16
votes
Accepted
What are the Vectored Continue Handlers
Unfortunately MSDN and windows API documentation is really scarce here, and I had difficulties finding anything other than the minimal description in MSDN.
It turns out the Vectored Continue Handlers ...
- 11.8k
8
votes
Dealing with exceptions in x64dbg
Exceptions are complicated business. I will attempt to explain briefly how SEH (Structured Exception Handling) in Windows works to invoke the appropriate exception handler. Your game probably does not ...
- 141
5
votes
how to overcome setunhandledexceptionfilter in ollyDebugger?
TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program.
A more detailed ...
- 11.8k
3
votes
Accepted
How to hook RuntimeException to prevent crashes?
RuntimeException is an Exception class like all the others, the only difference is that developers are not forced to catch RuntimeException and its child classes. And there is no special relation ...
- 1,145
3
votes
Accepted
Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?
So all the steps above are correct the way they were described. The only thing I have done wrong was, that my target DLL was modified by Mono.Cecil before (I already had read and wrote my target DLL ...
3
votes
IDA Unknown Exception Code 6F4
\>cdb -c "!error 6f4;q" cdb | awk "/Reading/,/quit/"
0:000> cdb: Reading initial command '!error 6f4;q'
**Error code: (Win32) 0x6f4 (1780) - A null reference pointer was ...
- 16.5k
3
votes
Access violation when reading [OLLYDEBUG]
TL;DR: Without understanding what's causing the access violation, it is hard to tell how best to address it. You will need to investigate the exception handler and the cause first.
This status line ...
- 11.8k
3
votes
Accepted
how to bypass exception to debug EXE
It seems this exception is used to set the thread name for the debugger. You should be able to safely ignore it.
- 36.9k
3
votes
Accepted
Moving xmm0 onto the stack results in a access violation exception
According to definition of the assembly command movdqathe memory operand should be aligned by 16 (see Intel SDM at Vol. 2B 4-63):
When the source or destination operand is a memory operand, the
...
- 8,528
2
votes
Accepted
GS Cookie and exception handlers
The function commented as "New Exception Handler", does contain a Cookie check. But I've never been able to step into it.
Since the exception handler is called only during an exception, it won't be ...
- 36.9k
2
votes
How to test and debug x86 Assembly exceptions in NASM?
The CPU exceptions are reported to the OS fault handler which then may either terminate the program or notify it via an OS specific mechanism. On Windows this is Structured Exception Handling (SEH), ...
- 36.9k
2
votes
How to test and debug x86 Assembly exceptions in NASM?
Those are vectors for interrupt like int1....intn
here is sample c code that generates and a handles
int0 (#DE) ,int1 (#DB) ,int3 (#BP) and int6 (#UD)
#include <stdio.h>
#include <windows.h&...
- 16.5k
2
votes
I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()
just modified your source a bit to print Rip prior and post in handler
added another exception and eliminated a warning (empty handler block)
and tested with +1,+2,+3 +4 +5 on the handler Hardware ...
- 16.5k
2
votes
Accepted
IDA PRO Hex-Rays try-catch
I've considered doing this myself, but it's tricky for many reasons.
First, exception internals are not standardized across languages, platforms, or implementations. 64-bit Windows programs use a data-...
- 9,198
1
vote
IDA PRO Hex-Rays try-catch
In the end, it seems like there is no way to do this in IDA up to 7.5. It's a shame.
- 197
1
vote
How does Borland C++ 5 exception handling work?
Try to find Borland C++ Builder runtime sources, IIRC it included EH and RTTI details, albeit updated for Win32. Long time ago I made scripts for parsing and labeling those structures (see bcc.idc); ...
- 36.9k
1
vote
Determine if the function has try/catch statement via the static analysis
TL,DR;
Exception handling can cause memory leaks. Your C++ compiler is smart enough to realize the possibility of memory leaks surrounding exception handling and is automatically inserting exception ...
1
vote
Accepted
What is happening with these exceptions in OllyDbg?
You can see the list of SEH Chain in the View tab -> SEH Chain. Just set a breakpoint at the address of SEH.
- 417
1
vote
Accepted
Why the program can't write to specific memory area
I went to the memory map window.
I searched for the memory address range for 408060.
It was under .rsrc (Resources).
It had only read permissions, I set it with write permissions too and now it works:...
- 583
1
vote
Accepted
Is it possible to change the value of a register when a certain instruction is executed?
Alright, so apparently you can just edit ExceptionInfo->ContextRecord->Eax inside your
LONG CALLBACK VectoredHandler(
_In_ PEXCEPTION_POINTERS ExceptionInfo
);
function and the OS will set ...
- 188
Only top scored, non community-wiki answers of a minimum length are eligible