学步园

引言：MSVCR90D.dll!_except_handler4函数是C/C++运行库自动生成的异常处理函数。

004114A0 _EXCEPTION_DISPOSITION __cdecl _except_handler4(<br /> 004114A0 _EXCEPTION_RECORD *ExceptionRecord,<br /> 004114A0 _EXCEPTION_REGISTRATION_RECORD *EstablisherFrame,<br /> 004114A0 _CONTEXT *ContextRecord,<br /> 004114A0 void *DispatcherContext<br /> 004114A0 )<br /> 004114A0<br /> 004114A0 ExceptionRecord = dword ptr 8<br /> 004114A0 EstablisherFrame= dword ptr 0Ch<br /> 004114A0 ContextRecord = dword ptr 10h<br /> 004114A0 DispatcherContext= dword ptr 14h<br /> 004114A0<br /> 004114A0 mov edi, edi<br /> 004114A2 push ebp<br /> 004114A3 mov ebp, esp<br /> 004114A5 mov eax, [ebp+DispatcherContext]<br /> 004114A8 push eax<br /> 004114A9 mov ecx, [ebp+ContextRecord]<br /> 004114AC push ecx<br /> 004114AD mov edx, [ebp+EstablisherFrame]<br /> 004114B0 push edx<br /> 004114B1 mov eax, [ebp+ExceptionRecord]<br /> 004114B4 push eax<br /> 004114B5 push offset j_@__security_check_cookie@4 ; __security_check_cookie(x)<br /> 004114BA push offset ___security_cookie<br /> 004114BF call j___except_handler4_common ; __except_handler4_common<br /> 004114C4 add esp, 18h<br /> 004114C7 pop ebp<br /> 004114C8 retn<br /> 004114C8 __except_handler4 endp<br />

相应的伪代码：

/**<br /> *结构描述：异常处理函数返回值,即__try/__except(filter)结构中filter的返回值.<br /> *所在定义: excpt.h<br /> *typedef enum _EXCEPTION_DISPOSITION {<br /> * ExceptionContinueExecution,<br /> * ExceptionContinueSearch,<br /> * ExceptionNestedException,<br /> * ExceptionCollidedUnwind<br /> *} EXCEPTION_DISPOSITION;<br /> *<br /> *<br /> *结构描述:异常记录信息(WinNT.h).<br /> *typedef struct _EXCEPTION_RECORD {<br /> * DWORD ExceptionCode;<br /> * DWORD ExceptionFlags;<br /> * struct _EXCEPTION_RECORD *ExceptionRecord;<br /> * PVOID ExceptionAddress;<br /> * DWORD NumberParameters;<br /> * ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];<br /> *} EXCEPTION_RECORD;<br /> *<br /> *<br /> *异常处理函数原型(exsup.inc)<br /> *typedef void (*_except_handler)(PEXCEPTION_RECORD, PEXCEPTION_REGISTRATION, PCONTEXT, PEXCEPTION_RECORD);<br /> *<br /> *操作系统级别的SEH结构,FS:[0]中存放的原始结构(exsup.inc)<br /> *typedef struct _EXCEPTION_REGISTRATION_RECORD {<br /> * DWORD prev;<br /> * _except_handler handler;<br /> *}<br /> *<br /> **/<br /> _EXCEPTION_DISPOSITION __cdecl _except_handler4(<br /> _EXCEPTION_RECORD *ExceptionRecord,<br /> _EXCEPTION_REGISTRATION_RECORD *EstablisherFrame,<br /> _CONTEXT *ContextRecord,<br /> void *DispatcherContext<br /> )<br /> {<br /> //用于验证安全码正确与否.<br /> void __fastcall __security_check_cookie(unsigned int cookie);<br /> extern DWORD ___security_cookie;</p> <p> //调用__except_handler4_common.C/C++运行库级别上,真正执行异常处理的函数.<br /> return __except_handler4_common(&___security_cookie,<br /> &__security_check_cookie,<br /> ExceptionRecord,<br /> EstablisherFrame,<br /> ContextRecord,<br /> DispatcherContext<br /> );<br /> }

其中__security_check_cookie函数仅仅是验证___security_cookie的值有没有被非法修改/破坏，有的话就抛出异常终止程序。最终_except_handler4调用__except_handler4_common执行异常处理。