Windows RDS 下 Illustrator 2025 普通用户 0xc0000142 崩溃修复

# 1. 是否启用了 per-session TEMP 重定向
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v PerSessionTempDir
# 期望看到：PerSessionTempDir  REG_DWORD  0x1   ← 这是问题的大前提

# 2. 当前所有 RDP 会话的用户和 session ID
query user

# 3. 枚举 C:\Windows\TEMP\<sid> 下每个数字目录的 owner
#    与上一步的 (session ID → user) 映射做对比
Get-ChildItem C:\Windows\TEMP -Directory |
    Where-Object Name -match '^\d+$' |
    ForEach-Object {
        '{0,3}: owner={1}' -f $_.Name, (Get-Acl $_.FullName).Owner
    }

# [1] 永久关掉 per-session TEMP 重定向
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" `
    /v PerSessionTempDir /t REG_DWORD /d 0 /f

# [2] 给每个普通用户的 HKU\<SID>\Environment 显式绑定 TEMP 到 profile
#     REG_EXPAND_SZ + %USERPROFILE% token：每个用户登录时展开到自己的 profile
reg add "HKU\<user_sid>\Environment" /v TEMP /t REG_EXPAND_SZ `
    /d "%USERPROFILE%\AppData\Local\Temp" /f
reg add "HKU\<user_sid>\Environment" /v TMP  /t REG_EXPAND_SZ `
    /d "%USERPROFILE%\AppData\Local\Temp" /f

# [3] 修改 Default 用户模板（未来新建的用户就不会再踩）
#     注意：真正的 Default 模板是 C:\Users\Default\NTUSER.DAT，
#     不是 HKU\.DEFAULT（后者对应 LocalSystem 账号，与新建用户无关）。
#     必须先 reg load 离线 hive，改完再 unload
reg load "HKU\_DefaultTemplate" "C:\Users\Default\NTUSER.DAT"
reg add "HKU\_DefaultTemplate\Environment" /v TEMP /t REG_EXPAND_SZ /d "%USERPROFILE%\AppData\Local\Temp" /f
reg add "HKU\_DefaultTemplate\Environment" /v TMP  /t REG_EXPAND_SZ /d "%USERPROFILE%\AppData\Local\Temp" /f
[gc]::Collect()        # 释放 PowerShell 可能持有的 hive 句柄
reg unload "HKU\_DefaultTemplate"

# [4] 过渡：修正当前错配目录的 ACL，让正在登录中的用户不必注销就能立即用
takeown /f C:\Windows\TEMP\<stale_sid> /r /d Y
icacls C:\Windows\TEMP\<stale_sid> /grant "<current_session_user>:(OI)(CI)F"

BOOL WINAPI DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved) {
    if (dwReason == DLL_PROCESS_ATTACH) {
        DetourRestoreAfterWith();
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        LONG status = DetourAttach(&(PVOID &)TrueGetSystemMetrics, FakeGetSystemMetrics);
        if (status != NO_ERROR) {
            DetourTransactionAbort();
            return FALSE;   // ← 这里
        }
        if (DetourTransactionCommit() != NO_ERROR) {
            return FALSE;   // ← 这里
        }
    }
    return TRUE;
}

# 示例：给 Illustrator 的 licensing helper 禁用扩展点注入
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adobe_licensing_helper.exe" `
    /v MitigationOptions /t REG_QWORD /d 0x100000000 /f

$procs = Get-Process -Name AdobeIPCBroker,CCXProcess,node,Illustrator
foreach ($p in $procs) {
    $hasRdp = $p.Modules | Where-Object { $_.ModuleName -match 'RdpBypass' }
    $loaded = if ($hasRdp) { "YES" } else { 'no' }
    Write-Host "$($p.Name) RdpBypass loaded: $loaded"
}

AdobeIPCBroker  RdpBypass loaded: no
CCXProcess      RdpBypass loaded: no
Illustrator     RdpBypass loaded: no
node            RdpBypass loaded: no

C:\ProgramData\Adobe\
    Installer\                  (只有这一个子目录)

C:\Users\Administrator\AppData\Local\Adobe\
    Color\
    licflags\
    NGL\                        (只有这 3 个)

对比正常 Adobe 安装应该有：
  - AdobeGCClient
  - CoreSync
  - OOBE
  - SLStore
  - Sign-In
  - 多个后台服务 (AGSService, AGMService, AdobeUpdateService, ...)

