Description

• Windows error handling mechanism
• When an error occurs, the exception handler information is stored on the stack
• Use of __try and __except keywords in C++
• Some packers use SEH: When an exception is triggered, execution continues in the exception handler

SEH Chain

The _EXCEPTION_REGISTRATION structure has two components:

• A pointer to an exception handler function
• A pointer to the previous _EXCEPTION_REGISTRATION record

The SEH chain:

• The address of the first record is always stored at the address pointed to by the FS register (FS:[O])
• The chain ends when the OS encounters OxFFFFFFFF

Misusing Structured Exception Handlers

SEH provides a flow control that is difficult to be understood by disassemblers and that fools debuggers.

Comments