c++windowskerneldriverwindbg

Zero values for stack base and stack limit addresses in NT_TIB struct (Kernel Mode Windows)


When running the !pcr command in Windbg, the NT_TIB structure shows zeros for StackBase and StackLimit. I am debugging drivers on Windows 7 x32 Ultimate using Windbg via COM port. OS is running on VMWare.

kd> !pcr
KPCR for Processor 0 at 8296ec00:
    Major 1 Minor 1
    NtTib.ExceptionList: 8296b0ac
        NtTib.StackBase: 00000000
       NtTib.StackLimit: 00000000
     NtTib.SubSystemTib: 801db000
          NtTib.Version: 000140f2
      NtTib.UserPointer: 00000001
          NtTib.SelfTib: 00000000

                SelfPcr: 8296ec00
                   Prcb: 8296ed20
                   Irql: 0000001f
                    IRR: 00000000
                    IDR: ffffffff
          InterruptMode: 00000000
                    IDT: 80b95400
                    GDT: 80b95000
                    TSS: 801db000

          CurrentThread: 82978380
             NextThread: 00000000
             IdleThread: 82978380

              DpcQueue:

Is it possible to get valid stack base and limit adresses on Win7 x32? I need to verify, that SEH Registration address is valid and locates between system thread's stack base address and it's limit address. In the link below you can see, that it takes those values from FS registry, but in my case those values are zeros. Please correct me if I'm wrong about the meaning of _stack_limit and _stack_base in the avakar's implementation

https://github.com/avakar/vcrtl/blob/b0e858052f1d2afee3d6ed7182bff399e92793b5/src/x86/throw_x86.cpp#L90


Solution

  • As an alternative way to validate these addresses I use `IoWithinStackLimits` function (msdn)

    The IoWithinStackLimits routine determines whether a region of memory is within the stack limit of the current thread.