;INFO: prezentacia vnorenych try..catch. ; menenim nastavenia registra EAX je mozne nastavovat uspesnost obsluhy SEH handlerov (01-03) ; Pre pochopenie je vhodne na handlery a "unwind" sekvencie breakpointy. ; Tato ukazka v (povodnej forme) vygeneruje vynimku, ktora je zachytena az tretim SEH handlerom (SEH_HANDLER_01_INSTALL). ; ; Ukazka je skusana pod OllyDbg 2.0. ; Treba v nom ale povolit automaticke vykonavanie obsluh SEH handlerov pre chybu typu "integer division by 0" ;Nastavenie: ; Zapnut: "Options->Options | Exceptions | Integer division by 0" ;Pseudokod: ; try ; try ; try ; i=i div 0 ; catch ; throw; ; end ; catch ; throw; ; end ; catch ; //OK :-) ; end format PE GUI 4.0 at 0x400000 include 'win32a.inc' section '.text' code readable executable SEH_HANDLER_01_INSTALL: push SEH_HANDLER_01 push dword [FS:0] mov [FS:0], ESP SEH_HANDLER_02_INSTALL: push SEH_HANDLER_02 push dword [FS:0] mov [FS:0], ESP SEH_HANDLER_03_INSTALL: push SEH_HANDLER_03 push dword [FS:0] mov [FS:0], ESP ;This cause error: xor eax, eax idiv eax nop nop nop SEH_HANDLER_03_UNWIND: pop dword [FS:0] add ESP, 4 SEH_HANDLER_02_UNWIND: pop dword [FS:0] add ESP, 4 SEH_HANDLER_01_UNWIND: pop dword [FS:0] add ESP, 4 EXIT: ret SEH_HANDLER_01: mov edx, [esp+0ch] ;CONTEXT mov dword [edx+0B8h], SEH_HANDLER_01_UNWIND; oprava EIP (CONTEXT.EIP = ...) mov ebx, [esp+08h] ;pointer to extablisher frame record mov dword [edx+0C4h], ebx; CONTEXT.ESP = ...) mov eax, 0 ; RETURN TRUE;!!!!!!!!!!!!!!!!!!! ret SEH_HANDLER_02: mov edx, [esp+0ch] ;CONTEXT mov dword [edx+0B8h], SEH_HANDLER_02_UNWIND; oprava EIP (CONTEXT.EIP = ...) mov ebx, [esp+08h] ;pointer to extablisher frame record mov dword [edx+0C4h], ebx; CONTEXT.ESP = ...) mov eax, 1 ; RETURN FALSE; (THROW) ret SEH_HANDLER_03: ;------------------- ; Handler03 Alternativa 1 - preskocenie mov edx, [esp+0ch] ;CONTEXT ; oprava EIP - nepouzije sa (CONTEXT.EIP = ...) ;mov dword [edx+0B8h], SEH_HANDLER_03_UNWIND ; OPRAVA ESP - vyuzijeme fakt, ze druhy parameter (pointer to established frame record) ukazuje zaroven aj na vrch zasobnika (ESP), ; v momente, kedy sa nastavi "TRY" blok. A kedze EIP sme si nastavili rovno na prislusny "Unwind" SEH handlera, nemusime sa o "unwind" starat, ; pretoze po navrate z vlakna sa nan skoci automaticky. ; O EBP sa nestarame, pretoze vsetky "TRY" bloky sme spustili akoby v jednej funkcii. ; Samozrejme, ze toto nie je jedina moznost, ako upravu EBP,ESP implementovat. :-) mov ebx, [esp+08h] ;pointer to extablisher frame record mov dword [edx+0C4h], ebx; CONTEXT.ESP = ...) mov eax, 1 ; RETURN FALSE; (THROW) ret ;------------------- ; Handler03 Alternativa 2 - OPRAVA EAX a pokracovanie. Esp netreba upravovat a ani EIP. staci sa retnut s vysledkom 0 mov edx, [esp+0ch] ;CONTEXT mov dword [edx+0A8h], 00h ; Context.EDX = 0 mov dword [edx+0B0h], 04h ; Context.EAX = 5 mov eax, 0 ret ;section '.reloc' fixups data readable discardable