Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [seh]

Structured Exception Handling is the mechanism used by compilers for try/catch blocks. It can also be used as anti-debug tricks, by altering the flow, changing the thread context, debugging oneself...

1
vote
2answers
63 views

Generate software breakpoint other than int3

Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example? If so, I was wondering why debuggers don't support generating ...
7
votes
1answer
212 views

WHY and WHEN do we need SEH for buffer overflowing

In our course in university, we recently moved on from standard buffer-overflows to SEH based ones. My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
3
votes
2answers
90 views

Win32 SEH address

I have read this kind of code in some tutorials : push handler ; Address of handler function push FS:[0] ; Address of previous handler mov FS:[0],ESP ; Install new Handler I do not understand ...
0
votes
1answer
247 views

“Stepping Into” Exception Handler

I have some code which makes use of the Structured Exception Handler in order to employ some anti-debugging voodoo. It executes a series of instructions and I need to get the correct input. I can see ...
0
votes
2answers
395 views

I have a question about SEH Overwrite

I am trying SEH Overwrite for vulnerable test programs. However, overwriting the RET and SEH chains through 41414141 (input value) does not cause the EIP to run as 41414141. The picture is that the ...
3
votes
1answer
341 views

Win32 Structured Exception Handling in MS C++ - Mapping compiler code to assembly code

I am trying to read through Matt Pietrek article on "A Crash Course on the Depths of Win32 Structured Exception Handling" linked here. In the section titled Compiler-level SEH, he writes: Now that ...
4
votes
2answers
4k views

How does Windows SafeSEH mechanism work?

How does Windows SafeSEH mechanism work? I understand how the overwriting SEH exploitation technique works. I do not quite understand how the SafeSEH mechanism works preventing this technique from ...
1
vote
2answers
698 views

Reversing PECompact packed code (How SEH works)

I'm currently reversing file that is packed with PECompact packer. I'm interested in actual algorithm how it unpacks itself rather than having unpacked file. It uses SEH for modifying program flow. ...
0
votes
1answer
344 views

Monitoring Exceptions raised by an executable

Using tools like strace I can figure out the signals a program receives as it executes, regardless of whether or not signal handlers for those signals have been defined. [EDIT] In order to do the ...
3
votes
1answer
767 views

Win64 .pdata required to be a separate COFF section?

It seems that Windows usually finds its support structures inside PEs by looking at the header information (especially OptionalHeader.DataDirectory[]), which means that there is no mandatory mapping ...
5
votes
1answer
329 views

Do you have tips analyzing reported PoC(exploit) files?

My daily job is analyzing reported proof of concept files that exploits document viewers. People who report vulnerabilities in document viewers just give me the PoC and vulnerable version number. They ...
0
votes
2answers
221 views

Need help analyzing an image viewer exploit

I recently acquired an exploit for an image viewer program and started analyzing. Specific details cannot be given, but basically it is a SEH overwrite exploit using malicious image file. Using ...
3
votes
3answers
4k views

Check DEP , ASLR and SafeSEH enabled or not , immlib

How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using immlib library of Python in Immunity Debugger ? Actually I am looking for small code snippet for each.
19
votes
1answer
7k views

What's 'fs:[0]' doing and how can I execute it step by step?

In a 32 bits Windows binary, I see this code: push next push fs:[0] mov fs:[0], esp int3 ... next: I see that something happens on the int3 (an error), but I don't understand why,...