Log in

View Full Version : tracing via seh

LaBBa
July 13th, 2009, 16:26
Hi all i have looked aroud (google that is) and didn't found a good tut that explain how to trace via SEH for example simple anti debugger hook int 3 how to know where is the catch that the app continue from this place etc..
does any one knows any good tut about this kind of things ?
BanMe
July 13th, 2009, 17:18
y0da's SEHCALL its classic and in masm or tasm..

http://freenet-homepage.de/DaYoda/codesnippets.htm

and hmm have PhUn.. wonder if y0da's still around..

regards BanMe
evaluator
July 14th, 2009, 03:16
LaBBa.. cmon..
SEHandler is called from Kernel32/Ntdll, so you need put BreakPoint.. guess where!?
LaBBa
July 14th, 2009, 07:27
i know i know .. it just sucks tracing the SEH in VC++ 9 it uses the
MSVCR90._except_handler4_common
and i find it hard to trace back to the EH

so i asked here if there is a tut that covers all the SEH thingy..
edit:
i have found this :
http://www.openrce.org/downloads/details/196
hope it will help me ..
LaBBa
July 14th, 2009, 08:22
This is the code of : MSVCR90._except_handler4_common
Code:


785914D0 > 8BFF             MOV EDI,EDI

785914D2   55               PUSH EBP

785914D3   8BEC             MOV EBP,ESP

785914D5   83EC 18          SUB ESP,18

785914D8   8B45 08          MOV EAX,DWORD PTR SS:[EBP+8]

785914DB   53               PUSH EBX

785914DC   8B5D 14          MOV EBX,DWORD PTR SS:[EBP+14]

785914DF   56               PUSH ESI

785914E0   8B73 08          MOV ESI,DWORD PTR DS:[EBX+8]

785914E3   3330             XOR ESI,DWORD PTR DS:[EAX]

785914E5   57               PUSH EDI

785914E6   8B06             MOV EAX,DWORD PTR DS:[ESI]

785914E8   C645 FF 00       MOV BYTE PTR SS:[EBP-1],0

785914EC   C745 F4 01000000 MOV DWORD PTR SS:[EBP-C],1

785914F3   8D7B 10          LEA EDI,DWORD PTR DS:[EBX+10]

785914F6   83F8 FE          CMP EAX,-2

785914F9   74 0B            JE SHORT MSVCR90.78591506

785914FB   8B4E 04          MOV ECX,DWORD PTR DS:[ESI+4]

785914FE   03CF             ADD ECX,EDI

78591500   330C38           XOR ECX,DWORD PTR DS:[EAX+EDI]

78591503   FF55 0C          CALL DWORD PTR SS:[EBP+C]

78591506   8B4E 0C          MOV ECX,DWORD PTR DS:[ESI+C]

78591509   8B56 08          MOV EDX,DWORD PTR DS:[ESI+8]

7859150C   03CF             ADD ECX,EDI

7859150E   330C3A           XOR ECX,DWORD PTR DS:[EDX+EDI]

78591511   FF55 0C          CALL DWORD PTR SS:[EBP+C]

78591514   8B45 10          MOV EAX,DWORD PTR SS:[EBP+10]

78591517   F640 04 66       TEST BYTE PTR DS:[EAX+4],66

7859151B   0F85 12010000    JNZ MSVCR90.78591633

78591521   8D4D E8          LEA ECX,DWORD PTR SS:[EBP-18]

78591524   894B FC          MOV DWORD PTR DS:[EBX-4],ECX

78591527   8B5B 0C          MOV EBX,DWORD PTR DS:[EBX+C]

7859152A   8945 E8          MOV DWORD PTR SS:[EBP-18],EAX

7859152D   8B45 18          MOV EAX,DWORD PTR SS:[EBP+18]

78591530   8945 EC          MOV DWORD PTR SS:[EBP-14],EAX

78591533   83FB FE          CMP EBX,-2

78591536   74 60            JE SHORT MSVCR90.78591598

78591538   EB 06            JMP SHORT MSVCR90.78591540

7859153A   8D9B 00000000    LEA EBX,DWORD PTR DS:[EBX]

