EXCEPTION_HIJACK(0xe0434f4e)异常的抛出过程

样例工程

在VS2013里新建一个C#控制台工程，写下如下代码：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading;

namespace ConsoleApplication1
{
    class Program
    {
        static void Main(string[] args)
        {
            Thread t1 = new Thread(new ThreadStart(TestMethod));
            t1.Start();
            t1.Join();
        }

        public static void TestMethod()
        {
            while (true)
            {
                StringBuilder sb = new StringBuilder(*);
                Thread.Sleep();
            }
        }
    }

}

工程配置如下：

编译生成Exe文件

跟踪分析

用windbg运行

在Event filter里添加异常0xe0434f4e

输入g命令，让程序运行，耐心等待触发异常中断，调试器中断后，有如下输出：

(2dfc.4e1c): Unknown exception - code e0434f4e (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=090bf848 ebx=00aacf28 ecx=00000000 edx=00000000 esi=00000000 edi=00aa8118
eip=762819b2 esp=090bf848 ebp=090bf8a0 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
KERNELBASE!RaiseException+0x62:
762819b2 8b4c2454        mov     ecx,dword ptr [esp+54h] ss:002b:090bf89c=2df2f623
输入KV查看当前栈：

0:008> kv
 # ChildEBP RetAddr  Args to Child              
00 090bf8a0 7234a780 e0434f4e 00000000 00000000 KERNELBASE!RaiseException+0x62 (FPO: [4,22,0])
01 090bf8dc 02f1091c 76f1b499 00aacf28 00000000 clr!Thread::RedirectedHandledJITCase+0x1d0 (FPO: [SEH])
WARNING: Frame IP not in any known module. Following frames may be wrong.
02 090bf910 721a10e1 00aacf28 090bf930 02f1091c 0x2f1091c
03 090bf91c 02f1091c 06ea8090 06ea8074 00000001 clr!RedirectedHandledJITCaseForGCThreadControl_Stub+0x1d
04 090bf930 70eb8391 06e62488 090bf9a0 70e8f474 0x2f1091c
05 090bf93c 70e8f474 06e623cc 00000000 00000000 mscorlib_ni+0x468391
06 090bf9a0 70e8f3a7 00000000 06e62400 00000000 mscorlib_ni+0x43f474
07 090bf9b4 70e8f364 00000000 06e62400 00000000 mscorlib_ni+0x43f3a7
08 090bf9d0 70eb82eb 06e62400 00000000 00000000 mscorlib_ni+0x43f364
09 090bf9e8 721af066 00aa8118 090bfa48 721b2375 mscorlib_ni+0x4682eb
0a 090bf9f4 721b2375 090bfa90 090bfa38 7234e800 clr!CallDescrWorkerInternal+0x34
0b 090bfa48 721bb3f5 090bfb54 06e62434 00000004 clr!CallDescrWorkerWithHandler+0x6b (FPO: [Non-Fpo])
0c 090bfabc 7234b377 090bfc00 7dae50c3 090bfd04 clr!MethodDescCallSite::CallTargetWorker+0x16a (FPO: [Non-Fpo])
0d 090bfc2c 7224f756 090bfda0 00aa8118 090bfd44 clr!ThreadNative::KickOffThread_Worker+0x131 (FPO: [Non-Fpo])
0e 090bfc44 7224f7e1 7dae5007 00000001 090bfd44 clr!ManagedThreadBase_DispatchInner+0x71 (FPO: [Non-Fpo])
0f 090bfce8 7224f6d3 7dae51d3 00000001 00aa8118 clr!ManagedThreadBase_DispatchMiddle+0x7e (FPO: [Non-Fpo])
10 090bfd3c 7224f8c1 00000001 00000000 00000001 clr!ManagedThreadBase_DispatchOuter+0x99 (FPO: [Non-Fpo])
11 090bfd60 7234b228 00000001 00000002 7dae510b clr!ManagedThreadBase_FullTransitionWithAD+0x2f (FPO: [Non-Fpo])
12 090bfde4 72334637 00aa7900 00000000 00000000 clr!ThreadNative::KickOffThread+0x260 (FPO: [Non-Fpo])
13 090bff08 74c00419 00aa7928 74c00400 090bff74 clr!Thread::intermediateThreadProc+0x58 (FPO: [Non-Fpo])
14 090bff18 76f2662d 00aa7928 9f537ce9 00000000 KERNEL32!BaseThreadInitThunk+0x19 (FPO: [Non-Fpo])
15 090bff74 76f265fd ffffffff 76f451b5 00000000 ntdll!__RtlUserThreadStart+0x2f (FPO: [SEH])
16 090bff84 00000000 723345e0 00aa7928 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])
可以看到，确实是在进行GC堆垃圾回收时触发了此异常，输入uf  clr!Thread::RedirectedHandledJITCase

...

7234a747 33f6            xor     esi,esi//对esi清0
7234a749 56              push    esi
7234a74a 8bcf            mov     ecx,edi
7234a74c e805f4ffff      call    clr!Thread::HandleThreadAbort (72349b56)
7234a751 c785e0ffffff01000000 mov dword ptr [ebp-20h],1
7234a75b 8b83b8000000    mov     eax,dword ptr [ebx+0B8h]
7234a761 8985d0ffffff    mov     dword ptr [ebp-30h],eax
7234a767 898704010000    mov     dword ptr [edi+104h],eax
7234a76d 89b708010000    mov     dword ptr [edi+108h],esi
7234a773 56              push    esi//压第四个参数0
7234a774 56              push    esi//压第三个参数0
7234a775 56              push    esi//压第二个参数0
7234a776 684e4f43e0      push    0E0434F4Eh//第一个参数直接以立即数压栈
7234a77b ff15e4628f72    call    dword ptr [clr!_imp__RaiseException (728f62e4)]//抛出异常
...