<Data key="APPLICATION_CUSTOMIZATION_DATA">SuppressSerialWF</Data>
<Data key="LicensingCode">V7{}Illustrator-29-Win-GM</Data>
<Data key="TrialSerialNumber">XXXXXXXXXXXXXXXXXXXXXXXX</Data>
<Data key="InstallDate">1775636579</Data>   <!-- 2026-04-06 06:22 UTC -->

C:\Users\Administrator\AppData\Local\Temp\2\NGL\NGLClient_Illustrator129.8.2.log

15:06:07:179  ReadFileWithLockAndDecrypt: Finished with status: 0     ← 解密成功
15:06:07:185  DP API CNG functions success                            ← DPAPI 工作正常
15:06:07:188  ReadFileWithLockAndDecrypt: Finished with status: 0     ← 第二次解密
15:06:07:226  InitialProfileTimer: app is licensed                    ← 声明已授权
15:06:07:372  ...
15:06:07:372  Calling endpoint https://lcs-cops.adobe.io/...          ← 开始联网
15:07:10:316  OnCallBack: Asynchronous error occured
15:07:10:320  MapLastErrorToStatusCode: Error is 12002                ← ERROR_INTERNET_TIMEOUT
15:07:10:403  GetUnauthenticatedProfile: Failed to retrieve ASNP
15:07:10:421  FetchAccessTokenFromDeviceToken: Empty device token given!!

Get-ChildItem "C:\Users\rds-user-a\AppData\Local\Temp" -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match 'NGLClient' }
# (空)

# 让 Illustrator.exe 下次崩溃时写一个完整的内存转储
$wer = 'HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Illustrator.exe'
New-Item -Path $wer -Force | Out-Null
New-ItemProperty -Path $wer -Name 'DumpFolder' -PropertyType ExpandString -Value 'C:\temp\dumps' -Force
New-ItemProperty -Path $wer -Name 'DumpType'   -PropertyType DWord        -Value 2 -Force  # 2 = full memory
New-ItemProperty -Path $wer -Name 'DumpCount'  -PropertyType DWord        -Value 5 -Force

# WER 会在崩溃进程的用户上下文里写 dump，因此需要给目标用户写入权限。
# 注意：Full memory dump 里可能包含 token、凭据、业务敏感内存，
#      所以 ACL 必须收紧到**最小集合**——绝不要用 Everyone:(F)
New-Item -ItemType Directory -Path 'C:\temp\dumps' -Force | Out-Null

# 清空默认继承的宽权限
icacls 'C:\temp\dumps' /inheritance:r | Out-Null

# 只授予：SYSTEM + Administrators 完全控制（便于管理员读取并清理）
icacls 'C:\temp\dumps' /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' | Out-Null

# 仅授予将要触发崩溃的那个具体用户最小的"写入 + 新建子项 + 同步"权限
# 不授予 READ，避免同机其他低权限用户窃取 dump 内容
icacls 'C:\temp\dumps' /grant:r '<target-user>:(OI)(CI)(WD,AD,S)' | Out-Null

Restart-Service WerSvc

# 推荐：基于密钥的认证 + 保留主机指纹校验
#   预先 ssh-copy-id 把公钥放到目标机 administrator 账号里，
#   known_hosts 会在首次连接时记录对方指纹
sftp administrator@rds-host.internal <<'EOF'
lcd /md0/vibe/ai_dump
get /C:/temp/dumps/Illustrator.exe.35648.dmp
bye
EOF

python3 -m venv .venv
.venv/bin/pip install minidump

from minidump.minidumpfile import MinidumpFile
mf = MinidumpFile.parse('Illustrator.exe.35648.dmp')

print(mf.exception)
print(f"Modules: {len(mf.modules.modules)}")

ThreadId   | ExceptionCode                   | ExceptionAddress | ExceptionInformation
0x00003724 | ExceptionCode.EXCEPTION_UNKNOWN  | 0x7ffa49eaf18c   | [429065504, 327611837760, 140711765660576, 140711763378176]

