SEH相关数据结构（续）

╰+攻爆jí腚メ 2022-08-14 04:38 129阅读 0赞

继上一篇[SEH相关数据结构][SEH]，还有三个结构体很重要。

它们是EXCEPTION\_POINTERS、EXCEPTION\_RECORD、CONTEXT

当一个异常发生时，操作系统向引起异常的线程的堆栈里压入EXCEPTION\_POINTERS结构：

typedef struct _EXCEPTION_POINTERS {
        PEXCEPTION_RECORD ExceptionRecord;
        PCONTEXT ContextRecord;
    } EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;

上篇文章的程序跟踪到此处时

00401017    8B06            mov eax,dword ptr ds:[esi]

Shift+F7进入异常刚发生时的系统代码处，EXCEPTION\_POINTERS结构就在当前栈顶，那么当前堆栈的数据就是此结构的两个成员EXCEPTION\_RECORD、CONTEXT。

**EXCEPTION\_RECORD结构**

typedef struct _EXCEPTION_RECORD {
        DWORD    ExceptionCode;
        DWORD ExceptionFlags;
        struct _EXCEPTION_RECORD *ExceptionRecord;
        PVOID ExceptionAddress;
        DWORD NumberParameters;
        ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
        } EXCEPTION_RECORD;

这个结构包含有关最近发生异常的详细信息，这些信息独立于CPU。

这个ExceptionCode字段定义了产生异常的原因，下表列出了一些常见的异常原因：

<table> 
 <tbody> 
 <tr> 
 <td> 异常原因 </td> 
 <td> 对应值 </td> 
 <td> 说明 </td> 
 </tr> 
 <tr> 
 <td> STATUS_GUARD_PAGE_VIOLATION </td> 
 <td> 080000001h </td> 
 <td> 读写属性为PAGE_GUARD的页面 </td> 
 </tr> 
 <tr> 
 <td> EXCEPTION_BREAKPOINT </td> 
 <td> 080000003h </td> 
 <td> 断点异常 </td> 
 </tr> 
 <tr> 
 <td> EXCEPTION_SINGLE_STEP </td> 
 <td> 080000004h </td> 
 <td> 单步中断 </td> 
 </tr> 
 <tr> 
 <td> EXCEPTION_INVALID_HANDLE </td> 
 <td> 0C0000008h </td> 
 <td> 向一个函数传递了一个无效句柄 </td> 
 </tr> 
 <tr> 
 <td> EXCEPTION_ACCESS_VIOLATION </td> 
 <td> 0C0000005h </td> 
 <td> 读写内存冲突 </td> 
 </tr> 
 <tr> 
 <td> EXCEPTION_ILLEGAL_INSTRUCTION </td> 
 <td> 0C000001Dh </td> 
 <td> 遇到无效指令 </td> 
 </tr> 
 <tr> 
 <td> EXCEPTION_IN_PAGE_ERROR </td> 
 <td> 0C0000006h </td> 
 <td> 存取不存在的页面 </td> 
 </tr> 
 <tr> 
 <td> EXCEPTION_INT_DIVIDE_BY_ZERO </td> 
 <td> 0C0000094h </td> 
 <td> 除零错误 </td> 
 </tr> 
 <tr> 
 <td> EXCEPTION_STACK_OVERFLOW </td> 
 <td> 0C00000FDh </td> 
 <td> 堆栈溢出 </td> 
 </tr> 
 </tbody> 
</table>

00401017    8B06            mov eax,dword ptr ds:[esi]

这句会引发一个STATUS\_GUARD\_PAGE\_VIOLATION异常，异常代码是0C0000005h

在堆栈中数据窗口跟随，发现如下：

0018FAD0  05 00 00 C0 00 00 00 00 00 00 00 00 17 10 40 00  ..?.......@.  
0018FAE0  02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ...............  
  
**CONTEXT结构**

CONTEXT结构是Win32API一个几乎唯一与处理器相关的结构，包括了线程运行时处理器各主要寄存器的完整镜像，用于保存线程运行环境。

其结构如下：

typedef struct _CONTEXT {
    
        //
        // The flags values within this flag control the contents of
        // a CONTEXT record.
        //
        // If the context record is used as an input parameter, then
        // for each portion of the context record controlled by a flag
        // whose value is set, it is assumed that that portion of the
        // context record contains valid context. If the context record
        // is being used to modify a threads context, then only that
        // portion of the threads context will be modified.
        //
        // If the context record is used as an IN OUT parameter to capture
        // the context of a thread, then only those portions of the thread's
        // context corresponding to set flags will be returned.
        //
        // The context record is never used as an OUT only parameter.
        //
    
        DWORD ContextFlags;
    
        //
        // This section is specified/returned if CONTEXT_DEBUG_REGISTERS is
        // set in ContextFlags.  Note that CONTEXT_DEBUG_REGISTERS is NOT
        // included in CONTEXT_FULL.
        //
    
        DWORD   Dr0;
        DWORD   Dr1;
        DWORD   Dr2;
        DWORD   Dr3;
        DWORD   Dr6;
        DWORD   Dr7;
    
        //
        // This section is specified/returned if the
        // ContextFlags word contians the flag CONTEXT_FLOATING_POINT.
        //
    
        FLOATING_SAVE_AREA FloatSave;
    
        //
        // This section is specified/returned if the
        // ContextFlags word contians the flag CONTEXT_SEGMENTS.
        //
    
        DWORD   SegGs;
        DWORD   SegFs;
        DWORD   SegEs;
        DWORD   SegDs;
    
        //
        // This section is specified/returned if the
        // ContextFlags word contians the flag CONTEXT_INTEGER.
        //
    
        DWORD   Edi;
        DWORD   Esi;
        DWORD   Ebx;
        DWORD   Edx;
        DWORD   Ecx;
        DWORD   Eax;
    
        //
        // This section is specified/returned if the
        // ContextFlags word contians the flag CONTEXT_CONTROL.
        //
    
        DWORD   Ebp;
        DWORD   Eip;
        DWORD   SegCs;              // MUST BE SANITIZED
        DWORD   EFlags;             // MUST BE SANITIZED
        DWORD   Esp;
        DWORD   SegSs;
    
        //
        // This section is specified/returned if the ContextFlags word
        // contains the flag CONTEXT_EXTENDED_REGISTERS.
        // The format and contexts are processor specific
        //
    
        BYTE    ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION];
    
    } CONTEXT;

我们可以看一下regEip处的内容，发现它正好是我们异常发生处的地址。又一个值得深入理解的结构~~~~

[SEH]: http://blog.csdn.net/super_mimi/article/details/41623189