登 录
引言：__global_unwind2函数是结构化异常处理的全局展开函数.
7C80DE94 ;int __cdecl _global_unwind2(_EXCEPTION_REGISTRATION *EstablisherFrame)<br /> 7C80DE94 __global_unwind2 proc near ; CODE XREF: __except_handler3+70p<br /> 7C80DE94<br /> 7C80DE94 EstablisherFrame= dword ptr 8<br /> 7C80DE94<br /> 7C80DE94 push ebp<br /> 7C80DE95 mov ebp, esp<br /> 7C80DE97 push ebx<br /> 7C80DE98 push esi<br /> 7C80DE99 push edi<br /> 7C80DE9A push ebp<br /> 7C80DE9B push 0 ; ReturnValue<br /> 7C80DE9D push 0 ; ExceptionRecord<br /> 7C80DE9F push offset loc_7C80DEAC ; TargetIp<br /> 7C80DEA4 push [ebp+EstablisherFrame] ; TargetFrame<br /> 7C80DEA7 call _RtlUnwind@16 ; RtlUnwind(x,x,x,x)<br /> 7C80DEAC<br /> 7C80DEAC loc_7C80DEAC: ; DATA XREF: __global_unwind2+Bo<br /> 7C80DEAC pop ebp<br /> 7C80DEAD pop edi<br /> 7C80DEAE pop esi<br /> 7C80DEAF pop ebx<br /> 7C80DEB0 mov esp, ebp<br /> 7C80DEB2 pop ebp<br /> 7C80DEB3 retn<br /> 7C80DEB3 __global_unwind2 endp
相应的伪代码：
/**<br /> * VC++扩展SEH的异常帧结构:<br /> * [ebp-18] ESP<br /> * [ebp-14] PEXCEPTION_POINTERS xpointers;<br /> * struct _EXCEPTION_REGISTRATION{<br /> * [ebp-10] struct _EXCEPTION_REGISTRATION *prev;<br /> * [ebp-0C] _except_handler handler;<br /> * [ebp-08] struct scopetable_entry *scopetable;<br /> * [ebp-04] int trylevel;<br /> * [ebp-00] int _ebp;<br /> * };<br /> *<br /> * RtlUnwind函数原型(Winternl.h)<br /> * void WINAPI RtlUnwind(<br /> * __in_opt PVOID TargetFrame,<br /> * __in_opt PVOID TargetIp,<br /> * __in_opt PEXCEPTION_RECORD ExceptionRecord,<br /> * __in PVOID ReturnValue<br /> * );<br /> *<br /> *参数说明：<br /> *EstablisherFrame - 引发异常的SEH帧<br /> **/</p> <p>int __cdecl _global_unwind2(_EXCEPTION_REGISTRATION *EstablisherFrame)<br /> {<br /> return RtlUnwind(EstablisherFrame,&loc_7C80DEAC,0,0);<br /> }
__global_unwind2只是简单的调用NtDLL.dll!RtlUnwind。下一篇，我会详细的分析RtlUnwind函数。
抱歉!评论已关闭.