Win32 SEH address

Question

I have read this kind of code in some tutorials :

push handler ; Address of handler function
push FS:[0] ; Address of previous handler
mov FS:[0],ESP ; Install new Handler

I do not understand something: for me the 2 push are not in the good order. ESP points on old handler ? But all tutorials i have read works like this... so if can anyone explain me...

Answer 1

Well the comment: "Install new handler" is a bit misleading. What you are installing is EXCEPTION_REGISTRATION_RECORD and if you would check how this structure looks like it would be more obvious that this is the way:

typedef struct _EXCEPTION_REGISTRATION_RECORD
{
     PEXCEPTION_REGISTRATION_RECORD Next;
     PEXCEPTION_DISPOSITION Handler;
} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;

FS:[0] also doesn't point to the handler itself but the same EXCEPTION_REGISTRATION_RECORD structure. So the previous record that is at FS:[0] goes to the Next and the one that you are installing goes to the Handler.

Naming is also a bit confusing as we call it the previous handler but it's being set to the Next field.

Answer 2

fs:[0] points to ETHREAD
whose first is member NtTib which again is a structure
whose first member is _EXCEPTION_REGISTRATION_RECORD

0:000> dt ntdll!_TEB NtTib.* @$thread
   +0x000 NtTib  : 
      +0x000 ExceptionList : 0x0010f76c _EXCEPTION_REGISTRATION_RECORD
      +0x004 StackBase : 0x00110000 Void
      +0x008 StackLimit : 0x0010d000 Void
      +0x00c SubSystemTib : (null) 
      +0x010 FiberData : 0x00001e00 Void
      +0x010 Version : 0x1e00
      +0x014 ArbitraryUserPointer : (null) 
      +0x018 Self   : 0x7ffde000 _NT_TIB



0:000> ? @$thread
Evaluate expression: 2147344384 = 7ffde000

the exception registration record contains the chain of exception handlers

0:000> dx -r2 ((ntdll!_EXCEPTION_REGISTRATION_RECORD *)0x10f76c)
((ntdll!_EXCEPTION_REGISTRATION_RECORD *)0x10f76c)                 : 0x10f76c [Type: _EXCEPTION_REGISTRATION_RECORD *]
    [+0x000] Next             : 0x10f91c [Type: _EXCEPTION_REGISTRATION_RECORD *]
        [+0x000] Next             : 0xffffffff [Type: _EXCEPTION_REGISTRATION_RECORD *]
        [+0x004] Handler          : 0x77ade115 [Type: _EXCEPTION_DISPOSITION (*)(_EXCEPTION_RECORD *,void *,_CONTEXT *,void *)]
    [+0x004] Handler          : 0x77ade115 [Type: _EXCEPTION_DISPOSITION (*)(_EXCEPTION_RECORD *,void *,_CONTEXT *,void *)]
        [Type: _EXCEPTION_DISPOSITION (_EXCEPTION_RECORD *,void *,_CONTEXT *,void *)]

like this

0:000> !exchain
0010f76c: ntdll!_except_handler4+0 (77ade115)
  CRT scope  0, filter: ntdll!LdrpDoDebuggerBreak+32 (77b605ac)
                func:   ntdll!LdrpDoDebuggerBreak+36 (77b605b0)
0010f91c: ntdll!_except_handler4+0 (77ade115)
  CRT scope  0, filter: ntdll!_LdrpInitialize+db (77b40ee4)
                func:   ntdll!_LdrpInitialize+f0 (77b40ef9)
Invalid exception stack at ffffffff

when you push handler

esp will hold the handler

esp  0x12345678 _SEH_HANDLER

when you push fs:[0] you push a pointer to

dx -r2 ((ntdll!_EXCEPTION_REGISTRATION_RECORD *)0x10f76c)

0:000> dd esp
0010f750  779f8159 00000000 00000000 7ffdf000

0:000> a 
77b605a6 push fs:[0]
push fs:[0]
77b605ad 

0:000> p

0:000> dd esp
0010f74c  **0010f76c** 779f8159 00000000 00000000
0010f75c  7ffdf000 00000000 0010f750 77ade115

mov fs:[0] esp

with this you swap out the old EXCEPTION_REGISTRATION_RECORD WITH NEW ONE