[Note: Make sure your compiler is configured with debug mode. Otherwise, you will not get the right result described as below, in that some optimizations emitted by VC++ compiler in release mode. Shutdown Enable Incremental Linking switch, which will make a table list for the function called. It will set the address of the entry in this table instead of the real address.]
1. Try to define a simple function as following, with empty execute body definition:
void bar() { }
Press F5 and step into the function body, disassembly it and try to fetch the accordant asm code.
00411950 push ebp // Save current frame pointer on stack.
00411951 mov ebp,esp //Activate the new frame for callee.
00411953 sub esp,0C0h // 0C0h (192) Set ESP at the end of the frame.
00411959 push ebx
0041195A push esi
0041195B push edi // The above three assembly code is used to save current register.
0041195C lea edi,[ebp-0C0h] // edi is now pointing to the end of the stack frame.
00411962 mov ecx,30h // 30h = 0C0h/4, ‘rep stos’ will be executed 48 times.
00411967 mov eax,0CCCCCCCCh // Set parameter of ‘rep stos’ instrument.
0041196C rep stos dword ptr es:[edi] // Use the value of eax (0CCCCCCCCh) to initialize stack.
0041196E pop edi
0041196F pop esi
00411970 pop ebx // The above three assembly code is used to restore the register.
00411971 mov esp,ebp
00411973 pop ebp // Activate caller’s stack frame.
00411974 ret // Return to the caller.
2. Try to define a simple function as following, with a try/catch block in its execute body:
void foo(){
try { }
catch ( … ) { }
}
00411890 push ebp
00411891 mov ebp,esp // Activate the new frame for callee.
00411893 push 0FFFFFFFFh // id, member of EXCEPTION_REGISTRATION.
00411895 push offset __ehhandler$?foo@@YAXXZ (415D60h) // Address of exception handler.
0041189A mov eax,dword ptr fs:[00000000h] // FS:[0] stores the current exception handler.
004118A0 push eax // Save the previous exception handler in the chain.
004118A1 mov dword ptr fs:[0],esp // Register the EXCEPTION_REGISTRATION with OS.
004118A8 push ecx
004118A9 sub esp,0C0h
004118AF push ebx
004118B0 push esi
004118B1 push edi
004118B2 lea edi,[ebp-0D0h]
004118B8 mov ecx,30h
004118BD mov eax,0CCCCCCCCh
004118C2 rep stos dword ptr es:[edi]
004118C4 mov dword ptr [ebp-10h],esp
004118C7 mov dword ptr [ebp-4],0
004118CE jmp __catch$?foo@@YAXXZ$0+0Dh (4118DDh)
004118D0 mov dword ptr [ebp-4],0FFFFFFFFh
004118D7 mov eax,offset $LN2 (4118E4h)
004118DC ret
004118DD mov dword ptr [ebp-4],0FFFFFFFFh
004118E4 mov ecx,dword ptr [ebp-0Ch]
004118E7 mov dword ptr fs:[0],ecx
004118EE pop edi
004118EF pop esi
004118F0 pop ebx
004118F1 mov esp,ebp
004118F3 pop ebp
004118F4 ret
VC++ creates EXCEPTION_REGISTRATION structure for every function as its local variable. Function’s prologue creates this structure on its stack frame and register it with operating system.
What is __ehhandler$?foo@@YAXXZ (415D60h)?
Since it’s not readable, let’s unmangling it with UnDecorateSymbolName API provided by Dbghelp.dll:
?foo@@YAXXZ to void __cdecl foo(void). The dollar ‘$’ here is just used to join __ehhanlder with foo.
So, we can get a conclusion that, __ehhandler$?foo@@YAXXZ is the exception handler generated automatically by VC++ compiler. As the same, you can find a catch handler __catch$?foo@@YAXXZ in the following assembly.
Then you will see what we are already familiar with. Compare it with the following code, you will got it:
_asm {
move EAX, FS : [0]
move prev, EAX }
What is the usage of __ehhandler$?foo@@YAXXZ (415D60h)?
415D60h here is the offset, where __ehhandler$?foo@@YAXXZ is located. Navigate to this address:
00415D60 mov eax,offset ___rtc_tzz+13Ch (418F24h)
00415D65 jmp @ILT+595(___CxxFrameHandler3) (411258h)
Obviously, this function just pass a parameter to another function ___CxxFrameHandler3.
What is ___CxxFrameHandler3?
It just inspects the EXCEPTION_REGISTRATION on the stack to see if there is any catch block in the function interested in catching the current exception. If it does not find any, it returns ExceptionContinueSearch value back to the operating system.
Hope this can help.
Yesterday is HISTORY, Tomorrow is MYSTERY. 