Modules: 138

0x00007ffa02ac0000 - 0x00007ffa02d30000   AITextViewModel.dll

struct _ThrowInfo {
    DWORD   attributes;
    int32_t pmfnUnwind;           // RVA to destructor
    int32_t pForwardCompat;       // RVA
    int32_t pCatchableTypeArray;  // RVA → CatchableTypeArray
};

struct _CatchableTypeArray {
    int32_t nCatchableTypes;
    int32_t arrayOfCatchableTypes[];   // RVAs → _CatchableType
};

struct _CatchableType {
    DWORD   properties;
    int32_t pType;        // RVA → TypeDescriptor
    // ... 还有 _PMD、sizeOrOffset、copyFunction
};

struct TypeDescriptor {
    PVOID  pVFTable;
    PVOID  spare;
    char   name[];   // mangled name, 例如 ".?AVfilesystem_error@filesystem@std@@"
};

import struct
from minidump.minidumpfile import MinidumpFile

mf = MinidumpFile.parse('Illustrator.exe.35648.dmp')
buf = mf.get_reader().get_buffered_reader()

IB      = 0x7ffa02ac0000  # AITextViewModel.dll image base
TI_ADDR = 0x7ffa02ced3a0  # ThrowInfo
OBJ     = 0x4c472fed40    # exception object

def rd(addr, n):
    buf.move(addr)
    return buf.read(n)

# ThrowInfo
attrs, unwind_rva, fwd_rva, cta_rva = struct.unpack('<Iiii', rd(TI_ADDR, 16))
cta_addr = IB + cta_rva
cnt = struct.unpack('<i', rd(cta_addr, 4))[0]
ct_rvas = struct.unpack(f'<{cnt}i', rd(cta_addr + 4, cnt * 4))

# 枚举所有 catchable type（继承链），最具体的在第一个
for i, ct_rva in enumerate(ct_rvas):
    ct_addr = IB + ct_rva
    props, ptype_rva = struct.unpack('<Ii', rd(ct_addr, 8))
    td_addr = IB + ptype_rva
    buf.move(td_addr + 16)   # 跳过 pVFTable + spare
    name = b''
    while True:
        c = buf.read(1)
        if c == b'\x00' or not c: break
        name += c
    print(f"  [{i}] {name.decode()}")

  [0] .?AVfilesystem_error@filesystem@std@@
  [1] .?AVsystem_error@std@@
  [2] .?AV_System_error@std@@
  [3] .?AVruntime_error@std@@
  [4] .?AVexception@std@@

obj = rd(OBJ, 256)
vptr = struct.unpack('<Q', obj[0:8])[0]
# 找 vptr 属于哪个模块 → AITextViewModel.dll +0x1c5bd0

for off in range(8, 200, 8):
    chunk = obj[off:off+32]
    size = struct.unpack_from('<Q', chunk, 16)[0]
    cap  = struct.unpack_from('<Q', chunk, 24)[0]
    if 16 <= cap < 65536 and 16 <= size < cap:
        ptr = struct.unpack_from('<Q', chunk, 0)[0]
        s = rd(ptr, size).decode('ascii', errors='replace')
        print(f"  +{off:#x} size={size} cap={cap}: '{s}'")

  +0x68 heap str size=58 cap=63 ptr=0x1bcc09614f0:
       'temp_directory_path: not a directory: "C:\Windows\TEMP\5\"'

std::filesystem::filesystem_error:
  what(): temp_directory_path: not a directory: "C:\Windows\TEMP\5\"

path temp_directory_path() {
    path result;
    _Temp_directory_path(result._Text);
    const file_status st = status(result);
    if (!exists(st) || !is_directory(st)) {
        _Throw_fs_error("temp_directory_path",
                        make_error_code(errc::not_a_directory),
                        result);
    }
    return result;
}

C:\Windows\TEMP\5
  Owner: RDSHOST01\rds-user-b
  NT AUTHORITY\SYSTEM             Allow  FullControl
  BUILTIN\Administrators          Allow  FullControl
  RDSHOST01\rds-user-b   Allow  FullControl   ← 错配
  BUILTIN\Users                   Allow  CreateFiles, AppendData, ExecuteFile, Synchronize
  CREATOR OWNER                   Allow  (inherit)

