VMPROTECT处理异常2-各种异常处理(VEH,VCH,SEH,UEF)

typedef struct _EXCEPTION_POINTERS {
    PEXCEPTION_RECORD ExceptionRecord;
    PCONTEXT ContextRecord;
} EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;

#define GetExceptionInformation     (struct _EXCEPTION_POINTERS *)_exception_info
LPEXCEPTION_POINTERS GetExceptionInformation(void);

DWORD SEHTest()
{
	DWORD dwTemp = 0;
	EXCEPTION_RECORD SavedExceptRec;
	CONTEXT SavedContext;
	__try
	{
		dwTemp = 5/dwTemp;//异常
	}
	__except(SavedExceptRec = *(GetExceptionInformation())->ExceptionRecord,
			 SavedContext = *(GetExceptionInformation())->ContextRecord,
			 EXCEPTION_EXECUTE_HANDLER)
	{
		//写这里面是错误的!:SavedExceptRec = *(GetExceptionInformation())->ExceptionRecord;
		//写这里面是错误的!SavedContext = *(GetExceptionInformation())->ContextRecord;
		int k = 0;
	}
	return dwTemp;
}

EXCEPTION_RECORD SavedExceptRec;
CONTEXT SavedContext;
LONG SEHFilter()
{
	//写这里面是错误的!:SavedExceptRec = *(GetExceptionInformation())->ExceptionRecord;
	//写这里面是错误的!SavedContext = *(GetExceptionInformation())->ContextRecord;
	return EXCEPTION_EXECUTE_HANDLER;
}
DWORD SEHTest()
{
	DWORD dwTemp = 0;
	__try
	{
		dwTemp = 5/dwTemp;//异常
	}
	__except(SEHFilter())
	{
		int k = 0;
	}
	return dwTemp;
}

LPTOP_LEVEL_EXCEPTION_FILTER WINAPI SetUnhandledExceptionFilter(
  __in          LPTOP_LEVEL_EXCEPTION_FILTER lpTopLevelExceptionFilter
);

LONG __stdcall UEFFilter(_EXCEPTION_POINTERS* ExceptionInfo)
{
	printf("UEF\n");
	return EXCEPTION_EXECUTE_HANDLER;
}

LONG __stdcall UEFFilter0(_EXCEPTION_POINTERS* ExceptionInfo)
{
	printf("UEF0\n");
	return EXCEPTION_EXECUTE_HANDLER;
}

int _tmain(int argc, _TCHAR* argv[])
{
	SetUnhandledExceptionFilter(&UEFFilter0);
	LPTOP_LEVEL_EXCEPTION_FILTER  lp = SetUnhandledExceptionFilter(&UEFFilter);
	lp(NULL);// 调用前一个设置函数

UEF0

PVOID WINAPI AddVectoredExceptionHandler(
  __in          ULONG FirstHandler,//为0,则回调位于VEH链表的尾部,非0则置于VEH链表的最前端
  __in          PVECTORED_EXCEPTION_HANDLER VectoredHandler);

ULONG WINAPI RemoveVectoredExceptionHandler(
  __in          PVOID Handler);

DWORD dwTemp = 0;
DWORD SEHTest()
{
	__try
	{
		dwTemp = 15/dwTemp;//异常
	}
	__except(MessageBoxA(NULL,"SEH",NULL,0),// 此处不会执行到,因为VEH已修复了dwTemp
		EXCEPTION_CONTINUE_SEARCH
		)
	{
	}
	return dwTemp;// 最后输出结果为15/5=3
}

LONG __stdcall VEHFilter0(_EXCEPTION_POINTERS* ExceptionInfo)
{
	MessageBoxA(NULL,"VEH0",NULL,0);
	dwTemp = 5;// 修复BUG
	return EXCEPTION_CONTINUE_EXECUTION;// 处理完,重新执行dwTemp = 15/dwTemp;
}

int _tmain(int argc, _TCHAR* argv[])
{
	AddVectoredExceptionHandler(1,&VEHFilter0);

