Log in

View Full Version : okay, all is fine now, BUT...kernel32!unhandledexceptionfilter


pasha
March 23rd, 2003, 18:31
greetz

okay, i finally figured out what the problem was. i patched driver studio 2.7 as per instructions by splaj and when i patched the "kernel32!unhandledexceptionfilter" i was able to defeat peshield successfully.

now comes the wierd part. i wrote a small program for myself using SEH and that program simply exits midway somewhere in the SEH chain. same thing happens to SD2 exes too.

anyone out there have any ideas on this ?

best regards
pasha

dELTA
March 23rd, 2003, 19:51
You have to return the correct parameters from each exception handler, or otherwise the chain will always break. Did you do this in all your exception handlers? In protection schemes like SD, I'm sure that they can return "the wrong values" on purpose, to break the chain intentionally for some reason.

dELTA

pasha
March 23rd, 2003, 20:05
greetz

well i checked my SEH handler and its absolutely fine. but if what you say is true that protection systems like sd2 can return wrong values and break the chain, then how is it working without softice loaded ?

best regards
pasha