RCE Messageboard's Regroupment > Archived Forums: Read-Only > Forums > Blogs Forum > SEH Graph

---

Log in

View Full Version : SEH Graph

---

Hex Blog

October 5th, 2009, 22:17

It is said ("http://en.wikipedia.org/wiki/A_picture_is_worth_a_thousand_words") that a picture is worth a thousand words, and similarly many reversers would agree that a graph is worth a thousand lists! Recently, we added graphing support into IDAPython and now Python scripts can build interactive graphs.
To demonstrate this new addition, we will write a small script that graphs the structured exception handlers of a given process.

http://hexblog.com/ida_pro/pix/sehgraph_small.png
Writing the script

The steps needed to write the script:

For each thread in the process:

Retrieve the linear address of FS:[0]
Walk the exception registration record list and save the handler

Build the graph:

Allocate one node for each unique exception handler address
Add edges between the last exception handler and the current exception handler (so to create the chain visually)

Display the graph

Walking the exception registration records

In Win32, a new SEH is installed by filling an EXCEPTION_REGISTRATION_RECORD entry and linking it to the SEH chain (at FS:[0]).

Code:

typedef struct _EXCEPTION_REGISTRATION_RECORD

{

  struct _EXCEPTION_REGISTRATION_RECORD *Prev;

  PEXCEPTION_HANDLER       Handler;

} EXCEPTION_REGISTRATION_RECORD;

Before walking the exception registration records, we need to get the base address of the FS selector.
Fortunately, each debugger module provides a special callback in its debugger_t structure:

Code:

// Get information about the base of a segment register

//   tid        - thread id

//   sreg_value - value of the segment register

//   answer     - pointer to the answer. can't be NULL.

// 1-ok, 0-failed, -1-network error

int (idaapi *thread_get_sreg_base)(

  thid_t tid, 

  int sreg_value, 

  ea_t *answer);

Code:

def GetFsBase(tid):

    idc.SelectThread(tid)

    return idaapi.dbg_get_thread_sreg_base(tid, cpu.fs)

Code:

ea_t fs_base;

dbg->thread_get_sreg_base(tid, fs_sel_value, &fs_base);

Code:

def GetExceptionChain(tid):

    fs_base = GetFsBase(tid)

    exc_rr = Dword(fs_base)

    result = []

    while exc_rr != 0xffffffff:

        prev    = Dword(exc_rr)

        handler = Dword(exc_rr + 4)

        exc_rr  = prev

        result.append(handler)

    return result

Code:

    # Iterate through all function instructions and take only call instructions

    result = {}

    for tid in idautils.Threads():

        result[tid] = GetExceptionChain(tid)

Code:

def OnRefresh(self):

  self.Clear() # clear previous nodes

  addr_id = {}



  for (tid, chain) in self.result.items():

    # Add the thread node

    id_parent = self.AddNode("Thread %X" % tid)



    # Add each handler

    for handler in chain:

      # Get the node id given the handler address

      # We use an addr -> id dictionary 

      # so that similar addresses get similar node id

      if not addr_id.has_key(handler):

        id = self.AddNode( hex(handler) )

        addr_id[handler] = id # add this ID

      else:

        id = addr_id[handler]



      # Link handlers to each other

      self.AddEdge(id_parent, id)

      # Now the parent node is this handler

      id_parent = id



  return True

Externalist

October 6th, 2009, 10:40

hawt stuff

evlncrn8

October 27th, 2009, 13:53

you could also process the LOAD_CONFIG directory in the pe file, as if it is compiled with /safeseh you could also obtain a nice list of seh addresses by processing it