Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Jun 2015 20:52:03 -0400
From: Mathieu Laprise <mathlaprise@...il.com>
To: john-dev@...ts.openwall.com
Subject: Re: Jumbo & Johnny Windows Problem (was Windows event loop)

>
> On Jun 10, 2015, at 9:53 PM, Mathieu Laprise <mathlaprise@...il.com>
> wrote:
>
>
> On Wed, Jun 10, 2015 at 2:43 PM, Shinnok <admin@...nnok.com> wrote:
> I modified the permission for the dmp, it should be downloadable now. But
> yeah, I'm not sure either about how useful this dmp is. I've never used
> GDB, I'll try what you said.
>
> Thanks for digging further. The dmp on GDrive requires permissions
> somehow. Still not sure how useful is that dmp.
> A better approach would be to attach to the spawned JtR with the gdb in
> cygwin and then make it crash. GDB should pause and offer a stack trace.
> Then you can follow with the usual GDB commands such as:
> * bt all
> * info locals
> * info threads
> * info registers
> http://users.ece.utexas.edu/~adnan/gdb-refcard.pdf
>
> Here is what happened with GDB(.txt file attached of output)

[ CONTENT OF TYPE text/html SKIPPED ]

(gdb) attach 7004
Attaching to program `/cygdrive/c/Users/Mathieu/Desktop/JuinJohnny/JohnTheRipper/run/john.exe', process 7004
[New Thread 7004.0x1d24]
[New Thread 7004.0xdf8]
[New Thread 7004.0x444]
[New Thread 7004.0x2638]
[New Thread 7004.0x21b4]
[New Thread 7004.0x1494]
[New Thread 7004.0x1554]
[New Thread 7004.0x26cc]
[New Thread 7004.0x948]
[New Thread 7004.0x1928]
0x77886f81 in ntdll!DbgBreakPoint ()
   from /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll
(gdb) continue
Continuing.
[Thread 7004.0x1928 exited with code 0]
[New Thread 7004.0x1f04]

