逆向分析MSVCR90D.dll!_except_handler4函数

引言：MSVCR90D.dll!_except_handler4函数是C/C++运行库自动生成的异常处理函数。

004114A0 _EXCEPTION_DISPOSITION __cdecl _except_handler4( 004114A0 _EXCEPTION_RECORD *ExceptionRecord, 004114A0 _EXCEPTION_REGISTRATION_RECORD *EstablisherFrame, 004114A0 _CONTEXT *ContextRecord, 004114A0 void *DispatcherContext 004114A0 ) 004114A0 004114A0 ExceptionRecord = dword ptr 8 004114A0 EstablisherFrame= dword ptr 0Ch 004114A0 ContextRecord = dword ptr 10h 004114A0 DispatcherContext= dword ptr 14h 004114A0 004114A0 mov edi, edi 004114A2 push ebp 004114A3 mov ebp, esp 004114A5 mov eax, [ebp+DispatcherContext] 004114A8 push eax 004114A9 mov ecx, [ebp+ContextRecord] 004114AC push ecx 004114AD mov edx, [ebp+EstablisherFrame] 004114B0 push edx 004114B1 mov eax, [ebp+ExceptionRecord] 004114B4 push eax 004114B5 push offset j_@__security_check_cookie@4 ; __security_check_cookie(x) 004114BA push offset ___security_cookie 004114BF call j___except_handler4_common ; __except_handler4_common 004114C4 add esp, 18h 004114C7 pop ebp 004114C8 retn 004114C8 __except_handler4 endp

相应的伪代码：

/** *结构描述：异常处理函数返回值,即__try/__except(filter)结构中filter的返回值. *所在定义: excpt.h *typedef enum _EXCEPTION_DISPOSITION { * ExceptionContinueExecution, * ExceptionContinueSearch, * ExceptionNestedException, * ExceptionCollidedUnwind *} EXCEPTION_DISPOSITION; * * *结构描述:异常记录信息(WinNT.h). *typedef struct _EXCEPTION_RECORD { * DWORD ExceptionCode; * DWORD ExceptionFlags; * struct _EXCEPTION_RECORD *ExceptionRecord; * PVOID ExceptionAddress; * DWORD NumberParameters; * ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; *} EXCEPTION_RECORD; * * *异常处理函数原型(exsup.inc) *typedef void (*_except_handler)(PEXCEPTION_RECORD, PEXCEPTION_REGISTRATION, PCONTEXT, PEXCEPTION_RECORD); * *操作系统级别的SEH结构,FS:[0]中存放的原始结构(exsup.inc) *typedef struct _EXCEPTION_REGISTRATION_RECORD { * DWORD prev; * _except_handler handler; *} * **/ _EXCEPTION_DISPOSITION __cdecl _except_handler4( _EXCEPTION_RECORD *ExceptionRecord, _EXCEPTION_REGISTRATION_RECORD *EstablisherFrame, _CONTEXT *ContextRecord, void *DispatcherContext ) { //用于验证安全码正确与否. void __fastcall __security_check_cookie(unsigned int cookie); extern DWORD ___security_cookie; //调用__except_handler4_common.C/C++运行库级别上,真正执行异常处理的函数. return __except_handler4_common(&___security_cookie, &__security_check_cookie, ExceptionRecord, EstablisherFrame, ContextRecord, DispatcherContext ); }

其中__security_check_cookie函数仅仅是验证___security_cookie的值有没有被非法修改/破坏，有的话就抛出异常终止程序。最终_except_handler4调用__except_handler4_common执行异常处理。