Skip to main content
6 votes
Accepted

WHY and WHEN do we need SEH for buffer overflowing

First of all, read this: https://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-litchfield.pdf That's pretty much how all this started. A SEH buffer overflow is a specific stack overflow that ...
Abigail's user avatar
  • 684
4 votes

What does state mean in unwinding?

the __ehstate_t type is defined as int. toState is the index of the next handler in the array that needs to be unwind. Action is the operation that needs to be done in order to reach the next state (...
Yotamz's user avatar
  • 1,272
4 votes
Accepted

When is EXCEPTION_REGISTRATION_RECORD created on the stack?

EXCEPTION_REGISTRATION_RECORD is placed on the stack in anticipation of an exception occurring. The "try" will put one there. The record is part of a chain, for as many nested "try&...
peter ferrie's user avatar
  • 4,709
4 votes
Accepted

Win32 Structured Exception Handling in MS C++ - Mapping compiler code to assembly code

In case of the compiler-level SEH, the callback invoked by the OS is the compiler-provided function, usually __except_handler3 or similar. Once called, it inspects the stack, retrieves the trylevel, ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

What code produces FuncInfoV1 with zero TryBlocks and zero UnwindMap?

So, EHFlags bits are defined as follows (see ehdata_values.h): #define FI_EHS_FLAG 0x00000001 #define FI_DYNSTKALIGN_FLAG 0x00000002 #define FI_EHNOEXCEPT_FLAG 0x00000004 i.e. 5 ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

Generate software breakpoint other than int3

A more flexible solution using x64dbg In addition to ollydbg2's built-in experimental support, it's relatively easy to achieve something similar in x64dbg, although some manual scripting is required. ...
NirIzr's user avatar
  • 11.8k
3 votes

Generate software breakpoint other than int3

if you were on windows then you can try ollydbg v2
blabb's user avatar
  • 16.4k
2 votes

I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()

just modified your source a bit to print Rip prior and post in handler added another exception and eliminated a warning (empty handler block) and tested with +1,+2,+3 +4 +5 on the handler Hardware ...
blabb's user avatar
  • 16.4k
1 vote

Determine if the function has try/catch statement via the static analysis

TL,DR; Exception handling can cause memory leaks. Your C++ compiler is smart enough to realize the possibility of memory leaks surrounding exception handling and is automatically inserting exception ...
Jerry Hundric's user avatar
1 vote

Win32 SEH address

fs:[0] points to ETHREAD whose first is member NtTib which again is a structure whose first member is _EXCEPTION_REGISTRATION_RECORD 0:000> dt ntdll!_TEB NtTib.* @$thread +0x000 NtTib : ...
blabb's user avatar
  • 16.4k
1 vote
Accepted

Win32 SEH address

Well the comment: "Install new handler" is a bit misleading. What you are installing is EXCEPTION_REGISTRATION_RECORD and if you would check how this structure looks like it would be more obvious that ...
Paweł Łukasik's user avatar
1 vote
Accepted

"Stepping Into" Exception Handler

from your second screen shot [ebp+10] will point to _CONTEXT ebx = [ebp+10] -> ebx == CONTEXT->FirstMember ==ContextFlags ebx+4 == CONTEXT->SecondMember == Dr0 (Debug Register 0) ebx+a0 == ...
blabb's user avatar
  • 16.4k
1 vote

I have a question about SEH Overwrite

There are two things you must check: You overwritten exception handler but, is there any exception occurs? Are there any protection mechanism active for exception handlers? For first one, most easy ...
Kerim Can Kalıpcıoğlu's user avatar
1 vote

I have a question about SEH Overwrite

The SEH overwrite attack requires that the function has registered an SEH handler. The SEH handler address exists below the stack cookie and return address. If you've overwritten the return address ...
peter ferrie's user avatar
  • 4,709

Only top scored, non community-wiki answers of a minimum length are eligible