Find and step VEH handlers with Olly?

Question

I was looking for a way to get to the VEH handler (specified by the application being reversed) that gets called when an exception occurs. I have read this question and it explains some things nicely, but my situation is slightly different. The code I'm stepping/executing throws an exception:

In that situation, what can I do to get to the handler code and step it with Olly (other than statically analyzing the executable and looking for AddVectoredExceptionHandler and friends)?

Answer 1

_LdrpVectorHandlerList seems to be undocumented and may also be not available in xp

I couldn't even land a half semi authentic googley about its inner workings

what little i could find about _LdrpVectorHandlerList seems to point that it is an EncodedPointer and not the actual handler

DecodePointer is per process and executing DecodePointer in a debugger (with plugins / extensions etc) will not Decode the Debuggees EncodedPointer one can read process memory to get the debuggees EncodedPointer HandlerList.

ollydbg 1.10 was prior to the exisitance of VEH so it knows only about SEH in view->SEH chain window

ollydbg 2.01 will show the encoded pointer link and not the actual handler in view->seh chain window as pasted below

VEH/SEH chain of main thread
Index  Type                       Link                        Handler
1      Vectored                   00153848                    Invalid
2      Vectored                   001537F8                    Invalid
3      Vectored                   00153820                    Invalid
4      SEH                        0013FF60                    00401880 _except_handler4
5      SEH                        0013FFB0                    00401880 _except_handler4
6      SEH                        0013FFE0                    7C839AD8 _except_handler3

to find actual veh handlers i crafted a bat file that uses windbg's local kernel debugging (used in xp sp3 only not sure if this still holds in newer os) you may check it out

:type c:\findveh.bat
kd -kl -c "$$>a< c:\findveh.txt %1 ;q" | findstr /I eval

:type c:\findveh.txt
.foreach /pS 1 /ps 200 (place { !process 0 0 ${$arg1} } ) {.process /p /r place}
!list -t ntdll!_SINGLE_LIST_ENTRY.Next -x "? poi( @$extret+8 ) ^ @@(@$proc->Cookie)" @@masm(ntdll!RtlpCalloutEntryList);
!list -t ntdll!_SINGLE_LIST_ENTRY.Next -x "? poi( @$extret)" @@masm(ntdll!RtlpCalloutEntryList);

output of bat file ( the second !list command added just to show the linked EncodedPointers for comparison it is not required)

explanation of script

set process context of relevent process for which we want to find veh handlers traverse the SINGLE_LIST_ENTRY and print the actual handlers by xorring the EncodedPointer with the specific ProcessCookie

code for veh.exe is copy paste of msdn documentation sample using veh handlers

:findveh.bat veh.exe

:kd -kl -c "$$>a< c:\findveh.txt veh.exe ;q"   | findstr /I eval
Evaluate expression: -169753474 = f5e1c47e
Evaluate expression: -4290768896 = ffffffff`00401000
Evaluate expression: -4290768848 = ffffffff`00401030
Evaluate expression: -4290768800 = ffffffff`00401060
Evaluate expression: 1390664 = 00153848
Evaluate expression: 1390584 = 001537f8
Evaluate expression: 1390624 = 00153820
Evaluate expression: 2090329024 = 7c97e3c0

Answer 2

If you're only using export table symbols (the default), then your best bet would likely to be to set a breakpoint on ntdll!KiUserExceptionDispatcher(). When it's called, you can trace into it to find the vector handler list. On the other hand, if you have ntdll.dll's public symbols PDB, then you can find the vector handler list directly by looking at _LdrpVectorHandlerList.

Honestly though, it's probably easier to just set a logging breakpoint on AddVectoredExceptionHandler() and record each VEH entry as it's added.