1

I was looking for a way to get to the VEH handler (specified by the application being reversed) that gets called when an exception occurs. I have read this question and it explains some things nicely, but my situation is slightly different. The code I'm stepping/executing throws an exception:

enter image description here

In that situation, what can I do to get to the handler code and step it with Olly (other than statically analyzing the executable and looking for AddVectoredExceptionHandler and friends)?

1

If you're only using export table symbols (the default), then your best bet would likely to be to set a breakpoint on ntdll!KiUserExceptionDispatcher(). When it's called, you can trace into it to find the vector handler list. On the other hand, if you have ntdll.dll's public symbols PDB, then you can find the vector handler list directly by looking at _LdrpVectorHandlerList.

Honestly though, it's probably easier to just set a logging breakpoint on AddVectoredExceptionHandler() and record each VEH entry as it's added.

  • does _LdrpVectorHandlerList hold handler or Encoded Pointer ? do you have any links / documentation – blabb Mar 9 '15 at 19:40
  • Encoded pointer, which is why it's easier to just log calls to AddVectoredExceptionHandler(). – Jason Geffner Mar 9 '15 at 20:05
  • BTW, @blabb, I like your WinDbg answer! Not sure if szczurcio wants to do this entirely in OllyDbg, but if not, your approach looks solid! – Jason Geffner Mar 9 '15 at 20:10
  • 1
    Thanksfor confirming about the Encoded Pointer i was wondering what you meant by this you can find the vector handler list directly in your reply if he wants to do it in ollydbg alone and xp is acceptable there is an olly plugin ollylkd that can aid him – blabb Mar 10 '15 at 6:09
1

_LdrpVectorHandlerList seems to be undocumented and may also be not available in xp

I couldn't even land a half semi authentic googley about its inner workings

what little i could find about _LdrpVectorHandlerList seems to point that it is an EncodedPointer and not the actual handler

DecodePointer is per process and executing DecodePointer in a debugger (with plugins / extensions etc) will not Decode the Debuggees EncodedPointer one can read process memory to get the debuggees EncodedPointer HandlerList.

ollydbg 1.10 was prior to the exisitance of VEH so it knows only about SEH in view->SEH chain window

ollydbg 2.01 will show the encoded pointer link and not the actual handler in view->seh chain window as pasted below

VEH/SEH chain of main thread
Index  Type                       Link                        Handler
1      Vectored                   00153848                    Invalid
2      Vectored                   001537F8                    Invalid
3      Vectored                   00153820                    Invalid
4      SEH                        0013FF60                    00401880 _except_handler4
5      SEH                        0013FFB0                    00401880 _except_handler4
6      SEH                        0013FFE0                    7C839AD8 _except_handler3

to find actual veh handlers i crafted a bat file that uses windbg's local kernel debugging (used in xp sp3 only not sure if this still holds in newer os) you may check it out

:type c:\findveh.bat
kd -kl -c "$$>a< c:\findveh.txt %1 ;q" | findstr /I eval

:type c:\findveh.txt
.foreach /pS 1 /ps 200 (place { !process 0 0 ${$arg1} } ) {.process /p /r place}
!list -t ntdll!_SINGLE_LIST_ENTRY.Next -x "? poi( @$extret+8 ) ^ @@(@$proc->Cookie)" @@masm(ntdll!RtlpCalloutEntryList);
!list -t ntdll!_SINGLE_LIST_ENTRY.Next -x "? poi( @$extret)" @@masm(ntdll!RtlpCalloutEntryList);

output of bat file ( the second !list command added just to show the linked EncodedPointers for comparison it is not required)

explanation of script

set process context of relevent process for which we want to find veh handlers traverse the SINGLE_LIST_ENTRY and print the actual handlers by xorring the EncodedPointer with the specific ProcessCookie

code for veh.exe is copy paste of msdn documentation sample using veh handlers

:findveh.bat veh.exe

:kd -kl -c "$$>a< c:\findveh.txt veh.exe ;q"   | findstr /I eval
Evaluate expression: -169753474 = f5e1c47e
Evaluate expression: -4290768896 = ffffffff`00401000
Evaluate expression: -4290768848 = ffffffff`00401030
Evaluate expression: -4290768800 = ffffffff`00401060
Evaluate expression: 1390664 = 00153848
Evaluate expression: 1390584 = 001537f8
Evaluate expression: 1390624 = 00153820
Evaluate expression: 2090329024 = 7c97e3c0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.