Program received signal SIGINT, Interrupt.
[Switching to Thread 7004.0x1f04]
0x75ee22cb in KERNELBASE!CtrlRoutine ()
   from /cygdrive/c/WINDOWS/SYSTEM32/KERNELBASE.dll
(gdb) bt
#0  0x75ee22cb in KERNELBASE!CtrlRoutine ()
   from /cygdrive/c/WINDOWS/SYSTEM32/KERNELBASE.dll
#1  0xf9269dfa in ?? ()
#2  0x6100626b in _cygtls::call2(unsigned long (*)(void*, void*), void*, void*)
    ()
   from /cygdrive/c/Users/Mathieu/Desktop/JuinJohnny/JohnTheRipper/run/cygwin1.dll
#3  0x61006306 in _cygtls::call(unsigned long (*)(void*, void*), void*) ()
   from /cygdrive/c/Users/Mathieu/Desktop/JuinJohnny/JohnTheRipper/run/cygwin1.dll
#4  0x61082728 in threadfunc_fe(void*) ()
   from /cygdrive/c/Users/Mathieu/Desktop/JuinJohnny/JohnTheRipper/run/cygwin1.dll
#5  0x75ad7c04 in KERNEL32!BaseThreadInitThunk ()
   from /cygdrive/c/WINDOWS/SYSTEM32/KERNEL32.DLL
#6  0x778bad1f in ntdll!RtlInitializeExceptionChain ()
   from /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll
#7  0x778bacea in ntdll!RtlInitializeExceptionChain ()
   from /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll
#8  0x00000000 in ?? ()
(gdb) bt all
No symbol "all" in current context.
(gdb) info locals
No symbol table info available.
(gdb) info threads
  Id   Target Id         Frame
* 11   Thread 7004.0x1f04 0x75ee22cb in KERNELBASE!CtrlRoutine ()
   from /cygdrive/c/WINDOWS/SYSTEM32/KERNELBASE.dll
  9    Thread 7004.0x948 0x005f4f37 in SSEmd5body (
    _data=_data@...ry=0xfe3fa860, out=<optimized out>, out@...ry=0xfe3f9ae0,
    reload_state=<optimized out>, reload_state@...ry=0x0,
    SSEi_flags=SSEi_flags@...ry=0) at sse-intrinsics.c:256
  8    Thread 7004.0x26cc 0x005f48ac in SSEmd5body (
    _data=_data@...ry=0xfe4fba60, out=<optimized out>, out@...ry=0xfe4f9ae0,
    reload_state=<optimized out>, reload_state@...ry=0x0,
    SSEi_flags=SSEi_flags@...ry=0) at sse-intrinsics.c:241
  7    Thread 7004.0x1554 0x6899b7a0 in cygcrypto-1.0.0!MD5_Final ()
   from /cygdrive/c/Users/Mathieu/Desktop/JuinJohnny/JohnTheRipper/run/cygcrypto-1.0.0.dll
  6    Thread 7004.0x1494 SSEmd5body (_data=_data@...ry=0xfe6fc660,
    out=<optimized out>, out@...ry=0xfe6f9ae0, reload_state=<optimized out>,
    reload_state@...ry=0x0, SSEi_flags=SSEi_flags@...ry=0)
    at sse-intrinsics.c:227
  5    Thread 7004.0x21b4 SSEmd5body (_data=_data@...ry=0xfe7fba60,
    out=<optimized out>, out@...ry=0xfe7f9ae0, reload_state=<optimized out>,
    reload_state@...ry=0x0, SSEi_flags=SSEi_flags@...ry=0)
    at sse-intrinsics.c:270
  4    Thread 7004.0x2638 0x005f400f in SSEmd5body (
---Type <return> to continue, or q <return> to quit---
    _data=_data@...ry=0xfe90c660, out=<optimized out>, out@...ry=0xfe909ae0,
    reload_state=<optimized out>, reload_state@...ry=0x0,
    SSEi_flags=SSEi_flags@...ry=0) at sse-intrinsics.c:222
  3    Thread 7004.0x444 dispatch (saltlen=<optimized out>,
    length=<optimized out>, f=<optimized out>, buffers=<optimized out>)
    at sse-intrinsics.c:464
  2    Thread 7004.0xdf8 0x7789c4dc in ntdll!ZwReadFile ()
   from /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll
  1    Thread 7004.0x1d24 SSEmd5body (_data=_data@...ry=0x28b7a0,
    out=<optimized out>, out@...ry=0x289220, reload_state=<optimized out>,
    reload_state@...ry=0x0, SSEi_flags=SSEi_flags@...ry=0)
    at sse-intrinsics.c:275
(gdb) info registers
eax            0x1aeccec        28232940
ecx            0x78ef0000       2028929024
edx            0x0      0
ebx            0xfffffffe       -2
esp            0x1aecccc        0x1aecccc
ebp            0x1aecd58        0x1aecd58
esi            0x0      0
edi            0x40010005       1073807365
eip            0x75ee22cb       0x75ee22cb <KERNELBASE!CtrlRoutine+203>
eflags         0x246    [ PF ZF IF ]
cs             0x23     35
ss             0x2b     43
ds             0x2b     43
es             0x2b     43
fs             0x53     83
gs             0x2b     43
(gdb) info frame
Stack level 0, frame at 0x1aeccd0:
 eip = 0x75ee22cb in KERNELBASE!CtrlRoutine; saved eip = 0xf9269dfa
 called by frame at 0x1aecd60
 Arglist at 0x1aeccc8, args:
 Locals at 0x1aeccc8, Previous frame's sp is 0x1aeccd0
 Saved registers:
  eip at 0x1aecccc
(gdb)
Stack level 0, frame at 0x1aeccd0:
 eip = 0x75ee22cb in KERNELBASE!CtrlRoutine; saved eip = 0xf9269dfa
 called by frame at 0x1aecd60
 Arglist at 0x1aeccc8, args:
 Locals at 0x1aeccc8, Previous frame's sp is 0x1aeccd0
 Saved registers:
  eip at 0x1aecccc
continue
All Threads exited with code 62097
[Inferior 1 (process 7004) exited with code 0171221]


Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