English 中文(简体)
way to "reverse" dw20.exe hashes?
原标题:

Our application has been throwing unhandled exceptions. DW20.exe logs these like this test case:

EventType clr20r3, P1 clr20r3.exe, P2 1.0.0.0, P3 4af175d6, P4 clr20r3, P5 1.0.0.0, P6 4af175d6, P7 1, P8 a, P9 system.applicationexception, P10 NIL.

P9 is the name of the exception. If the exception name is over 32 characters long, DW20.exe hashes the name (and presumably encodes the hash). For instance, the exception "LongExceptionWithNameThatIsOver32" is logged as:

EventType clr20r3, P1 aspnet_wp.exe, P2 2.0.50727.3082, P3 492b8702, P4 app_web_bmcy0pha, P5 0.0.0.0, P6 4af86274, P7 59, P8 5, P9 3e3rjg2ow1fkknn0eqptakfytpvxew1k, P10 NIL.

As you can see, P9 is no longer the exception name, but a hash of the name.

I can throw the exceptions in our application one at a time, but I d prefer to feed the exception name to a utility program instead to get the hash. I m fairly sure that DW20.exe is the program doing the hashing (and not the .NET Runtime). I d like to know what hashing/encoding algorithm dw20.exe is using so I can build a utility that will take all my exceptions and produce the corresponding hash/encode.

I ve tried attaching windbg to the test program, but then dw20.exe isn t invoked. I ve tried attaching windbg to dw20.exe when it puts up the dialog box about transmitting to microsoft, but it has already logged the exception by then. I can t get dw20.exe to start under the control of windbg.exe, which would be one way to find out what is being used.

JR

问题回答

暂无回答




相关问题
Using EventLog objects can cause security holes?

While reading the Traning Guide for the 70-536 exam written by Tony Northup and friends, I came across the following: CAUTION - Avoid EventLog objects in partial trust environments Use of ...

Log errors in EventLog using ELMAH

I am using ELMAH to log errors in my asp.net MVC(C#) application. I am able to log errors in xml or database. How to log errors to the eventlog using ELMAH?

An event log source that s always available for writing?

Is there an event log source that s always available for writing by an ASP.NET webapp? Backstory, in case anyone has a seemingly unrelated solution: Our ASP.NET webapp uses its own event log source, ...

EventLog permission failing in ASP.Net on Win7

I have an ASP.Net app .net 3.5 SP1, running in Win7 . During the login process, something within the ASP.Net login control is causing a write to the security log (this sounds acceptable to me) in the ...

Unhandled IIS Exception - How can I track it down

I am seeing the following error in the event log. It is coming from our ASP.Net application. I am having trouble tracking down what is causing the error. Any suggestions appreciated! OS: Windows ...

What event id to use for my custom event log entries?

Is there any ranges of valid event IDs which should be used by custom applications while logging to Windows EventLog? Or I can use any event ID of my choice (1,2,3,4....). P.S, I am developing in C#....

way to "reverse" dw20.exe hashes?

Our application has been throwing unhandled exceptions. DW20.exe logs these like this test case: EventType clr20r3, P1 clr20r3.exe, P2 1.0.0.0, P3 4af175d6, P4 clr20r3, P5 1.0.0.0, P6 4af175d6, P7 1, ...

热门标签