DBG: Implement most functions for exception handlers (SEH missing)

src/dbg/exhandlerinfo.cpp

@@ -0,0 +1,167 @@
+/**
+@file exhandlerinfo.cpp
+
+@brief ???
+*/
+
+#include "exhandlerinfo.h"
+#include "memory.h"
+#include "disasm_helper.h"
+#include "disasm_fast.h"
+#include "_exports.h"
+#include "module.h"
+#include "thread.h"
+
+bool ExHandlerGetInfo(EX_HANDLER_TYPE Type, EX_HANDLER_INFO* Info)
+{
+    bool ret = false;
+    std::vector<duint> handlerEntries;
+
+    switch(Type)
+    {
+    case EX_HANDLER_SEH:
+        ret = ExHandlerGetSEH(handlerEntries);
+        break;
+
+    case EX_HANDLER_VEH:
+        ret = ExHandlerGetVEH(handlerEntries);
+        break;
+
+    case EX_HANDLER_VCH:
+        ret = ExHandlerGetVCH(handlerEntries);
+        break;
+
+    case EX_HANDLER_UNHANDLED:
+        ret = ExHandlerGetUnhandled(handlerEntries);
+        break;
+    }
+
+    // Check if a call failed
+    if(!ret)
+    {
+        Info->count = 0;
+        Info->addresses = nullptr;
+        return false;
+    }
+
+    // Convert vector to C-style array
+    Info->count = (int)handlerEntries.size();
+    Info->addresses = (duint*)BridgeAlloc(Info->count * sizeof(duint));
+
+    memcpy(Info->addresses, handlerEntries.data(), Info->count * sizeof(duint));
+    return false;
+}
+
+bool ExHandlerGetSEH(std::vector<duint> & Entries)
+{
+    // TODO: 32-bit
+    // TODO: 64-bit
+    return false;
+}
+
+bool ExHandlerGetVEH(std::vector<duint> & Entries)
+{
+    // Try the address for Windows XP first (or older)
+    //
+    // VECTORED_EXCEPTION_NODE RtlpCalloutEntryList;
+    static duint addr_RtlpCalloutEntryList = 0;
+
+    if(addr_RtlpCalloutEntryList || valfromstring("ntdll:RtlpCalloutEntryList", &addr_RtlpCalloutEntryList))
+    {
+        // Read header node
+        VECTORED_EXCEPTION_NODE node;
+        memset(&node, 0, sizeof(VECTORED_EXCEPTION_NODE));
+
+        if(!MemRead(addr_RtlpCalloutEntryList, &node, sizeof(VECTORED_EXCEPTION_NODE)))
+            return false;
+
+        // Move to the next link
+        duint listCurrent = (duint)node.ListEntry.Flink;
+        duint listEnd = addr_RtlpCalloutEntryList;
+
+        while(listCurrent && listCurrent != listEnd)
+        {
+            duint handler = (duint)node.handler;
+
+            MemDecodePointer(&handler);
+            Entries.push_back(handler);
+
+            // Move to next element
+            memset(&node, 0, sizeof(VECTORED_EXCEPTION_NODE));
+
+            if(!MemRead(listCurrent, &node, sizeof(VECTORED_EXCEPTION_NODE)))
+                break;
+
+            listCurrent = (duint)node.ListEntry.Flink;
+        }
+    }
+
+    // Otherwise try the Windows Vista or newer version
+    return ExHandlerGetVCH(Entries, true);
+}
+
+bool ExHandlerGetVCH(std::vector<duint> & Entries, bool UseVEH)
+{
+    // VECTORED_HANDLER_LIST LdrpVectorHandlerList[2];
+    static duint addr_LdrpVectorHandlerList = 0;
+
+    if(!addr_LdrpVectorHandlerList && !valfromstring("ntdll:LdrpVectorHandlerList", &addr_LdrpVectorHandlerList))
+        return false;
+
+    // Increase array index when using continue handlers
+    if(!UseVEH)
+        addr_LdrpVectorHandlerList += (1 * sizeof(VECTORED_HANDLER_LIST));
+
+    // Read head entry
+    VECTORED_HANDLER_LIST list;
+    memset(&list, 0, sizeof(VECTORED_HANDLER_LIST));
+
+    if(!MemRead(addr_LdrpVectorHandlerList, &list, sizeof(VECTORED_HANDLER_LIST)))
+        return false;
+
+    // Sub-entries in list
+    duint listCurrent = (duint)list.Next;
+    duint listEnd = addr_LdrpVectorHandlerList;
+
+    while(listCurrent && listCurrent != listEnd)
+    {
+        duint handler = (duint)list.VectoredHandler;
+
+        MemDecodePointer(&handler);
+        Entries.push_back(handler);
+
+        // Move to next element
+        memset(&list, 0, sizeof(VECTORED_HANDLER_LIST));
+
+        if(!MemRead(listCurrent, &list, sizeof(VECTORED_HANDLER_LIST)))
+            break;
+
+        listCurrent = (duint)list.Next;
+    }
+
+    return true;
+}
+
+bool ExHandlerGetUnhandled(std::vector<duint> & Entries)
+{
+    // Try the address for Windows Vista+
+    static duint addr_BasepCurrentTopLevelFilter = 0;
+
+    if(addr_BasepCurrentTopLevelFilter || valfromstring("kernelbase:BasepCurrentTopLevelFilter", &addr_BasepCurrentTopLevelFilter))
+    {
+        // Read external pointer
+        duint handlerValue = 0;
+
+        if(!MemRead(addr_BasepCurrentTopLevelFilter, &handlerValue, sizeof(duint)))
+            return false;
+
+        // Decode with remote process cookie
+        if(!MemDecodePointer(&handlerValue))
+            return false;
+
+        Entries.push_back(handlerValue);
+        return true;
+    }
+
+    return false;
+}

