异常处理第一讲(SEH),筛选器异常,以及__asm的扩展,寄存器注入简介

_declspec(naked) int MySub(int n1,int n2)
{
    int nLocal1;　　　　　　　　//注意变量
    int nLocal2;
    _asm
    {
        push ebp
        mov ebp,esp
        sub esp,8　　　　　　 //申请了两个变量,那么栈就要抬高8个字节,一个变量4个字节

        push 0
        push 0
        push 0
        push 0
    
    
        pop ebp
        ret
    }
}

sub esp,xxx

__asm
{
  ...
   mov nLocal,eax  //把eax的值给局部变量  
  ...    
}

__asm
{
  _emit 04ah
      
}

LPTOP_LEVEL_EXCEPTION_FILTER SetUnhandledExceptionFilter(
  LPTOP_LEVEL_EXCEPTION_FILTER lpTopLevelExceptionFilter 
);

LONG __stdcall 自己的回调函数名字(__EXCEPTION_POINTERS *ExceptionInfo)
{
  MessageBoxA(NULL,NULL,NULL,NULL);
  return 0;    
}

#include <stdio.h>
#include <windows.h>
LONG __stdcall MyException(_EXCEPTION_POINTERS *Ecptpoints)
{
    MessageBox(NULL, NULL, NULL, NULL);
    return 0;
}
int main(_In_ int _Argc, _In_reads_(_Argc) _Pre_z_ char ** _Argv, _In_z_ char ** _Env)
{

    SetUnhandledExceptionFilter(MyException); //设置异常的回调函数,如果有异常,操作系统会调用我们给的回调
    int *pNum = NULL;  
    *pNum = 1;　　　　　　//这里故意引发异常,空指针异常
    return 0;
}

typedef struct _EXCEPTION_POINTERS {
    PEXCEPTION_RECORD ExceptionRecord;　　　　//保存异常信息的结构体
    PCONTEXT ContextRecord;　　　　　　　　　　 //保存但是寄存器信息的结构体
} EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;

typedef struct _EXCEPTION_RECORD { 
  DWORD ExceptionCode; 　　　　　　　　　　　　　　　　//保存了错误代码
  DWORD ExceptionFlags; 　　　　　　　　　　　　　　　 //保存了错误标志
  struct _EXCEPTION_RECORD *ExceptionRecord; 　　 //类似于链表,继续保存错误信息(异常链)
  PVOID ExceptionAddress; 　　　　　　　　　　　　　　//错误发生的时候的地址
  DWORD NumberParameters; 　　　　　　　　　　　　　　//个数
  ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
} EXCEPTION_RECORD, *PEXCEPTION_RECORD; 　　　　　//附加数组

typedef struct _CONTEXT {

    //
    // The flags values within this flag control the contents of
    // a CONTEXT record.
    //
    // If the context record is used as an input parameter, then
    // for each portion of the context record controlled by a flag
    // whose value is set, it is assumed that that portion of the
    // context record contains valid context. If the context record
    // is being used to modify a threads context, then only that
    // portion of the threads context will be modified.
    //
    // If the context record is used as an IN OUT parameter to capture
    // the context of a thread, then only those portions of the thread's
    // context corresponding to set flags will be returned.
    //
    // The context record is never used as an OUT only parameter.
    //

    DWORD ContextFlags;

    //
    // This section is specified/returned if CONTEXT_DEBUG_REGISTERS is
    // set in ContextFlags.  Note that CONTEXT_DEBUG_REGISTERS is NOT
    // included in CONTEXT_FULL.
    //

    DWORD   Dr0;　　　　
    DWORD   Dr1;
    DWORD   Dr2;
    DWORD   Dr3;　　　　　　//这些寄存器我们没见过,主要是Dr0 - 3 是我们OD中硬件断点使用的,而 6 - 7是内存断点使用,具体设置寄存器,有专门的API
    DWORD   Dr6;
    DWORD   Dr7;

    //
    // This section is specified/returned if the
    // ContextFlags word contians the flag CONTEXT_FLOATING_POINT.
    //

    FLOATING_SAVE_AREA FloatSave;

    //
    // This section is specified/returned if the
    // ContextFlags word contians the flag CONTEXT_SEGMENTS.
    //

    DWORD   SegGs;
    DWORD   SegFs;
    DWORD   SegEs;
    DWORD   SegDs;

    //
    // This section is specified/returned if the
    // ContextFlags word contians the flag CONTEXT_INTEGER.
    //

    DWORD   Edi;
    DWORD   Esi;
    DWORD   Ebx;
    DWORD   Edx;
    DWORD   Ecx;
    DWORD   Eax;

    //
    // This section is specified/returned if the
    // ContextFlags word contians the flag CONTEXT_CONTROL.
    //

    DWORD   Ebp;
    DWORD   Eip;
    DWORD   SegCs;              // MUST BE SANITIZED
    DWORD   EFlags;             // MUST BE SANITIZED
    DWORD   Esp;
    DWORD   SegSs;

    //
    // This section is specified/returned if the ContextFlags word
    // contains the flag CONTEXT_EXTENDED_REGISTERS.
    // The format and contexts are processor specific
    //

    BYTE    ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION];

} CONTEXT;

BOOL SetThreadContext(
  HANDLE hThread,            // handle to thread
  CONST CONTEXT*lpContext   // context structure
);

/*
1.OpenThread     打开一个线程
2.SuspendThread 暂定这个线程
3.VirtualAllocEX    申请空间
4.WriteProcessMemory  写入DLL路径
5.修改Eip
6.ResumeThread  启动线程
....
*/
具体先看下网上的内容,时间关系,后面写