78591540   8D145B           LEA EDX,DWORD PTR DS:[EBX+EBX*2]

78591543   8B4C96 14        MOV ECX,DWORD PTR DS:[ESI+EDX*4+14]

78591547   8D4496 10        LEA EAX,DWORD PTR DS:[ESI+EDX*4+10]

7859154B   8945 F0          MOV DWORD PTR SS:[EBP-10],EAX

7859154E   8B00             MOV EAX,DWORD PTR DS:[EAX]

78591550   8945 F8          MOV DWORD PTR SS:[EBP-8],EAX

78591553   85C9             TEST ECX,ECX

78591555   74 14            JE SHORT MSVCR90.7859156B

78591557   8BD7             MOV EDX,EDI

78591559   E8 24E0FFFF      CALL MSVCR90.7858F582

7859155E   C645 FF 01       MOV BYTE PTR SS:[EBP-1],1

78591562   85C0             TEST EAX,EAX

78591564   7C 3C            JL SHORT MSVCR90.785915A2

78591566   7F 43            JG SHORT MSVCR90.785915AB

78591568   8B45 F8          MOV EAX,DWORD PTR SS:[EBP-8]

7859156B   8BD8             MOV EBX,EAX

7859156D   83F8 FE          CMP EAX,-2

78591570  ^75 CE            JNZ SHORT MSVCR90.78591540

78591572   807D FF 00       CMP BYTE PTR SS:[EBP-1],0

78591576   74 20            JE SHORT MSVCR90.78591598

78591578   8B06             MOV EAX,DWORD PTR DS:[ESI]

7859157A   83F8 FE          CMP EAX,-2

7859157D   74 0B            JE SHORT MSVCR90.7859158A

7859157F   8B4E 04          MOV ECX,DWORD PTR DS:[ESI+4]

78591582   03CF             ADD ECX,EDI

78591584   330C38           XOR ECX,DWORD PTR DS:[EAX+EDI]

78591587   FF55 0C          CALL DWORD PTR SS:[EBP+C]

7859158A   8B4E 0C          MOV ECX,DWORD PTR DS:[ESI+C]

7859158D   8B56 08          MOV EDX,DWORD PTR DS:[ESI+8]

78591590   03CF             ADD ECX,EDI

78591592   330C3A           XOR ECX,DWORD PTR DS:[EDX+EDI]

78591595   FF55 0C          CALL DWORD PTR SS:[EBP+C]

78591598   8B45 F4          MOV EAX,DWORD PTR SS:[EBP-C]

7859159B   5F               POP EDI

7859159C   5E               POP ESI

7859159D   5B               POP EBX

7859159E   8BE5             MOV ESP,EBP

785915A0   5D               POP EBP

785915A1   C3               RETN

785915A2   C745 F4 00000000 MOV DWORD PTR SS:[EBP-C],0

785915A9  ^EB CD            JMP SHORT MSVCR90.78591578

785915AB   8B45 10          MOV EAX,DWORD PTR SS:[EBP+10]

785915AE   8138 63736DE0    CMP DWORD PTR DS:[EAX],E06D7363

785915B4   75 29            JNZ SHORT MSVCR90.785915DF

785915B6   833D 841E5278 00 CMP DWORD PTR DS:[78521E84],0

785915BD   74 20            JE SHORT MSVCR90.785915DF

785915BF   68 841E5278      PUSH MSVCR90.78521E84

785915C4   E8 E7570000      CALL MSVCR90.78596DB0

785915C9   83C4 04          ADD ESP,4

785915CC   85C0             TEST EAX,EAX

785915CE   74 0F            JE SHORT MSVCR90.785915DF

785915D0   8B4D 10          MOV ECX,DWORD PTR SS:[EBP+10]

785915D3   6A 01            PUSH 1

785915D5   51               PUSH ECX

785915D6   FF15 841E5278    CALL DWORD PTR DS:[78521E84]             ; MSVCR90.__DestructExceptionObject