C:\Windows\TEMP\4
  Owner: RDSHOST01\rds-user-c   ← 当前 session 4 是 rds-user-b
  RDSHOST01\rds-user-c Allow  FullControl

# [1] 永久关闭 per-session TEMP 重定向
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
    -Name PerSessionTempDir -Value 0

# [2] 给每个目标用户的 HKU Environment 写 TEMP/TMP
#     注意：必须用 ExpandString 类型，保留 %USERPROFILE% 这个 token，
#     这样每个用户登录时会用各自的 USERPROFILE 展开
$targetUsers = @(
  @{Name='rds-user-a';  Sid='S-1-5-21-XXXX-XXXX-XXXX-1003'},
  @{Name='rds-user-b';  Sid='S-1-5-21-XXXX-XXXX-XXXX-1009'},
  @{Name='rds-user-c';Sid='S-1-5-21-XXXX-XXXX-XXXX-1004'}
)
foreach ($u in $targetUsers) {
    $envKey = "Registry::HKEY_USERS\$($u.Sid)\Environment"
    if (Test-Path $envKey) {
        Set-ItemProperty -Path $envKey -Name TEMP -Value '%USERPROFILE%\AppData\Local\Temp' -Type ExpandString
        Set-ItemProperty -Path $envKey -Name TMP  -Value '%USERPROFILE%\AppData\Local\Temp' -Type ExpandString
    }
}

# [3] 修 Default 用户模板（未来新建用户会以这个模板创建 NTUSER.DAT）
#     重要：真正的模板是 C:\Users\Default\NTUSER.DAT 这个离线 hive，
#     不是 HKU\.DEFAULT（那是 LocalSystem 账号的活跃 hive，与新用户无关）
try {
    reg load 'HKU\_DefaultTpl' 'C:\Users\Default\NTUSER.DAT' | Out-Null
    Set-ItemProperty -Path 'Registry::HKEY_USERS\_DefaultTpl\Environment' -Name TEMP `
        -Value '%USERPROFILE%\AppData\Local\Temp' -Type ExpandString
    Set-ItemProperty -Path 'Registry::HKEY_USERS\_DefaultTpl\Environment' -Name TMP `
        -Value '%USERPROFILE%\AppData\Local\Temp' -Type ExpandString
} finally {
    [gc]::Collect()        # 释放 PowerShell 对 hive 的隐式引用
    reg unload 'HKU\_DefaultTpl' | Out-Null
}

# [4] 修正当前错配的 stale C:\Windows\TEMP\<sid> ACL
#     这样"现在正登录"的用户不用注销就能立即开 AI
$sessionMap = @{
    '3' = 'rds-user-c'
    '4' = 'rds-user-b'
    '5' = 'rds-user-a'
}
foreach ($sid in $sessionMap.Keys) {
    $dir = "C:\Windows\TEMP\$sid"
    $owner = $sessionMap[$sid]
    if (Test-Path $dir) {
        takeown /f $dir /r /d Y | Out-Null
        icacls $dir /grant "${owner}:(OI)(CI)F" | Out-Null
    }
}

Get-ItemProperty "Registry::HKEY_USERS\$sid\Environment" | Select TEMP, TMP

TEMP : C:\Users\Administrator\AppData\Local\Temp
TMP  : C:\Users\Administrator\AppData\Local\Temp

reg query "HKU\$sid\Environment" /v TEMP

HKEY_USERS\S-1-5-21-...-1003\Environment
    TEMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp

[1] PerSessionTempDir                                  0                                 ← PASS
[2] rds-user-a  HKU\<SID>\Environment\TEMP (raw)       %USERPROFILE%\AppData\Local\Temp  ← PASS
[2] rds-user-b  HKU\<SID>\Environment\TEMP (raw)       %USERPROFILE%\AppData\Local\Temp  ← PASS
[2] rds-user-c  HKU\<SID>\Environment\TEMP (raw)       %USERPROFILE%\AppData\Local\Temp  ← PASS
[3] Default template (offline NTUSER.DAT) TEMP (raw)   %USERPROFILE%\AppData\Local\Temp  ← PASS
[4] C:\Windows\TEMP\3 FullControl for rds-user-c       PASS
[4] C:\Windows\TEMP\4 FullControl for rds-user-b       PASS
[4] C:\Windows\TEMP\5 FullControl for rds-user-a       PASS

reg load 'HKU\_Check' 'C:\Users\Default\NTUSER.DAT' | Out-Null
reg query 'HKU\_Check\Environment' /v TEMP
reg query 'HKU\_Check\Environment' /v TMP
[gc]::Collect()
reg unload 'HKU\_Check' | Out-Null