src/dbg/exhandlerinfo.h

@@ -0,0 +1,26 @@
+#ifndef _EXHANDLERINFO_H
+#define _EXHANDLERINFO_H
+
+#include "_global.h"
+
+enum EX_HANDLER_TYPE
+{
+    EX_HANDLER_SEH,         // Structured
+    EX_HANDLER_VEH,         // Vectored
+    EX_HANDLER_VCH,         // Vectored continue
+    EX_HANDLER_UNHANDLED,   // Unhandled
+};
+
+struct EX_HANDLER_INFO
+{
+    int count;
+    duint* addresses;
+};
+
+bool ExHandlerGetInfo(EX_HANDLER_TYPE Type, EX_HANDLER_INFO* Info);
+bool ExHandlerGetSEH(std::vector<duint> & Entries);
+bool ExHandlerGetVEH(std::vector<duint> & Entries);
+bool ExHandlerGetVCH(std::vector<duint> & Entries, bool UseVEH);
+bool ExHandlerGetUnhandled(std::vector<duint> & Entries);
+
+#endif //_EXHANDLERINFO_H

src/dbg/undocumented.h

@@ -215,5 +215,18 @@ typedef struct _TEB
     PVOID                   StackReserved;
 } TEB, *PTEB;
 
+typedef struct _VECTORED_EXCEPTION_NODE
+{
+    LIST_ENTRY ListEntry;
+    PVECTORED_EXCEPTION_HANDLER handler;
+} VECTORED_EXCEPTION_NODE, *PVECTORED_EXCEPTION_NODE;
+
+typedef struct _LdrpVectorHandlerList
+{
+    struct _LdrpVectorHandlerList* Prev;
+    struct _LdrpVectorHandlerList* Next;
+    DWORD Depth;
+    PVECTORED_EXCEPTION_HANDLER VectoredHandler;
+} VECTORED_HANDLER_LIST, *PVECTORED_HANDLER_LIST;
 
 #endif /* _UNDOCUMENTED_H */

src/dbg/x64_dbg_dbg.vcxproj

@@ -42,6 +42,7 @@
     <ClCompile Include="error.cpp" />
     <ClCompile Include="exception.cpp" />
     <ClCompile Include="exceptiondirectoryanalysis.cpp" />
+    <ClCompile Include="exhandlerinfo.cpp" />
     <ClCompile Include="expressionparser.cpp" />
     <ClCompile Include="filehelper.cpp" />
     <ClCompile Include="function.cpp" />
@@ -119,6 +120,7 @@
     <ClInclude Include="error.h" />
     <ClInclude Include="exception.h" />
     <ClInclude Include="exceptiondirectoryanalysis.h" />
+    <ClInclude Include="exhandlerinfo.h" />
     <ClInclude Include="expressionparser.h" />
     <ClInclude Include="filehelper.h" />
     <ClInclude Include="function.h" />

src/dbg/x64_dbg_dbg.vcxproj.filters

@@ -293,6 +293,9 @@
     <ClCompile Include="_scriptapi_symbol.cpp">
       <Filter>Source Files\Interfaces/Exports\_scriptapi</Filter>
     </ClCompile>
+    <ClCompile Include="exhandlerinfo.cpp">
+      <Filter>Source Files\Information</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="x64_dbg.h">
@@ -646,5 +649,8 @@
     <ClInclude Include="_scriptapi_symbol.h">
       <Filter>Header Files\Interfaces/Exports\_scriptapi</Filter>
     </ClInclude>
+    <ClInclude Include="exhandlerinfo.h">
+      <Filter>Header Files\Information</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>