|You are here:|
- Windows error handling mechanism
- When an error occurs, the exception handler information is stored on the stack
- Use of __try and __except keywords in C++
- Some packers use SEH: When an exception is triggered, execution continues in the exception handler
The _EXCEPTION_REGISTRATION structure has two components:
- A pointer to an exception handler function
- A pointer to the previous _EXCEPTION_REGISTRATION record
The SEH chain:
- The address of the first record is always stored at the address pointed to by the FS register (FS:[O])
- The chain ends when the OS encounters OxFFFFFFFF
Misusing Structured Exception Handlers
SEH provides a flow control that is difficult to be understood by disassemblers and that fools debuggers.
Commentsblog comments powered by Disqus
This category currently contains no pages or media.