1

I'm reversing a program that dynamically loads SetUnhandledExceptionFilter and uses it to set a function as an exception handler. It then calls int 2D - so that execution transfers to the function only when the program is not being debugged.

I want to see how the function behaves dynamically - specifically because I'm having trouble understanding how it works with its EXCEPTION_POINTER* parameter - but I can't really do that because execution won't even transfer there while I'm debugging.

How can I make IDA execute int 2D so that I can see execution transfer to the exception handler function and see its behavior dynamically?

I tried following the advice in this answer, but it didn't help: changing 0x2DCD to 0x2DFF had the exact same effect - the program crashed.

  • Could you post a relevant excerpt of the assembly? – Carlos Garcia Jun 3 '15 at 7:01
  • you could also try one of IDAStealth or ScyllaHide for IDA plugins. – newgre Jun 4 '15 at 20:19
2

The KERNEL32.UnhandledExceptionFilter() is special, because it checks for the presence of a debugger, and refuses to call the process-defined UnhandledExceptionFilter() if one is present. In order to reach the process-defined routine, you need to set a breakpoint on NTDLL.NtQueryInformationProcess(), and check for these parameters on the stack: -1, 7, a pointer, 4, 0. When you see it, you can step over the function, change the return value to -1, and resume execution. Then the filter function will be called.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.