Last active
January 4, 2016 19:09
-
-
Save sinitcin/8665047 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* seh64.inc | |
macro enqueue list,item | |
{ match any,list \{ list equ list,item \} | |
match ,list \{ list equ item \} } | |
macro dequeue list,item | |
{ done@dequeue equ | |
match first=,rest,list | |
\{ item equ first | |
list equ rest | |
restore done@dequeue \} | |
match :m,done@dequeue:list | |
\{ item equ m | |
list equ | |
restore done@dequeue \} | |
match ,done@dequeue | |
\{ item equ | |
restore done@dequeue | |
\} } | |
macro queue list,index,item | |
{ local copy | |
copy equ list | |
rept index+1 \{ dequeue copy,item \} } | |
macro data directory | |
{ done@data equ | |
match =3,directory | |
\{ local l_infos,_info,_end | |
l_infos equ | |
align 4 | |
match list,l_handlers | |
\\{ | |
irp _handler,list | |
\\\{ local rva$ | |
rva$ = rva $ | |
enqueue l_infos,rva$ | |
db 19h,0,0,0 | |
dd _handler,0 | |
\\\} | |
\\} | |
data 3 | |
match list,l_begins | |
\\{ | |
irp _begin,list | |
\\\{ | |
dequeue l_ends,_end | |
dequeue l_infos,_info | |
dd _begin | |
dd _end | |
dd _info | |
\\\} | |
\\} | |
restore done@data | |
\} | |
match ,done@data | |
\{ data directory | |
restore done@data \} } | |
l_begins equ | |
l_ends equ | |
l_handlers equ | |
macro .try handler | |
{ local ..try | |
__TRY equ ..try | |
local ..end | |
__END equ ..end | |
local ..catch | |
__CATCH equ ..catch | |
__TRY: | |
if ~ handler eq | |
virtual at handler | |
__CATCH: | |
end virtual | |
end if } | |
macro .catch | |
{ jmp __END | |
__CATCH: } | |
macro .end | |
{ __END: | |
enqueue l_begins,rva __TRY | |
enqueue l_ends,rva __END | |
enqueue l_handlers,rva __CATCH | |
restore __TRY | |
restore __END | |
restore __CATCH } | |
* Ну и сама программка: | |
format PE64 GUI 4.0 | |
entry start | |
include 'win64a.inc' | |
include 'seh64.inc' | |
seh equ 3 | |
CONTEXT64.Rip = 0F8h | |
section '.code' code readable executable | |
start: | |
sub rsp,8*(4+1) | |
.try handler | |
xor eax,eax | |
mov dword[eax],0 | |
.end | |
safe_place: | |
.try | |
xor eax,eax | |
mov dword[eax],0 | |
.catch | |
mov rsp,rdx | |
xor r9,r9 | |
xor r8,r8 | |
lea rdx,[handler2] | |
xor ecx,ecx | |
call [MessageBox] | |
.end | |
xor r9,r9 | |
xor r8,r8 | |
lea rdx,[k] | |
xor ecx,ecx | |
call [MessageBox] | |
xor ecx,ecx | |
call [ExitProcess] | |
handler: | |
sub rsp,8*(4+1) | |
mov qword [r8+CONTEXT64.Rip],safe_place | |
xor r9,r9 | |
xor r8,r8 | |
lea rdx,[handler1] | |
xor ecx,ecx | |
call [MessageBox] | |
xor eax,eax | |
add rsp,8*(4+1) | |
retn | |
section '.data' data readable writeable | |
k db 'k.',0 | |
handler1 db 'in handler1',0 | |
handler2 db 'in handler2',0 | |
data seh | |
end data | |
section '.idata' import data readable | |
library kernel32,'KERNEL32.DLL',\ | |
user32,'USER32.DLL' | |
import kernel32,\ | |
ExitProcess,'ExitProcess' | |
import user32,\ | |
MessageBox,'MessageBoxA' |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment