Reverse Engineering for Beginners

(avery) #1

CHAPTER 68. WINDOWS NT CHAPTER 68. WINDOWS NT


jmp SHORT $LN2@main

; inner block filter:
$LN12@main:
$LN18@main:
mov ecx, DWORD PTR __$SEHRec$[ebp+4]
mov edx, DWORD PTR [ecx]
mov eax, DWORD PTR [edx]
mov DWORD PTR $T3[ebp], eax
cmp DWORD PTR $T3[ebp], -1073741819 ; c0000005H
jne SHORT $LN5@main
mov DWORD PTR tv72[ebp], 1
jmp SHORT $LN6@main
$LN5@main:
mov DWORD PTR tv72[ebp], 0
$LN6@main:
mov eax, DWORD PTR tv72[ebp]
$LN14@main:
$LN16@main:
ret 0


; inner block handler:
$LN13@main:
mov esp, DWORD PTR __$SEHRec$[ebp]
push OFFSET $SG85501 ; 'access violation, can''t recover'
call _printf
add esp, 4
mov DWORD PTR $SEHRec$[ebp+20], 0 ; exiting inner try block, setting previous try⤦
Çlevel back to 0
$LN2@main:
mov DWORD PTR
$SEHRec$[ebp+20], -2 ; exiting both blocks, setting previous try level⤦
Çback to -2
jmp SHORT $LN7@main


; outer block filter:
$LN8@main:
$LN19@main:
mov ecx, DWORD PTR $SEHRec$[ebp+4]
mov edx, DWORD PTR [ecx]
mov eax, DWORD PTR [edx]
mov DWORD PTR $T2[ebp], eax
mov ecx, DWORD PTR
$SEHRec$[ebp+4]
push ecx
mov edx, DWORD PTR $T2[ebp]
push edx
call _filter_user_exceptions
add esp, 8
$LN10@main:
$LN17@main:
ret 0


; outer block handler:
$LN9@main:
mov esp, DWORD PTR __$SEHRec$[ebp]
push OFFSET $SG85503 ; 'user exception caught'
call _printf
add esp, 4
mov DWORD PTR $SEHRec$[ebp+20], -2 ; exiting both blocks, setting previous try level⤦
Çback to -2
$LN7@main:
xor eax, eax
mov ecx, DWORD PTR
$SEHRec$[ebp+8]
mov DWORD PTR fs:0, ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0

Free download pdf