Reverse Engineering for Beginners

CHAPTER 68. WINDOWS NT CHAPTER 68. WINDOWS NT

Figure 68.4:Windows 7

Figure 68.5:Windows 8.1

Earlier, this handler was called Dr. Watson^31.

By the way, some developers make their own handler that sends information about the program crash to themselves. It is
registered with the help ofSetUnhandledExceptionFilter()and to be called if theOSdoes not have any other way
to handle the exception. An example is Oracle RDBMS —it saves huge dumps containing all possible information about the
CPUand memory state.

Let’s write our own primitive exception handler^32 :

#include <windows.h>
#include <stdio.h>

DWORD new_value=1234;

EXCEPTION_DISPOSITION __cdecl except_handler(
struct _EXCEPTION_RECORD ExceptionRecord,
void EstablisherFrame,
struct _CONTEXT ContextRecord,
void DispatcherContext )
{
unsigned i;

(^31) wikipedia
(^32) This example is based on the example from [Pie]
It must be compiled with the SAFESEH option:cl seh1.cpp /link /safeseh:no
More about SAFESEH here:
MSDN