Questions tagged [seh]
Structured Exception Handling is the mechanism used by compilers for try/catch blocks. It can also be used as anti-debug tricks, by altering the flow, changing the thread context, debugging oneself...
22
questions
3
votes
1
answer
66
views
When is EXCEPTION_REGISTRATION_RECORD created on the stack?
I want to understand when EXCEPTION_REGISTRATION_RECORDs get created on the stack.
Are they created when the program starts?
Are they created when we enter the function?
Or are they created only when ...
- 797
3
votes
1
answer
156
views
Determine if the function has try/catch statement via the static analysis
I need to determine if the function has exception handler via static analysis. Initially I thought that if there's SEH handler prolog in the function, then the function should have try /catch. I.e. I ...
- 1,840
0
votes
0
answers
238
views
Can I reverse engineer a DLL file and add SEH or some error handing codes to it?
I am using some DLL files in my Java application using JNI library.
The dlls are not written by me and I do not have access to their source codes. They are so buggy and throw lots of exceptions. ...
- 229
0
votes
0
answers
217
views
Some more questions related to C++ exceptions (catchHigh)
I've came up with the most convoluted example but still can't find the purpose of the catchHigh field. I find it that the right handler can be selected simply by looking at the tryblock map from start ...
- 455
1
vote
1
answer
297
views
What code produces FuncInfoV1 with zero TryBlocks and zero UnwindMap?
Topic is C++ exceptions internal representation in WIndows x86 binaries compiled with msvc.
I've found a code that straight up doesn't have nothing (all fields of FuncInfo zero) except the EHFlags ...
- 455
2
votes
1
answer
370
views
What does state mean in unwinding?
I'm looking at UnwindMapEntry. Here is it's declaration:
//
// UnwindMapEntry - Description of each state transition for unwinding
// the stack (i.e. calling destructors).
//
// The unwind map is an ...
- 455
2
votes
1
answer
264
views
I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()
#include <Windows.h>
int handle_exception (EXCEPTION_POINTERS *exception_pointers) {
exception_pointers->ContextRecord->Rip += 4;
return EXCEPTION_CONTINUE_EXECUTION;
}
int main (...
- 131
2
votes
1
answer
1k
views
Is there a way to show exceptions handlers in Hex-Rays decompiler output?
Is there a way to show these exception handlers in the decompiled code?
I can't tell that a block is in a __try block without looking into the disassembly.
__int64 __fastcall ...
- 23
1
vote
2
answers
996
views
Generate software breakpoint other than int3
Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example?
If so, I was wondering why debuggers don't support generating ...
- 185
7
votes
1
answer
1k
views
WHY and WHEN do we need SEH for buffer overflowing
In our course in university, we recently moved on from standard buffer-overflows to SEH based ones.
My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
- 173
3
votes
2
answers
649
views
Win32 SEH address
I have read this kind of code in some tutorials :
push handler ; Address of handler function
push FS:[0] ; Address of previous handler
mov FS:[0],ESP ; Install new Handler
I do not understand ...
- 797
0
votes
1
answer
2k
views
"Stepping Into" Exception Handler
I have some code which makes use of the Structured Exception Handler in order to employ some anti-debugging voodoo. It executes a series of instructions and I need to get the correct input. I can see ...
- 3
0
votes
2
answers
824
views
I have a question about SEH Overwrite
I am trying SEH Overwrite for vulnerable test programs.
However, overwriting the RET and SEH chains through 41414141 (input value) does not cause the EIP to run as 41414141.
The picture is that the ...
- 1
3
votes
1
answer
779
views
Win32 Structured Exception Handling in MS C++ - Mapping compiler code to assembly code
I am trying to read through Matt Pietrek article on "A Crash Course on the Depths of Win32 Structured Exception Handling" linked here. In the section titled Compiler-level SEH, he writes:
Now that ...
- 319
7
votes
2
answers
7k
views
How does Windows SafeSEH mechanism work?
How does Windows SafeSEH mechanism work?
I understand how the overwriting SEH exploitation technique works. I do not quite understand how the SafeSEH mechanism works preventing this technique from ...
- 211
1
vote
2
answers
1k
views
Reversing PECompact packed code (How SEH works)
I'm currently reversing file that is packed with PECompact packer. I'm interested in actual algorithm how it unpacks itself rather than having unpacked file.
It uses SEH for modifying program flow. ...
- 819
0
votes
1
answer
543
views
Monitoring Exceptions raised by an executable
Using tools like strace I can figure out the signals a program receives as it executes, regardless of whether or not signal handlers for those signals have been defined.
[EDIT]
In order to do the same ...
user1743
3
votes
1
answer
1k
views
Win64 .pdata required to be a separate COFF section?
It seems that Windows usually finds its support structures inside PEs by looking at the header information (especially OptionalHeader.DataDirectory[]), which means that there is no mandatory mapping ...
- 2,010
5
votes
1
answer
345
views
Do you have tips analyzing reported PoC(exploit) files?
My daily job is analyzing reported proof of concept files that exploits document viewers. People who report vulnerabilities in document viewers just give me the PoC and vulnerable version number. They ...
- 329
1
vote
2
answers
253
views
Need help analyzing an image viewer exploit
I recently acquired an exploit for an image viewer program and started analyzing.
Specific details cannot be given, but basically it is a SEH overwrite exploit using malicious image file.
Using ...
- 329
3
votes
3
answers
6k
views
Check DEP , ASLR and SafeSEH enabled or not , immlib
How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using immlib library of Python in Immunity Debugger ?
Actually I am looking for small code snippet for each.
- 265
24
votes
1
answer
13k
views
What's 'fs:[0]' doing and how can I execute it step by step?
In a 32 bits Windows binary, I see this code:
push next
push fs:[0]
mov fs:[0], esp
int3
...
next:
I see that something happens on the int3 (an error), but I don't understand why,...
- 6,684