VMPROTECT处理异常3--seh4

0:000> dt ntdll!_TEB
   +0x000 NtTib            : _NT_TIB

typedef struct _NT_TIB {
    struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
    PVOID StackBase;
    PVOID StackLimit;
    PVOID SubSystemTib;
    union {
        PVOID FiberData;
        DWORD Version;
    };
    PVOID ArbitraryUserPointer;
    struct _NT_TIB *Self;
} NT_TIB;
typedef NT_TIB *PNT_TIB;

EXCEPTION_DISPOSITION __cdecl _except_handler (
    _In_ struct _EXCEPTION_RECORD *_ExceptionRecord,
    _In_ void * _EstablisherFrame,
    _Inout_ struct _CONTEXT *_ContextRecord,
    _Inout_ void * _DispatcherContext
    );

typedef
EXCEPTION_DISPOSITION
(*PEXCEPTION_ROUTINE) (
    IN struct _EXCEPTION_RECORD *ExceptionRecord,
    IN PVOID EstablisherFrame,
    IN OUT struct _CONTEXT *ContextRecord,
    IN OUT PVOID DispatcherContext
    );
typedef struct _EXCEPTION_REGISTRATION_RECORD {
    struct _EXCEPTION_REGISTRATION_RECORD *Next;// 下一个，从而形成链
    PEXCEPTION_ROUTINE Handler;
} EXCEPTION_REGISTRATION_RECORD;

EXCEPTION_DISPOSITION HGYSEH(
					   IN struct _EXCEPTION_RECORD *ExceptionRecord,
					   IN PVOID EstablisherFrame,
					   IN OUT struct _CONTEXT *ContextRecord,
					   IN OUT PVOID DispatcherContext
					   )
{
	return ExceptionContinueSearch;
}

int _tmain(int argc, _TCHAR* argv[])
{
	__asm
	{
		push HGYSEH				// 设置当前的_except_handler
		push DWORD PTR fs:[0]   // 设置_EXCEPTION_REGISTRATION_RECORD.next
		mov fs:[0],esp			// 设置到fs:[0]位


		mov eax, DWORD PTR fs:[0]
		call DWORD PTR[eax+4]	// 调用HGYSEH
	}

void SEHTest()
{
	__try
	{
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
	}
}

  8 012213c0 55              push    ebp
    8 012213c1 8bec            mov     ebp,esp
    8 012213c3 6afe            push    0FFFFFFFEh
    8 012213c5 68686a2201      push    offset test!__rtc_tzz+0x104 (01226a68)
    8 012213ca 687d102201      push    offset test!ILT+120(__except_handler4) (0122107d)//1. 压入 __except_handler4，它是缺省的异常处理程序
    8 012213cf 64a100000000    mov     eax,dword ptr fs:[00000000h]//TEB取值到eax
    8 012213d5 50              push    eax//2.压入前一个TEB 值
    8 012213d6 81c438ffffff    add     esp,0FFFFFF38h
    8 012213dc 53              push    ebx
    8 012213dd 56              push    esi
    8 012213de 57              push    edi
    8 012213df 8dbd28ffffff    lea     edi,[ebp-0D8h]
    8 012213e5 b930000000      mov     ecx,30h
    8 012213ea b8cccccccc      mov     eax,0CCCCCCCCh
    8 012213ef f3ab            rep stos dword ptr es:[edi]
    8 012213f1 a100702201      mov     eax,dword ptr [test!__security_cookie (01227000)]
    8 012213f6 3145f8          xor     dword ptr [ebp-8],eax
    8 012213f9 33c5            xor     eax,ebp
    8 012213fb 50              push    eax
    8 012213fc 8d45f0          lea     eax,[ebp-10h]
    8 012213ff 64a300000000    mov     dword ptr fs:[00000000h],eax// 设置 FS:[0] 值
    8 01221405 8965e8          mov     dword ptr [ebp-18h],esp
    9 01221408 c745fc00000000  mov     dword ptr [ebp-4],0
   11 0122140f c745fcfeffffff  mov     dword ptr [ebp-4],0FFFFFFFEh
   11 01221416 eb10            jmp     test!SEHTest+0x68 (01221428)  Branch
   
   15 01221428 8b4df0          mov     ecx,dword ptr [ebp-10h]
   15 0122142b 64890d00000000  mov     dword ptr fs:[0],ecx//恢复 SEH 链处理
   15 01221432 59              pop     ecx
   15 01221433 5f              pop     edi
   15 01221434 5e              pop     esi
   15 01221435 5b              pop     ebx
   15 01221436 8be5            mov     esp,ebp
   15 01221438 5d              pop     ebp
   15 01221439 c3              ret

; exception registration record structure.

__EXCEPTIONREGISTRATIONRECORD struc
        prev_structure          dd      ?
        ExceptionHandler        dd      ?
        ExceptionFilter         dd      ?//scopetable
        FilterFrame             dd      ?
        PExceptionInfoPtrs      dd      ?
__EXCEPTIONREGISTRATIONRECORD ends

struct _EXCEPTION_REGISTRATION{
      struct _EXCEPTION_REGISTRATION *prev;
      void (*handler)(PEXCEPTION_RECORD,
                      PEXCEPTION_REGISTRATION,
                      PCONTEXT,
                      PEXCEPTION_RECORD);
      struct scopetable_entry *scopetable;
      int trylevel;
      int _ebp;
      PEXCEPTION_POINTERS xpointers;
 };

012ec630          QQDemo!_except_handler4 (struct _EXCEPTION_RECORD *, struct _EXCEPTION_REGISTRATION_RECORD *, struct _CONTEXT *, void *)

-->
012ec783 e868000000      call    QQDemo!ValidateLocalCookies (012ec7f0)
-->
012ec7f0          QQDemo!ValidateLocalCookies (struct _EH4_SCOPETABLE *, char *)
-->
0:000> dt _EH4_SCOPETABLE
QQDemo!_EH4_SCOPETABLE
   +0x000 GSCookieOffset   : Uint4B
   +0x004 GSCookieXOROffset : Uint4B
   +0x008 EHCookieOffset   : Uint4B
   +0x00c EHCookieXOROffset : Uint4B
   +0x010 ScopeRecord      : [1] _EH4_SCOPETABLE_RECORD

struct _EH4_SCOPETABLE {
 UINT GSCookieOffset;
 UINT GSCookieXOROffset;
 UINT EHCookieOffset;
 UINT EHCookieXOROffset;
 _EH4_SCOPETABLE_RECORD ScopeRecord[1];
};