0

I use http://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/ to loadlibrary from memory. but when use in my code "throw" program crashing. What's the problem?

code i use like this:

#include <excpt.h>
#include <windows.h>
 void func()
{
 __try{
  MessageBoxA(0,"try","try",0);
  if (1)
  {
   throw 10;
  }
 }__finally{
  MessageBoxA(0,"finally","finally",0);
 }
}
void DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)
{
 try
 {
  func();
 }
 catch(int a)
 {
  MessageBoxA(0,"catch","catch",0);
 }

when call "throw 10;" program crashing.

1

The answer differs on x86 and x64, I'm only going to answer for x86.

There are various types of exception dispatching mechanisms. Your code uses SEH.

As SEH was abused in exploits(e.g. MS03-026) Microsoft decided to protect against that with SafeSEH introduced in Server 2003.

http://sota.gen.nz/veh/seh_xp.txt is an annotated decompiled version for XP.
It starts in RtlDispatchException(), the function that is of concern in this problem is RtlIsValidHandler().

Firstly it calls RtlLookupFunctionTable() which looks through the PEB to find the image the handler resides in. MemoryModule does NOT add your library to the PEB lists of loaded modules - so that won't find your DLL.
But after returning there is a further check - all handler must reside in memory pages marked as SEC_IMAGE. This value cannot be set by usermode code.

There are some ways around this:

  • Switch to VEH exceptions
  • build a VEH handler that recognizes exception from your code (BlackBone does that) and handles them
  • hook functions to lie that your DLL has the image flag.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.