0

I'm trying to understand the mechanism of SEH (Structured Exception Handling). I understood how it was recorded and saved in FS: [0] on the previous three instructions. But why add interrupt 1 (step by step): I can not understand what the report is.

push handler
push FS:[0]
mov  FS:[0], esp
int  1
  • Where is this code from? – Igor Skochinsky Sep 27 at 21:11
  • @IgorSkochinsky It comes from a challenge crackme, which contains a handler from SEH, which solves the challenge – 7hsk Sep 27 at 22:06
1

int 1 is not a part of the SEH setup, that's done by the third instruction. However, int is intercepted by Windows and is translated into an exception which is then dispatched to the handler that has been set up by the previous instructions. So basically here it serves as a sort of "invoke handler" macro.

In practice, any privileged instruction (e.g. hlt or out) could have been used as well, but the "nice" thing about int 1 is that it produces a single step exception which is used by the debugging API to report single-step events to the debugger during normal debugging. If the debugger does not track its own actions properly, it may consider this exception as one originating from the debugging activity (single-stepping through the code), handle it as a normal single step and do not pass the exception to the debuggee. This means the handler code won't be executed and the debugger or tracer could be detected by the code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.