Hello RCEs:

Where can I find some "internal" information on the usage of NTDLL!NTContinue function. This is in the context of SEH. I know that somewhere along the SEH line, NTContinue is called. Where exactly is it called, what is its function is what I'm interested in.

I could trace it in SICE but I'm wondering if anybody has already does this work

Any pointers to information would suffice.

Thanks,

Signed,
-- FoxThree

Found this reference on the MSDN website (dated Jan 97) but it may help

http://www.microsoft.com/msj/defaultframe.asp?page=/msj/0197/exception/exception.htm&nav=/msj/0197/newnav.htm

This is the only interesting part:

"The heart of KiUserExceptionDispatcher is its call to RtlDispatchException. This kicks off the search for any registered exception handlers. If a handler handles the exception and continues execution, the call to RtlDispatchException never returns. If RtlDispatchException returns, there are two possible paths: either NtContinue is called, which lets the process continues, or another exception is raised. This time, the exception isn't continuable, and the process must terminate."

You might get lucky on sysinternals perhaps ?

Hi Actlon:

Thanks a lot for your posting. Mmm.. interestingly I'd gone only 1/3rd of the article before posting this question. I'm sure what you've written is from the other 2/3rd I must be getting lazy

Thanks again,

Signed,
-- FoxThree