PVOID WINAPI AddVectoredContinueHandler(
  __in          ULONG FirstHandler,
  __in          PVECTORED_EXCEPTION_HANDLER VectoredHandler);

ULONG WINAPI RemoveVectoredContinueHandler(
  __in          PVOID Handler);

DWORD dwTemp = 0;
DWORD SEHTest()
{
	dwTemp = 15/dwTemp;//异常
	return dwTemp;// 最后输出结果为15/5=3
}

LONG __stdcall VEHFilter(_EXCEPTION_POINTERS* ExceptionInfo)
{
	MessageBoxA(NULL,"VEH",NULL,0);
	dwTemp = 5;
	return EXCEPTION_CONTINUE_EXECUTION;//如果改为EXCEPTION_EXECUTE_HANDLER,不在调试状态下运行,不会弹VCH框!!
}

LONG __stdcall VCHFilter(_EXCEPTION_POINTERS* ExceptionInfo)
{
	MessageBoxA(NULL,"VCH",NULL,0);
	return EXCEPTION_EXECUTE_HANDLER;
}

int _tmain(int argc, _TCHAR* argv[])
{
	AddVectoredExceptionHandler(1,&VEHFilter);
	AddVectoredContinueHandler(1,&VCHFilter);

EXCEPTION_DISPOSITION __cdecl _except_handler (
    _In_ struct _EXCEPTION_RECORD *_ExceptionRecord,//异常记录结构指针
    _In_ void * _EstablisherFrame,//指向EXCEPTION_REGISTRATION结构,即SEH链
    _Inout_ struct _CONTEXT *_ContextRecord,//Context结构指针 (线程上下文)
    _Inout_ void * _DispatcherContext//调度器上下文
    );

typedef struct _EXCEPTION_POINTERS {
    PEXCEPTION_RECORD ExceptionRecord;//异常记录（EXCEPTION_RECORD）的指针
    PCONTEXT ContextRecord;//线程上下文的指针
} EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;

typedef struct _EXCEPTION_RECORD {
    DWORD    ExceptionCode;// ExceptionCode包含异常的代码,等同于GetExceptionCode()的值
    DWORD ExceptionFlags;
    struct _EXCEPTION_RECORD *ExceptionRecord;
    PVOID ExceptionAddress;
    DWORD NumberParameters;
    ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
    } EXCEPTION_RECORD;

typedef struct _CONTEXT {

     //-->ContextFlags成员用于向GetThreadContext函数指明你想检索哪些寄存器，注意GetThreadContext要先暂停线程
    DWORD ContextFlags;

    //-->CONTEXT_DEBUG_REGISTER用于标识CPU的调试寄存器
    DWORD   Dr0;
    DWORD   Dr1;
    DWORD   Dr2;
    DWORD   Dr3;
    DWORD   Dr6;
    DWORD   Dr7;

    //-->ONTEXT_FLOATING_POINT用于标识CPU的浮点寄存器
    FLOATING_SAVE_AREA FloatSave;

    //-->CONTEXT_SEGMENTS用于标识CPU的段寄存器
    DWORD   SegGs;
    DWORD   SegFs;
    DWORD   SegEs;
    DWORD   SegDs;

    //-->CONTEXT_INTEGER用于标识CPU的整数寄存器
    DWORD   Edi;
    DWORD   Esi;
    DWORD   Ebx;
    DWORD   Edx;
    DWORD   Ecx;
    DWORD   Eax;

    // -->CONTEXT_CONTROL包含CPU的控制寄存器，比如指令指针、堆栈指针、标志和函数返回地址
    DWORD   Ebp;
    DWORD   Eip;
    DWORD   SegCs;              // MUST BE SANITIZED
    DWORD   EFlags;             // MUST BE SANITIZED
    DWORD   Esp;
    DWORD   SegSs;

    //-->CONTEXT_EXTENDED_REGISTERS用于标识CPU的扩展寄存器
    BYTE    ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION];

} CONTEXT;

EXCEPTION_CONTINUE_EXECUTION (–1) Exception is dismissed. Continue execution at the point where the exception occurred.
EXCEPTION_CONTINUE_SEARCH (0)   Exception is not recognized. Continue to search up the stack for a handler, first for containing try-except statements, then for handlers with the next highest precedence.
EXCEPTION_EXECUTE_HANDLER (1)   Exception is recognized. Transfer control to the exception handler by executing the __except compound statement, then continue execution after the __except block. 

