- [Duke's Virus Labs #9] - [Page 23] -

ᯮ짮 Structured Exception Handler (SEH).
(c) by Voodoo/SMF

  ᬠਢ  ᮢ   砫  ⨯  push dword ptr fs:[0] .
   樨 뫨 .      ⪭  ⠪
뢠 Structured Exception Handler.   ࠧࠡ⪥ Voodoo v3.1  
  ஡  訡   饭   ᪠ 000000H.
  ᪨ ⠬   ⮩ ஡ ( த... ).  
SEH   ᤮஢ .  ਬ CIH ᯮ SEH  "室 娬  "
  ᪠  WIN NT.   Win32.Cabanas SEH ᯮ짮  anti debug
ਥ.
    ᯮ짮 SEH  뢠 ᮡ 㤭.
 砫 ᫥ ࠭ 室 Handler :
        push dword ptr fs:[0]
 㪠  ᢮ ࠡ稪 :
       push offset NEWSEH_Handler
       mov fs:[0],sp
 襭 ᫥     :
       pop dword ptr fs:[0]
ਬ ᯮ짮 SEH :
 tasm32 /m3 /ml sehtest,,;
 tlink32 /Tpe /aa sehtest,sehtest,,import32.lib

===== Cut =====
        .386p
        .model  flat                            ; Good good... 32 bit r0x0r
        extrn   MessageBoxA:PROC                ; Defined APIs
        extrn   ExitProcess:PROC
        .data
 szTitle        db      "Structured Exception Handler",0
 szMessage      db      "Intercepted General Protection Fault!",0
        .code
 start:
        call    setupSEH                        ; The call pushes the offset
                                                ; past it in the stack rigth?
                                                ; So we will use that :)
 errorhandler:
        mov     esp,[esp+8]                     ; Put the original SEH offset
                                                ; Error gives us old ESP
                                                ; in [ESP+8]

        push    00000000h                       ; Parameters for MessageBoxA
        push    offset szTitle
        push    offset szMessage
        push    00000000h
        call    MessageBoxA

        push    00000000h
        call    ExitProcess                     ; Exit Application

 setupSEH:
        push    dword ptr fs:[0]                ; Push original SEH handler
        mov     fs:[0],esp                      ; And put the new one (located
                                                ; after the first call)

        mov     ebx,0BFF70000h                  ; Try to write in kernel (will
        mov     eax,012345678h                  ; generate an exception)
        xchg    eax,[ebx]
        ret
 end    start
===== Cut =====

筨 . ଠ樨 (ਫ  ) :
http://members.xoom.com/Iczel/Exceptionhandling.html
http://members.xoom.com/Iczel/files/SEHinASM.zip