#!/usr/bin/env python3
"""
Parse MSVC C++ throw info from a Windows minidump with full memory.
Usage: python3 parse_cpp_throw.py <dump.dmp>
"""
import sys
import struct
from minidump.minidumpfile import MinidumpFile

def find_mod(mf, addr):
    for m in mf.modules.modules:
        if m.baseaddress <= addr < m.baseaddress + m.size:
            return m
    return None

def parse(dump_path):
    mf = MinidumpFile.parse(dump_path)
    buf = mf.get_reader().get_buffered_reader()

    exc = mf.exception.exception_records[0].exception_record
    code = exc.ExceptionCode
    params = exc.ExceptionInformation
    if code != 0xe06d7363:
        print(f"Exception is not MSVC C++ throw: 0x{code:x}")
        return

    magic, obj_ptr, ti_ptr, image_base = params[0], params[1], params[2], params[3]
    print(f"Magic:      0x{magic:x}  (expected 0x19930520)")
    print(f"Object:     0x{obj_ptr:x}")
    print(f"ThrowInfo:  0x{ti_ptr:x}")
    print(f"ImageBase:  0x{image_base:x}")

    mod = find_mod(mf, image_base)
    if mod:
        print(f"Throwing module: {mod.name}")

    def rd(addr, n):
        buf.move(addr)
        return buf.read(n)

    # ThrowInfo
    attrs, unwind_rva, fwd_rva, cta_rva = struct.unpack('<Iiii', rd(ti_ptr, 16))
    cta_addr = image_base + cta_rva
    cnt = struct.unpack('<i', rd(cta_addr, 4))[0]
    ct_rvas = struct.unpack(f'<{cnt}i', rd(cta_addr + 4, cnt * 4))
    print(f"\nCatchable types ({cnt}):")
    for i, ct_rva in enumerate(ct_rvas):
        ct_addr = image_base + ct_rva
        props, ptype_rva = struct.unpack('<Ii', rd(ct_addr, 8))
        td_addr = image_base + ptype_rva
        buf.move(td_addr + 16)
        name = b''
        while True:
            c = buf.read(1)
            if c == b'\x00' or not c:
                break
            name += c
        print(f"  [{i}] {name.decode('ascii', errors='replace')}")

    # Exception object: scan for embedded std::string
    print("\nScanning exception object for std::string fields:")
    obj = rd(obj_ptr, 256)
    for off in range(8, 200, 8):
        try:
            size = struct.unpack_from('<Q', obj, off + 16)[0]
            cap  = struct.unpack_from('<Q', obj, off + 24)[0]
            if 16 <= cap < 65536 and 16 <= size < cap:
                ptr = struct.unpack_from('<Q', obj, off)[0]
                s = rd(ptr, size).decode('ascii', errors='replace')
                if all(32 <= b < 127 for b in s.encode()[:min(size, 50)]):
                    print(f"  +0x{off:02x} size={size}: {s!r}")
        except Exception:
            pass

if __name__ == '__main__':
    parse(sys.argv[1])

$ python3 parse_cpp_throw.py Illustrator.exe.35648.dmp
Magic:      0x19930520  (expected 0x19930520)
Object:     0x4c472fed40
ThrowInfo:  0x7ffa02ced3a0
ImageBase:  0x7ffa02ac0000
Throwing module: C:\Program Files\Adobe\Adobe Illustrator 2025\Support Files\Contents\Windows\AITextViewModel.dll

Catchable types (5):
  [0] .?AVfilesystem_error@filesystem@std@@
  [1] .?AVsystem_error@std@@
  [2] .?AV_System_error@std@@
  [3] .?AVruntime_error@std@@
  [4] .?AVexception@std@@

Scanning exception object for std::string fields:
  +0x68 size=58: 'temp_directory_path: not a directory: "C:\\Windows\\TEMP\\5\\"'