I'm currently reversing file that is packed with PECompact packer. I'm interested in actual algorithm how it unpacks itself rather than having unpacked file.
It uses SEH for modifying program flow. So I would like to ask about SEH.
So I add breakpoint at
0x4517E4 after I pass exception into app I go here
It does some code modifications and returns
EXCEPTION_DISPOSITION enum). It returns to kernel function, but where should execution be continued from, after it goes back into app? I have tried putting breakpoint at
0x401016 because it is a point where exception occurred and it stopped there, I would like to ask if this is just a coincidence, or it should work this way?
I believe it is related to EXCEPTION_RECORD structure
ExceptionAddress value. Am I right?
So that I really want to know how exception handling determines point, from which program execution should be continued according to different return values from handler function.