Isn't that just a different syntax of an Exception Handler Frame?
Code:
struct _EH4_EXCEPTION_REGISTRATION_RECORD {
void* SavedESP;
_EXCEPTION_POINTERS* ExceptionPointers;
_EXCEPTION_REGISTRATION_RECORD* Next;
enum _EXCEPTION_DISPOSITION (*Handler)(_EXCEPTION_RECORD*, void*, _CONTEXT*, void*);
DWORD EncodedScopeTable;
unsigned long TryLevel;
};
That struct is from a useful set of IDC scripts I sometimes use to make sense of that stuff disassembled:
http://www.openrce.org/downloads/details/196/Microsoft_VC++_Reversing_Helpers
Also, here's an MS ppt presentation which discusses the EH Frame.
Recent Evolutions in Compiler-Based Security Mechanisms
http://www.facultyresourcecenter.com/curriculum/pfv.aspx?ID=7361
Expand that and I thought it served the same purpose as CPPEH_RECORD.
Code:
CPPEH_RECORD struc ; (sizeof=0x18, standard type)
old_esp dd ?
exc_ptr dd ? ; offset
prev_er dd ? ; offset
handler dd ? ; offset
msEH_ptr dd ? ; offset
disabled dd ?
CPPEH_RECORD ends
pCPPEH_RECORD TYPEDEF PTR CPPEH_RECORD
