1

I have disassembled a function in IDA Pro and I want to compile it into my project in visual c inline assembly... I'm still a newbie, so let me apologize if I don't use the right terminology...(I'm not an English native speaker) I have come up with this disassembly with IDA Pro:

push    ebp
mov     ebp, esp
push    0FFFFFFFFh
push    offset stru_xxxxx

and if I follow offset stru_xxxxx, I see this

stru_xxxxx   _SCOPETABLE_ENTRY <0FFFFFFFFh, 0, offset locxxxxx> 

offset locxxxxx is the location of the function (xor ebx, ebx Finally handler 0 for function XXXXXX)

Now, I'm aware it is a seh exception in C, but how can I reproduce it in inline assembly? How can I declare stru_xxxxx?

1

you can declare struct in c and access them in assembly

typedef struct _SCOPETABLE_ENTRY {
    DWORD EnclosingLevel;
    void* FilterFunc;
    void* HandlerFunc;
}ScopeTable, *PscpopeTable;
void * SomeFilt() {
    return &SomeFilt;
}
void * SomeHandler() {
    return &SomeHandler;
}
int main() {
    printf("%20s%p\n%20s%p\n",
        "Somefilt Addr = ", SomeFilt(), "SomeHandler Addr = ", SomeHandler());
    ScopeTable foo = { 0 };
    printf("Enclosing Level %x FilterFunc = %p HandlerFunc = %p\n",
        foo.EnclosingLevel, foo.FilterFunc, foo.HandlerFunc);
    __asm {
        lea ebx, foo
        mov[ebx]foo.EnclosingLevel, 1
        mov[ebx]foo.FilterFunc, offset SomeFilt
        mov[ebx]foo.HandlerFunc, offset SomeHandler
    }
    printf("Enclosing Level %x FilterFunc = %p HandlerFunc = %p\n",
        foo.EnclosingLevel, foo.FilterFunc, foo.HandlerFunc);
    return 0;
}

and executing this

    Somefilt Addr = 0006137F
 SomeHandler Addr = 00061384
Enclosing Level 0 FilterFunc = 00000000 HandlerFunc = 00000000
Enclosing Level 1 FilterFunc = 0006137F HandlerFunc = 00061384
Press any key to continue . . .
| improve this answer | |
0

SEH is not supported in inline assembly, you should use C syntax for it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.