I came across some malware that raised an exception while I was single stepping through it. IDA gives me the option to pass the exception to the application or not. What exactly is going on here? When would I not want to pass the exception to the application?
Often times malware and/or obfuscated code (such as unpacking stubs) will do something such as the following:
- Set up an exception handler.
- Throw an exception.
- See if the exception handler caught the exception.
If the exception handler didn't catch the exception then the debugged code knows that a debugger was attached and "swallowed" the exception, thus indicating that the code is being debugged. In order to hide your debugger from such detection techniques, you always want to pass exceptions to the application when dealing with malware and/or obfuscated code.