Questions tagged [seh]

Structured Exception Handling is the mechanism used by compilers for try/catch blocks. It can also be used as anti-debug tricks, by altering the flow, changing the thread context, debugging oneself...

Filter by
Sorted by
Tagged with
0
votes
0answers
45 views

Can I reverse engineer a DLL file and add SEH or some error handing codes to it?

I am using some DLL files in my Java application using JNI library. The dlls are not written by me and I do not have access to their source codes. They are so buggy and throw lots of exceptions. ...
0
votes
0answers
26 views

Some more questions related to C++ exceptions (catchHigh)

I've came up with the most convoluted example but still can't find the purpose of the catchHigh field. I find it that the right handler can be selected simply by looking at the tryblock map from start ...
1
vote
1answer
82 views

What code produces FuncInfoV1 with zero TryBlocks and zero UnwindMap?

Topic is C++ exceptions internal representation in WIndows x86 binaries compiled with msvc. I've found a code that straight up doesn't have nothing (all fields of FuncInfo zero) except the EHFlags ...
2
votes
1answer
88 views

What does state mean in unwinding?

I'm looking at UnwindMapEntry. Here is it's declaration: // // UnwindMapEntry - Description of each state transition for unwinding // the stack (i.e. calling destructors). // // The unwind map is an ...
2
votes
1answer
90 views

I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()

#include <Windows.h> int handle_exception (EXCEPTION_POINTERS *exception_pointers) { exception_pointers->ContextRecord->Rip += 4; return EXCEPTION_CONTINUE_EXECUTION; } int main (...
1
vote
1answer
138 views

Is there a way to show exceptions handlers in Hex-Rays decompiler output?

Is there a way to show these exception handlers in the decompiled code? I can't tell that a block is in a __try block without looking into the disassembly. __int64 __fastcall ...
1
vote
2answers
484 views

Generate software breakpoint other than int3

Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example? If so, I was wondering why debuggers don't support generating ...
7
votes
1answer
652 views

WHY and WHEN do we need SEH for buffer overflowing

In our course in university, we recently moved on from standard buffer-overflows to SEH based ones. My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
2
votes
2answers
237 views

Win32 SEH address

I have read this kind of code in some tutorials : push handler ; Address of handler function push FS:[0] ; Address of previous handler mov FS:[0],ESP ; Install new Handler I do not understand ...
0
votes
1answer
888 views

“Stepping Into” Exception Handler

I have some code which makes use of the Structured Exception Handler in order to employ some anti-debugging voodoo. It executes a series of instructions and I need to get the correct input. I can see ...
0
votes
2answers
599 views

I have a question about SEH Overwrite

I am trying SEH Overwrite for vulnerable test programs. However, overwriting the RET and SEH chains through 41414141 (input value) does not cause the EIP to run as 41414141. The picture is that the ...
3
votes
1answer
543 views

Win32 Structured Exception Handling in MS C++ - Mapping compiler code to assembly code

I am trying to read through Matt Pietrek article on "A Crash Course on the Depths of Win32 Structured Exception Handling" linked here. In the section titled Compiler-level SEH, he writes: Now that ...
6
votes
2answers
6k views

How does Windows SafeSEH mechanism work?

How does Windows SafeSEH mechanism work? I understand how the overwriting SEH exploitation technique works. I do not quite understand how the SafeSEH mechanism works preventing this technique from ...
1
vote
2answers
960 views

Reversing PECompact packed code (How SEH works)

I'm currently reversing file that is packed with PECompact packer. I'm interested in actual algorithm how it unpacks itself rather than having unpacked file. It uses SEH for modifying program flow. ...
0
votes
1answer
436 views

Monitoring Exceptions raised by an executable

Using tools like strace I can figure out the signals a program receives as it executes, regardless of whether or not signal handlers for those signals have been defined. [EDIT] In order to do the ...
3
votes
1answer
960 views

Win64 .pdata required to be a separate COFF section?

It seems that Windows usually finds its support structures inside PEs by looking at the header information (especially OptionalHeader.DataDirectory[]), which means that there is no mandatory mapping ...
5
votes
1answer
335 views

Do you have tips analyzing reported PoC(exploit) files?

My daily job is analyzing reported proof of concept files that exploits document viewers. People who report vulnerabilities in document viewers just give me the PoC and vulnerable version number. They ...
0
votes
2answers
228 views

Need help analyzing an image viewer exploit

I recently acquired an exploit for an image viewer program and started analyzing. Specific details cannot be given, but basically it is a SEH overwrite exploit using malicious image file. Using ...
3
votes
3answers
5k views

Check DEP , ASLR and SafeSEH enabled or not , immlib

How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using immlib library of Python in Immunity Debugger ? Actually I am looking for small code snippet for each.
20
votes
1answer
9k views

What's 'fs:[0]' doing and how can I execute it step by step?

In a 32 bits Windows binary, I see this code: push next push fs:[0] mov fs:[0], esp int3 ... next: I see that something happens on the int3 (an error), but I don't understand why,...