       墠 win32api c  hardware break point.
                   (c) by Voodoo/SMF
ਢ  ⥡ ⥫, "⥫" ;) .  ⮩     
 墠 㭪権 KERNEL32.dll c  hardware break point. ᫥ 
⮣   "⢀७"  ⠫  १  ६ ,  
  ࠧ.    襭 ⮩ ஡. : 
᪠ ᨬ   㤥 ᪠  ᪠ 㦭  䠩. 
   ⥩訬,   ⮣ 易⥫쭮 ⠢ १. 
ன: 墠뢠 win32api 㭪樨 ࠡ  䠩    ६ 㦭 
 䠩. 筮   㭪権  ⠡ ⮢  ᢮.  ⮬ 
 ஡: ண  ᯮ   㭪樨,   뢠  १ 
GetProcAddress.  室 墠뢠 GetProcAddress , ஫஢ 
 । 㭪権,   墠뢠,  ⠢ ᢮ .
墠뢠    㭪樨 ୥  ।⢥  . 
ਬ,  
                     push  NewMyFunction
                     ret
 ⮬ ᫥ ࠭  樨,   ⠪  믮 .  
ࠧ襭   KERNEL32.dll  ᯮ VirtualAllocEx.  NT  ⮤ 
 ਣ.  9-   ஡: VirtualAllocEx    
   KERNEL32.dll,  ᫨  ய  ring0,  " 
ய   ᮢ". 
 ᫨   i486 [1] ,   ⪭    "।⢠ ⫠".  
   :  " 80386  i486 ⫨  ।⢥ 
  ஬ । ⫠. .... 
  ....
   ⫠ ন ஫ 窨    .  饬, 
 ஫쭮 窮  ,  ᯮ짮 ண ணࠬ 
 ᮡ 砩 ⫠. ⠭ ஫쭮 窨   
ᯥ稢 ॣ 믮     ."
   ᮡ  ⫠ 뢠 int 1. ࠡ 
  ring3 쬠 ஡筮. Int 1  뢠   蠣 ⫠ 
ணࠬ. 
    ࠡ  砩 ⫠   ring3. 
 ⮣ ᯮ SEH [2].    ⫠ ⥬ 
। ࠢ SEH-  ⮪  맢  砩 ⫠,
c  ⥪⮬    ᪫祭 EXCEPTION_SINGLE_STEP.     
ॡ - ࠡ  ᪫祭.
  ࠧ, ⮡ 墠, ᪠ CreateFileA,  㦭 ந ᢮ SEH, 
㧨  DR0  CreateFileA,  DR7 ⠭  RW0,LEN0  0, L0  1  
   맮 :).   SEH    ⮪   
HBP (hardware break point) 㤥 ࠡ   ⥪  ⮪. 
.. ᫨ 㭪 CreateFileA 뢠   ⪨,    祣  
. 室   樨  墠 CreateThread.
墠⨢ CreateThread   塞  ⪨   襩 ணࠬ, 
 ࠨ SEH  ⠭ HBPs,  ⢥ ࠬ ⮪ 
(lpParameter) ।  ⪨,   뫠 ᪠. 
稢  ࠬ  ணࠬ ⤠ 㤠 ࠢ.  
뫮  ४⭥ ।  㪠⥫   : 
 dd  AddressOfNewThread 
 dd  OdlLpParameter
  ⥬ ⠭   ஥ 祭 lpParameter.
       ᫥ ࠡ⪥ EXCEPTION_SINGLE_STEP ᫥  HBP  
""  蠣 ० 믮 ணࠬ, ⠭  EFLAGS  TF=1. 
᫥ 믮   ᭮ ⠭ HBP.  室  
।饭 横.
 ⪮ ⮣ ⮤   ⢮ ॣ஢ ⫠: DR0-DR3.
 ⠪  ⮤ ࠡ⠥  win95  win2k, ..  win32 ᮢ⨬.
 ᥣ ⮣   室  䠩 seh_tr.asm
PS.
  ࠪ⨪, ⮤  .   ᫥ ⮣  , 
墠⨢ ࠡ稪, ⤠ ࠢ ண,  ⠭ ᢮ 
ࠡ稪.  ࠡ稪  祭 㦥   ⭮襭   :(. 
  ।    .  ய稢 calc.exe,   맮 
CreateThread  ᪫祭 (0x80000004) ஥ 㦠 . ⫠ 
,   ࠡ稪 室  3-. .. ⮡  ⮤ ࠡ⠫, 
室  "".   ""?     ।⮨ .
      ⮤ HBP  ᯮ짮   - ⫠,  - ⨪.

. :
[1]   .. ਣ쥢  
"ய i486. ⥪  ணࠬ஢ ( 4- )" 
      1
[2]  http://members.xoom.com/Iczel/Exceptionhandling.html
     http://members.xoom.com/Iczel/files/SEHinASM.zip

