15 votes
Accepted

What are the Vectored Continue Handlers

Unfortunately MSDN and windows API documentation is really scarce here, and I had difficulties finding anything other than the minimal description in MSDN. It turns out the Vectored Continue Handlers ...
NirIzr's user avatar
  • 11.8k
8 votes

Dealing with exceptions in x64dbg

Exceptions are complicated business. I will attempt to explain briefly how SEH (Structured Exception Handling) in Windows works to invoke the appropriate exception handler. Your game probably does not ...
barnaby-b's user avatar
  • 141
5 votes

how to overcome setunhandledexceptionfilter in ollyDebugger?

TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program. A more detailed ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

Win32 Structured Exception Handling in MS C++ - Mapping compiler code to assembly code

In case of the compiler-level SEH, the callback invoked by the OS is the compiler-provided function, usually __except_handler3 or similar. Once called, it inspects the stack, retrieves the trylevel, ...
Igor Skochinsky's user avatar
  • 36.6k
4 votes
Accepted

WinDBG. How to catch first-chance exceptions?

In WinDbg: !gflag +soe You can see http://www.openrce.org/blog/view/1564/Kernel_debugger_vs_user_mode_exceptions for more details.
Jason Geffner's user avatar
3 votes
Accepted

How to hook RuntimeException to prevent crashes?

RuntimeException is an Exception class like all the others, the only difference is that developers are not forced to catch RuntimeException and its child classes. And there is no special relation ...
Robert's user avatar
  • 1,042
3 votes
Accepted

Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?

So all the steps above are correct the way they were described. The only thing I have done wrong was, that my target DLL was modified by Mono.Cecil before (I already had read and wrote my target DLL ...
programming_is_bae's user avatar
3 votes

IDA Unknown Exception Code 6F4

\>cdb -c "!error 6f4;q" cdb | awk "/Reading/,/quit/" 0:000> cdb: Reading initial command '!error 6f4;q' **Error code: (Win32) 0x6f4 (1780) - A null reference pointer was ...
blabb's user avatar
  • 16.4k
3 votes

Access violation when reading [OLLYDEBUG]

TL;DR: Without understanding what's causing the access violation, it is hard to tell how best to address it. You will need to investigate the exception handler and the cause first. This status line ...
NirIzr's user avatar
  • 11.8k
3 votes
Accepted

how to bypass exception to debug EXE

It seems this exception is used to set the thread name for the debugger. You should be able to safely ignore it.
Igor Skochinsky's user avatar
  • 36.6k
3 votes
Accepted

Moving xmm0 onto the stack results in a access violation exception

According to definition of the assembly command movdqathe memory operand should be aligned by 16 (see Intel SDM at Vol. 2B 4-63): When the source or destination operand is a memory operand, the ...
w s's user avatar
  • 8,478
2 votes
Accepted

x64dbg and ollydbg error not enough memory

Based on the comments exchanged above, it sounds like the program uses anti-debugger code. You have a few options to deal with it: Find and disable (NOP / jump-over / etc.) the anti-debugging code. ...
Jason Geffner's user avatar
2 votes
Accepted

Target application crashes when using ReadProcessMemory

Alright, it would appear that we have an answer to this. And it's a lot simpler than I thought, and actually pretty cool. Basically, they allocate some pages with no physical backing until the page ...
Dave's user avatar
  • 153
2 votes
Accepted

GS Cookie and exception handlers

The function commented as "New Exception Handler", does contain a Cookie check. But I've never been able to step into it. Since the exception handler is called only during an exception, it won't be ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes

How to test and debug x86 Assembly exceptions in NASM?

The CPU exceptions are reported to the OS fault handler which then may either terminate the program or notify it via an OS specific mechanism. On Windows this is Structured Exception Handling (SEH), ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes

How to test and debug x86 Assembly exceptions in NASM?

Those are vectors for interrupt like int1....intn here is sample c code that generates and a handles int0 (#DE) ,int1 (#DB) ,int3 (#BP) and int6 (#UD) #include <stdio.h> #include <windows.h&...
blabb's user avatar
  • 16.4k
2 votes

I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()

just modified your source a bit to print Rip prior and post in handler added another exception and eliminated a warning (empty handler block) and tested with +1,+2,+3 +4 +5 on the handler Hardware ...
blabb's user avatar
  • 16.4k
2 votes
Accepted

IDA PRO Hex-Rays try-catch

I've considered doing this myself, but it's tricky for many reasons. First, exception internals are not standardized across languages, platforms, or implementations. 64-bit Windows programs use a data-...
Rolf Rolles's user avatar
  • 9,198
1 vote

IDA PRO Hex-Rays try-catch

In the end, it seems like there is no way to do this in IDA up to 7.5. It's a shame.
Ricardo's user avatar
  • 197
1 vote

How does Borland C++ 5 exception handling work?

Try to find Borland C++ Builder runtime sources, IIRC it included EH and RTTI details, albeit updated for Win32. Long time ago I made scripts for parsing and labeling those structures (see bcc.idc); ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Determine if the function has try/catch statement via the static analysis

TL,DR; Exception handling can cause memory leaks. Your C++ compiler is smart enough to realize the possibility of memory leaks surrounding exception handling and is automatically inserting exception ...
Jerry Hundric's user avatar
1 vote
Accepted

What is happening with these exceptions in OllyDbg?

You can see the list of SEH Chain in the View tab -> SEH Chain. Just set a breakpoint at the address of SEH.
ismael_akez's user avatar
1 vote
Accepted

Why the program can't write to specific memory area

I went to the memory map window. I searched for the memory address range for 408060. It was under .rsrc (Resources). It had only read permissions, I set it with write permissions too and now it works:...
E235's user avatar
  • 583
1 vote
Accepted

Is it possible to change the value of a register when a certain instruction is executed?

Alright, so apparently you can just edit ExceptionInfo->ContextRecord->Eax inside your LONG CALLBACK VectoredHandler( _In_ PEXCEPTION_POINTERS ExceptionInfo ); function and the OS will set ...
Majiick's user avatar
  • 188
1 vote

Target application crashes when using ReadProcessMemory

Check if attaching windbg in non-invasive mode works. If yes, check the page permissions of the target address range.
Igor Skochinsky's user avatar
  • 36.6k

Only top scored, non community-wiki answers of a minimum length are eligible