1

I'm trying to understand the mechanism of SEH (Structured Exception Handling). I understood how it was recorded and saved in FS: [0] on the previous three instructions. But why add interrupt 1 (step by step): I can not understand what the report is.

push handler
push FS:[0]
mov  FS:[0], esp
int  1
2
  • Where is this code from?
    – Igor Skochinsky
    Sep 27, 2019 at 21:11
  • @IgorSkochinsky It comes from a challenge crackme, which contains a handler from SEH, which solves the challenge
    – jukebox
    Sep 27, 2019 at 22:06

1 Answer 1

2

int 1 is not a part of the SEH setup, that's done by the third instruction. However, int is intercepted by Windows and is translated into an exception which is then dispatched to the handler that has been set up by the previous instructions. So basically here it serves as a sort of "invoke handler" macro.

In practice, any privileged instruction (e.g. hlt or out) could have been used as well, but the "nice" thing about int 1 is that it produces a single step exception which is used by the debugging API to report single-step events to the debugger during normal debugging. If the debugger does not track its own actions properly, it may consider this exception as one originating from the debugging activity (single-stepping through the code), handle it as a normal single step and do not pass the exception to the debuggee. This means the handler code won't be executed and the debugger or tracer could be detected by the code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.