785915DC   83C4 08          ADD ESP,8

785915DF   8B4D 14          MOV ECX,DWORD PTR SS:[EBP+14]

785915E2   E8 CBDFFFFF      CALL MSVCR90.7858F5B2

785915E7   8B45 14          MOV EAX,DWORD PTR SS:[EBP+14]

785915EA   3958 0C          CMP DWORD PTR DS:[EAX+C],EBX

785915ED   74 11            JE SHORT MSVCR90.78591600

785915EF   8B55 08          MOV EDX,DWORD PTR SS:[EBP+8]

785915F2   52               PUSH EDX

785915F3   57               PUSH EDI

785915F4   8BD3             MOV EDX,EBX

785915F6   8BC8             MOV ECX,EAX

785915F8   E8 CFDFFFFF      CALL MSVCR90.7858F5CC

785915FD   8B45 14          MOV EAX,DWORD PTR SS:[EBP+14]

78591600   8B4D F8          MOV ECX,DWORD PTR SS:[EBP-8]

78591603   8948 0C          MOV DWORD PTR DS:[EAX+C],ECX

78591606   8B06             MOV EAX,DWORD PTR DS:[ESI]

78591608   83F8 FE          CMP EAX,-2

7859160B   74 0B            JE SHORT MSVCR90.78591618

7859160D   8B4E 04          MOV ECX,DWORD PTR DS:[ESI+4]

78591610   03CF             ADD ECX,EDI

78591612   330C38           XOR ECX,DWORD PTR DS:[EAX+EDI]

78591615   FF55 0C          CALL DWORD PTR SS:[EBP+C]

78591618   8B4E 0C          MOV ECX,DWORD PTR DS:[ESI+C]

7859161B   8B56 08          MOV EDX,DWORD PTR DS:[ESI+8]

7859161E   03CF             ADD ECX,EDI

78591620   330C3A           XOR ECX,DWORD PTR DS:[EDX+EDI]

78591623   FF55 0C          CALL DWORD PTR SS:[EBP+C]

78591626   8B45 F0          MOV EAX,DWORD PTR SS:[EBP-10]

78591629   8B48 08          MOV ECX,DWORD PTR DS:[EAX+8]

7859162C   8BD7             MOV EDX,EDI

7859162E   E8 66DFFFFF      CALL MSVCR90.7858F599

78591633   BA FEFFFFFF      MOV EDX,-2

78591638   3953 0C          CMP DWORD PTR DS:[EBX+C],EDX

7859163B  ^0F84 57FFFFFF    JE MSVCR90.78591598

78591641   8B4D 08          MOV ECX,DWORD PTR SS:[EBP+8]

78591644   51               PUSH ECX

78591645   57               PUSH EDI

78591646   8BCB             MOV ECX,EBX

78591648   E8 7FDFFFFF      CALL MSVCR90.7858F5CC

7859164D  ^E9 26FFFFFF      JMP MSVCR90.78591578


I have just found out that to get to the EH back i need to trace into :
7859162E E8 66DFFFFF CALL MSVCR90.7858F599

Code:


7858F599   8BEA             MOV EBP,EDX

7858F59B   8BF1             MOV ESI,ECX

7858F59D   8BC1             MOV EAX,ECX

7858F59F   6A 01            PUSH 1

7858F5A1   E8 97110000      CALL MSVCR90.7859073D

7858F5A6   33C0             XOR EAX,EAX

7858F5A8   33DB             XOR EBX,EBX

7858F5AA   33C9             XOR ECX,ECX

7858F5AC   33D2             XOR EDX,EDX

7858F5AE   33FF             XOR EDI,EDI

7858F5B0   FFE6             JMP ESI


7858F5B0 FFE6 JMP ESI -> back to our code (EH).

hope this info will help some one in the future...

Regards,
LaBBa
disavowed
July 14th, 2009, 09:09
Quote:
[Originally Posted by BanMe;81730]wonder if y0da's still around..

iirc, he got a job a few years ago to do cd protections for a pretty major company. he's been pretty quiet online ever since.