EXCEPTION_CONTINUE_EXECUTION:如果返回该值，系统会恢复传给EH的CONTEXT，重新执行引发异常的指令
EXCEPTION_CONTINUE_SEARCH：搜索下一个EH（异常处理函数）
EXCEPTION_EXECUTE_HANDLER：继续处理，如果是_except，则继续执行__except括号以后的正常指令

DWORD dwTemp = 0;
DWORD SEHTest()
{
	__try
	{
		dwTemp = 15/dwTemp;//异常
	}
	__except(MessageBoxA(NULL,"SEH",NULL,0),
		EXCEPTION_CONTINUE_SEARCH)
	{
	}
	return dwTemp;
}

LONG __stdcall VEHFilter(_EXCEPTION_POINTERS* ExceptionInfo)
{
	MessageBoxA(NULL,"VEH",NULL,0);
	return EXCEPTION_CONTINUE_SEARCH;
}

LONG __stdcall VCHFilter(_EXCEPTION_POINTERS* ExceptionInfo)
{
	MessageBoxA(NULL,"VCH",NULL,0);
	dwTemp = 5;// 最后修复
	return EXCEPTION_CONTINUE_SEARCH;
}

LONG __stdcall UEFFilter(_EXCEPTION_POINTERS* ExceptionInfo)
{
	MessageBoxA(NULL,"UEF",NULL,0);
	return EXCEPTION_CONTINUE_EXECUTION;//必须有一个返回EXCEPTION_CONTINUE_EXECUTION或在调试器状态下，才能触发VCH
}

int _tmain(int argc, _TCHAR* argv[])
{
	SetUnhandledExceptionFilter(&UEFFilter);
	AddVectoredExceptionHandler(1,&VEHFilter);
	AddVectoredContinueHandler(1,&VCHFilter);
	SEHTest();

int _tmain(int argc, _TCHAR* argv[])
{
	STARTUPINFO si = { 0 };
	si.cb = sizeof(si);
	PROCESS_INFORMATION pi = { 0 };
	if (CreateProcess(
		TEXT("G:\\test\\Debug\\test.exe"),
		NULL,NULL,NULL,FALSE,
		DEBUG_ONLY_THIS_PROCESS | CREATE_NEW_CONSOLE,
		NULL,NULL,&si,&pi) == FALSE)
	{
		return -1;
	}

	DEBUG_EVENT debugEvent;
	BOOL waitEvent = TRUE;
	while (WaitForDebugEvent(&debugEvent, INFINITE)) 
	{
		switch (debugEvent.dwDebugEventCode)
		{
		case EXCEPTION_DEBUG_EVENT:// 发生异常时触发
			{
				MessageBoxA(NULL,"Debug",NULL,0);
				break;
			}
		case EXIT_PROCESS_DEBUG_EVENT:
			{
				waitEvent = FALSE;
				break;
			}
		default:
			break;
		}
		if (waitEvent == TRUE) 
		{
			// DBG_EXCEPTION_NOT_HANDLED 表示未处理，DBG_CONTINUE表示已处理
			ContinueDebugEvent(debugEvent.dwProcessId, debugEvent.dwThreadId, DBG_EXCEPTION_NOT_HANDLED);
		}
		else 
		{
			break;
		}
	}
	CloseHandle(pi.hThread);
	CloseHandle(pi.hProcess);
	return 0;

typedef struct _EXCEPTION_DEBUG_INFO {
    EXCEPTION_RECORD ExceptionRecord;
    DWORD dwFirstChance;
} EXCEPTION_DEBUG_INFO, *LPEXCEPTION_DEBUG_INFO;