Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [exception]

The tag has no usage guidance.

1
vote
1answer
37 views

What is happening with these exceptions in OllyDbg?

I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
0
votes
0answers
67 views

windows kernel mode exceptions not caught in windbg

I've done a few tests and it seems WinDbg does not catch some exceptions triggered inside a __try/__except clause in kernel mode. The code I run in kernel mode is as follows __try { /* code ...
0
votes
0answers
47 views

Exception while decompiling C# Windows application

I'm pretty new to RE, decompiling and stuffs. and my first time posting here. Recently I tried de-compiling a Windows app written in C#. I use Just Decompile. The decompiled code however shows some ...
4
votes
1answer
66 views

GS Cookie and exception handlers

I'm trying to understand how this GS cookie implementation is working. From what I've read on the topic, a cookie is set during the prologue then checked again in the epilogue. Well I can see the ...
1
vote
1answer
78 views

How to debug a crash in wow64.dll in 32bit process

I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
-1
votes
1answer
84 views

arm branch calculator

When I use this opcode 09E0 that mean B #0x12 that mean go to pc+0x12 .(relative address) How can I jump with B to pc-0x12 (relative address)?
1
vote
1answer
540 views

Dealing with exceptions in x64dbg

I'm debugging a game and I often come across an exception (EXCEPTION_PRIV_INSTRUCTION) The debugger pauses on the address where it stops, now I want to step over one command at a time but when I step ...
1
vote
2answers
511 views

Why the program can't write to specific memory area

I am working on Lab13-01.exe from "Practical Malware Analysis" (you can download it from here). When I run it without debuggers in my VMWare it runs without errors. I started to analyze it with ...
2
votes
1answer
653 views

how to overcome setunhandledexceptionfilter in ollyDebugger?

I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this. Can you guys please explain the setunhandledexceptionfilter() anti-...
9
votes
1answer
1k views

What are the Vectored Continue Handlers

Practically everyone knows what Vectored Exception Handlers are, but I couldn't find a lot of information about the similar "Vectored Continue Handlers" and related functions I encountered today, such ...
1
vote
1answer
3k views

Access violation when reading [OLLYDEBUG]

Any time I try to crack a program I get this error in olly: What causes this error? How can I fix this? If anyone has suggestion or advice that would be great. I already tried pressing F9 but that ...
0
votes
0answers
104 views

Overwriting a function in the IAT results in application crash

I am reversing an MMORPG, and therefore I want to hook some functions from the import address table, for example Sleep or sendto. As the first step I am injecting a dll into the target application and ...
1
vote
1answer
764 views

how to bypass exception to debug EXE

i am trying to debug and find the encryption password algorithm in a Windows Application. Whenever i try to debug, setting a breakpoint or not, the application gives a exception: is it some kind of ...
1
vote
1answer
287 views

Moving xmm0 onto the stack results in a access violation exception

Reversing an application that crashes at the last line of the following instructions: sub rsp,68 mov qword ptr ss:[rsp+B0],rcx mov qword ptr ss:[rsp+B8],rdx mov qword ptr ss:[rsp+C0],r8 mov qword ptr ...
0
votes
1answer
82 views

Is it possible to change the value of a register when a certain instruction is executed?

I was wondering if it was possible to change the value of a register when an instruction gets executed. For example 0x10 call eax Say eax contains 0x20 at that point, I want to add 0x10 to it so ...
3
votes
1answer
282 views

Win32 Structured Exception Handling in MS C++ - Mapping compiler code to assembly code

I am trying to read through Matt Pietrek article on "A Crash Course on the Depths of Win32 Structured Exception Handling" linked here. In the section titled Compiler-level SEH, he writes: Now that ...
2
votes
3answers
808 views

Target application crashes when using ReadProcessMemory

I have an interesting application that seems to crash whenever a particular region of memory is read using ReadProcessMemory. I know it's not doing anything special with RPM because: Injecting a DLL ...
1
vote
1answer
588 views

x64dbg and ollydbg error not enough memory

I wanted to debug an executable but I always receive one of the errors 'last or first chance' exception. The 'last error' label shows me this error : 00000008 (ERROR_NOT_ENOUGH_MEMORY). When I run the ...
3
votes
1answer
1k views

WinDBG. How to catch first-chance exceptions?

I have to catch first-chance exceptions occurring in user-mode application during kernel-mode debugging session. I have written simple example application called Exceptions.exe: int WINAPI WinMain(...
1
vote
2answers
620 views

Reversing PECompact packed code (How SEH works)

I'm currently reversing file that is packed with PECompact packer. I'm interested in actual algorithm how it unpacks itself rather than having unpacked file. It uses SEH for modifying program flow. ...
1
vote
0answers
417 views

Opening program via Ollydbg/Immunity in Win7 causes exception unless in XP Compatibility Mode

When opening the reverseme included with Lena's tutorials for debugging in either Immunity or Ollydbg an exception is produced within ntdll that results in termination of the process with code ...
2
votes
1answer
910 views

Adding exception range to IDA

I encountered a problem while trying to debug an application that raises an exception to stop the debugger. How can I add an exception range, such as (00000000 - FFFFFFFF), in IDA as in Olly ?
1
vote
1answer
1k views

KiUserExceptionDispatcher hook

i am analyzing a piece of malware in which first the address to "KiUserExceptionDispatcher" is obtained(using the Export Name Table, going to Export Ordinal Table and then finally to Export Address ...
0
votes
1answer
315 views

Monitoring Exceptions raised by an executable

Using tools like strace I can figure out the signals a program receives as it executes, regardless of whether or not signal handlers for those signals have been defined. [EDIT] In order to do the ...
0
votes
1answer
571 views

Windows VEH - catch and discard a single step exception

In a 3rd party application I'm modifying by means of DLL injection, there's a chunk of code that throws an EXCEPTION_SINGLE_STEP exception if it detects changes to the code. To bypass this ...
2
votes
2answers
417 views

Single step exception at the beginning of an unrelated function

I'm reversing an application and I know for a fact it employs CRC checks, so if I modify the code, for instance hooking something, it'll be detected. The application uses a DLL which I replaced with ...
2
votes
0answers
203 views

How to include these exception handle symbols in x86 assembly code?

The test is on 32bit x86 Linux, with g++ 4.6.3. So basically I use a IDA pro script to recover the .gcc_excpt_table and .eh_frame sections from binary compiled from C++ language. Basically I want to ...
6
votes
1answer
2k views

How to recover the exception info from .gcc_except_table and .eh_handle sections?

For C++ program with try catch defined, when using g++ to compile it into assembly code (test is on x86 32bit Linux, g++ 4.6.3) g++ -S cppexcept.cc A specified section called .gcc_except_table is ...