Comments on: Armadillo, Nanomites and vectored exception-handling

By: v3n

v3n — Mon, 16 Feb 2009 11:37:45 +0000

thanks for explaining some obscure things.

By: Greg

Greg — Thu, 31 Jan 2008 01:15:06 +0000

Bill,

Can I ask where you got that address from? I searched for a little while but I can’t find any documentation on the implementation of VEH on any version of Windows. Judging from the results of ten minutes poking around in OllyDbg (I really should be using a kernel debugger for this) I get the impression that VEH is implemented as a doubly-linked list on the process’s main heap (with an index being stored in ntdll’s .data section: 0×77BF0180). All pointers to VEHs are encoded using RtlEncodePointer. This doesn’t sound too compatible with what you described. Could you shed some light on the situation?

My findings are derived using WoW32 under 64-bit Vista, so there may well be significant differences from XP. I’ll set up a multi-boot system at some point so I can investigate these matters further.

Greg

By: Bill Stevens

Bill Stevens — Wed, 30 Jan 2008 19:07:41 +0000

Is the pointer to the first VEH located in the same place in XP SP2 as it is documented to be in SP1? (0x….3210)

By: Rolf

Rolf — Fri, 21 Dec 2007 20:10:46 +0000

Nicely done

By: upb

upb — Mon, 17 Dec 2007 18:05:19 +0000

great idea, love your blog

You could also implement the same strategy by hooking KiUserExceptionDispatcher instead of adding a VEH, but that is more dirty