I wrote the following code that can handle c++ exception manually (inside a veh handler):
LONG handler(EXCEPTION_POINTERS* ex) {
if (ex->ExceptionRecord->ExceptionCode == 0xE06D7363) {
const int maxFrames = 62;
void* frames[maxFrames];
USHORT framesCaptured = RtlCaptureStackBackTrace(0, maxFrames, frames, nullptr);
void* handler_data = NULL;
uint64_t establisher_frame = NULL;
CONTEXT context;
RtlCaptureContext(&context);
for (USHORT i = 0; i < framesCaptured; ++i)
{
auto lookup = RtlLookupFunctionEntry((DWORD64)frames[i],&imagebase,NULL);
UNWIND_INFO* ui = (UNWIND_INFO*)(imagebase + lookup->UnwindInfoAddress);
if (ui->Flags& UNW_FLAG_EHANDLER || ui->Flags & UNW_FLAG_UHANDLER) {
auto language_handler = RtlVirtualUnwind(UNW_FLAG_EHANDLER, imagebase, (DWORD64)frames[i], lookup, &context, &handler_data, &establisher_frame, NULL);
DISPATCHER_CONTEXT new_dc = {};
new_dc.ControlPc = (DWORD64)frames[i];
new_dc.ImageBase = imagebase;
new_dc.FunctionEntry = lookup;
new_dc.EstablisherFrame = establisher_frame;
new_dc.TargetIp = reinterpret_cast<uint64_t>(&lookup);
new_dc.ContextRecord = ex->ContextRecord;
new_dc.LanguageHandler = language_handler;
new_dc.HandlerData = handler_data;
auto result = language_handler(ex->ExceptionRecord, reinterpret_cast<void*>(establisher_frame), ex->ContextRecord, &new_dc);
return result;
}
}
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
}
Then I wrote a custom pe loader that can load an exe from memory.The problem is when that exe contains c++ exceptions it breaks, so I added the previous veh handler to that loader and a dynamic function table with RtlAddFunctionTable().BUT here is the problem the RtlLookupFunctionEntry() seems to return invalid RUNTIME_FUNCTION pointers and as a result the RtlVirtualUnwind() cant find the right handler. I did not try to use the RtlInsertInvertedFunctionTable() intenal API (althought it might work), because I don’t want my code to rely on undocumented APIs.Any ideas?
Thank you in advance.
xmr21 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.