拿到程序初始化失败的DUMP,一般情况下我们看到的栈是这个样子的:

0:000> kb
ChildEBP RetAddr  Args to Child              
0012fc7c 7c92d9ca 7c972b53 c0000145 00000001 ntdll!KiFastSystemCallRet
0012fc80 7c972b53 c0000145 00000001 00000000 ntdll!NtRaiseHardError+0xc
0012fca4 7c960f9f c0000005 0012fd30 00370034 ntdll!LdrpInitializationFailure+0x2d
0012fd1c 7c92e457 0012fd30 7c920000 00000000 ntdll!_LdrpInitialize+0x1f9
00000000 00000000 00000000 00000000 00000000 ntdll!KiUserApcDispatcher+0x7

0:000> !error c0000145
Error code: (NTSTATUS) 0xc0000145 (3221225797) - {Application Error}  The application was unable to start correctly (0x%lx). Click OK to close the application.

0:000> !error c0000005
Error code: (NTSTATUS) 0xc0000005 (3221225477) - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

可以看到最后报错是c0000145,应用程序无法运行。而引起出错的是LdrpInitializationFailure,出错原因内存访问异常。但是具体是哪出错还不无法从此刻的栈看到,我们需要进一步分析。

0:000> dds esp-1000 esp
...
0012f3c0  7c92e920 ntdll!_except_handler3
0012f3c4  00000001
0012f3c8  0012f470
0012f3cc  0012fd0c
0012f3d0  7c953fdc ntdll!RtlDispatchException+0xb1
0012f3d4  0012f470
0012f3d8  0012fd0c
0012f3dc  0012f48c
0012f3e0  0012f444
0012f3e4  7c92e920 ntdll!_except_handler3
0012f3e8  003d3810 someapp!PostMsg+0x27aa0
0012f3ec  0012f470
0012f3f0  b36caf32
0012f3f4  00153960
0012f3f8  7c93e584 ntdll!DbgPrint+0x1c
0012f3fc  00150178
0012f400  000000e8
0012f404  00000668
0012f408  00150000
0012f40c  0012f204
0012f410  7c940571 ntdll!RtlCreateActivationContext+0x2c
0012f414  c0000000
0012f418  00153960
0012f41c  003f0000
0012f420  00000000
0012f424  0012f444
0012f428  7c940610 ntdll!RtlCreateActivationContext+0xed
0012f42c  001539b4
0012f430  00000002
0012f434  00000008
0012f438  00000000
0012f43c  00000000
0012f440  00000000
0012f444  0012f750
0012f448  7c814880 kernel32!CreateActCtxW+0x75c
0012f44c  00130000
0012f450  0012d000
0012f454  00000000
0012f458  0012f76c
0012f45c  7c92e48a ntdll!KiUserExceptionDispatcher+0xe
0012f460  00000000
0012f464  0012f48c
0012f468  0012f470
0012f46c  0012f48c
0012f470  c0000005
0012f474  00000000
0012f478  00000000
0012f47c  7c93ccf2 ntdll!LdrpHandleOneOldFormatImportDescriptor+0x21
0012f480  00000002
0012f484  00000000
0012f488  d16cca32
0012f48c  0001003f
...

这里我们就可以看到异常发生的栈了。

0:000> .exr 0012f470
ExceptionAddress: 7c93ccf2 (ntdll!LdrpHandleOneOldFormatImportDescriptor+0x00000021)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: d16cca32
Attempt to read from address d16cca32

0:000> .cxr 0012f48c
eax=003a0000 ebx=00253010 ecx=d132ca32 edx=00033810 esi=b36caf32 edi=003d3810
eip=7c93ccf2 esp=0012f758 ebp=0012f76c iopl=0         nv up ei ng nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010282
ntdll!LdrpHandleOneOldFormatImportDescriptor+0x21:
7c93ccf2 833c0800        cmp     dword ptr [eax+ecx],0 ds:0023:d16cca32=????????
0:000> kb
  *** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr  Args to Child              
0012f76c 7c93ccc4 7ffd9000 00020498 00253010 ntdll!LdrpHandleOneOldFormatImportDescriptor+0x21
0012f784 7c93bc1e 7ffd9000 00020498 00253010 ntdll!LdrpHandleOldFormatImportDescriptors+0x1f
0012f800 7c93d216 00020498 00253010 00434398 ntdll!LdrpWalkImportDescriptor+0x19e
0012fa50 7c93cd1d 00020498 004396ca 00400000 ntdll!LdrpLoadImportModule+0x1c8
0012fa80 7c93ccc4 7ffd9000 00020498 00251ec0 ntdll!LdrpHandleOneOldFormatImportDescriptor+0x5e
0012fa98 7c93bc1e 7ffd9000 00020498 00251ec0 ntdll!LdrpHandleOldFormatImportDescriptors+0x1f
0012fb14 7c9418b5 00020498 00251ec0 7ffdf000 ntdll!LdrpWalkImportDescriptor+0x19e
0012fc94 00000000 0012fca0 00000000 0012fd1c ntdll!LdrpInitializeProcess+0xe02

0:000> dt ntdll!_LDR_DATA_TABLE_ENTRY 00253010 
   +0x000 InLoadOrderLinks : _LIST_ENTRY [ 0x251e9c - 0x252ee0 ]
   +0x008 InMemoryOrderLinks : _LIST_ENTRY [ 0x251ea4 - 0x252ee8 ]
   +0x010 InInitializationOrderLinks : _LIST_ENTRY [ 0x0 - 0x0 ]
   +0x018 DllBase          : 0x003a0000 Void
   +0x01c EntryPoint       : 0x003c1ae4 Void
   +0x020 SizeOfImage      : 0x43000
   +0x024 FullDllName      : _UNICODE_STRING "C:\Program Files\S-dir\Some-dir\someapp.dll"
   +0x02c BaseDllName      : _UNICODE_STRING "someapp.dll"
   +0x034 Flags            : 0x200006
   +0x038 LoadCount        : 0
   +0x03a TlsIndex         : 0
   +0x03c HashLinks        : _LIST_ENTRY [ 0x7c99e2f0 - 0x252a5c ]
   +0x03c SectionPointer   : 0x7c99e2f0 Void
   +0x040 CheckSum         : 0x252a5c
   +0x044 TimeDateStamp    : 0x5618c3dc
   +0x044 LoadedImports    : 0x5618c3dc Void
   +0x048 EntryPointActivationContext : 0x00153960 Void
   +0x04c PatchInformation : (null) 
   

可以看到正在加载someapp.dll,并且处理导入表的时候出了错。来看看这个模块的导入表

0:000> !dh someapp -f

File Type: DLL
FILE HEADER VALUES
     14C machine (i386)
       6 number of sections
5618C3DC time date stamp Sat Oct 10 15:53:00 2015

       0 file pointer to symbol table
       0 number of symbols
      E0 size of optional header
    2102 characteristics
            Executable
            32 bit word machine
            DLL

OPTIONAL HEADER VALUES
     10B magic #
   10.00 linker version
   27A00 size of code
   15C00 size of initialized data
       0 size of uninitialized data
   21AE4 address of entry point
    1000 base of code
         ----- new -----
10000000 image base
    1000 section alignment
     200 file alignment
       2 subsystem (Windows GUI)
    5.01 operating system version
    0.00 image version
    5.01 subsystem version
   43000 size of image
     400 size of headers
   4943E checksum
00100000 size of stack reserve
00001000 size of stack commit
00100000 size of heap reserve
00001000 size of heap commit
     140  DLL characteristics
            Dynamic base
            NX compatible
   34BE0 [     1E0] address [size] of Export Directory
   33810 [      B4] address [size] of Import Directory
   3A000 [     4CC] address [size] of Resource Directory
       0 [       0] address [size] of Exception Directory
       0 [       0] address [size] of Security Directory
   3B000 [    3954] address [size] of Base Relocation Directory
   29340 [      1C] address [size] of Debug Directory
       0 [       0] address [size] of Description Directory
       0 [       0] address [size] of Special Directory
   2DD80 [      18] address [size] of Thread Storage Directory
   2DD38 [      40] address [size] of Load Configuration Directory
       0 [       0] address [size] of Bound Import Directory
   29000 [     2CC] address [size] of Import Address Table Directory
       0 [       0] address [size] of Delay Import Directory
       0 [       0] address [size] of COR20 Header Directory
       0 [       0] address [size] of Reserved Directory

0:000> dc someapp+33810 someapp+33810+B4
003d3810  60325c32 68326432 90326c32 b332af32  2\2`2d2h2l2.2.2.
003d3820  d132ca32 df32db32 0032fc32 30332033  2.2.2.2.2.2.3 30
003d3830  40333833 4c334833 54335033 5c335833  [email protected]\
003d3840  64336033 6c336833 74337033 7c337833  3`3d3h3l3p3t3x3|
003d3850  84338033 8c338833 94339033 ce33b433  3.3.3.3.3.3.3.3.
003d3860  e933d233 f733f333 b134a633 0434e134  3.3.3.3.3.4.4.4.
003d3870  44353935 94357135 d435c935 57361a35  595D5q5.5.5.5.6W
003d3880  be366736 0c36d036 4b374037 b3377b37  [email protected]{7.
003d3890  ea37cf37 45380e37 81385e38 a0388a38  7.7.7.8E8^8.8.8.
003d38a0  fb38d338 4b392438 a4399939 0039dd39  8.8.8$9K9.9.9.9.
003d38b0  403a353a c33a863a 2a3ad33a 6b3b3c3b  :5:@:.:.:.:*;<;k
003d38c0  cf3b933b 1d3bea3b                    ;.;.;.;.

所以这样就清楚了,someapp.dll的输入表被破坏了,导致加载他的程序无法运行起来。