 13:40:16 2025 (67AAE2C0)文件编译时间是2025.02.11-13:40:16但我们需要转换为YYYY.MM.DD-HH:MM:SS格式。得到2025.02.11-13:40:164. 失败事件的缩写错误代码0x116对应VIDEO_TDR_FAILURE。TDR Timeout, Detection, and Recovery。缩写为TDR。5. 当时正在使用的应用程序名称PROCESS_NAME: System表示崩溃发生时在System 进程系统空闲/内核线程上下文中。所以应用程序名称应为System。组合起来furryCTF{nvlddmkm.sys_0x116_2025.02.11-13:40:16_TDR_System}