K
K
KrD2016-07-20 21:16:44
Windows
KrD, 2016-07-20 21:16:44

How to write a SEH handler in assembler for win32?

I am writing in assembler to search for the kernel32.dll base in the memory of my process. I took a pointer to the jungle of the .text section of this library from the top of the stack, then I look for the MZ signature by "reverse" search. There is an implementation with 64K address alignment and it works, but, in my opinion, this is not correct, because the memory page is 4K. Accordingly, in this situation, I will definitely get to the "empty" memory regions after the file headers and before the .text section, which requires installing my own SEH handler to return control to my code.
The problem is in the work of my handler: when I try to debug using the user-mode debugger, it crashes when an exception is triggered in the main code; without debugging, the process/thread is killed silently and without errors. There is no other way to debug it, only a long and thoughtful look.
I ask for your help in writing the correct SEH handler.
Version with 64k blocks and without SEH (working):
[pastebin.com/XbQMZriF]
Version with 4k blocks and with SEH (not working):
[pastebin.com/Utkywj68]

Answer the question

In order to leave comments, you need to log in

1 answer(s)
K
KrD, 2016-07-20
@KrD

I apologize: I was probably inattentive when reading the materials, or the materials were not the same (I don’t even remember).
I found documentation, where it turned out that the thread context is passed to the SEH handler not by the second, but by the third parameter. I corrected the code and it worked like clockwork.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question