exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Reverse Engineering SEHOP Chain Validation

Reverse Engineering SEHOP Chain Validation
Posted Jan 11, 2012
Authored by x90c

This proof of concept reverse engineering code demonstrates SEHOP chain validation.

tags | exploit, proof of concept
SHA-256 | e333c142682d7f51d57c80a04d7397a465c342670021b893a2ad3c2f1ef6da5b

Reverse Engineering SEHOP Chain Validation

Change Mirror Download
Reverse Engineering code of SEHOP Chain Validation 
by x90c (geinblues@gmail.com)


--[ sehop_chain_validation.c ]--

typedef struct _EXCEPTION_REGISTRATION_RECORD
{
struct _EXCEPTION_REGISTRATION_RECORD *Next;
PEXCEPTION_ROUTINE Handler;
} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;

/* first E_R struct of ebx[E_R->Next] to search */
register _EXCEPTION_REGISTRATION_RECORD *E_R = first_E_R_struct;

SEHOP_CHAIN_VALIDATION:
{
/* E_R and E_R->scopetable(E_R+8) isn't in the stack area? */
if(E_R < stack_bottom || E_R->scopetable > stack_top)
SEHOP_validation_error();

/* E_R struct isn't 4-byte alignment ? */
if(!(E_R & 0x3))
SEHOP_validation_error();

/*
* E_R->Handler isn't in the stack area(0x12c000 ~ 0x130000)?
* If stack ASLR then the address range will be changed.
*/
if(E_R->Handler < stack_bottom || E_R->Handler > stack_top))
SEHOP_validation_error();
else
E_R->Handler();

E_R = E_R->Next; /* Move to next chain record */

/*
* Next is the symbolic record(last chain record)?
* The symbolic record(last chain record) can be final exception registration record
* for ntdll!FinalExceptionHandler.
*/
if(E_R != 0xFFFFFFFF)
goto SEHOP_CHAIN_VALIDATION;
}
-- [ eoc ] --


Disassemble In Win Vista UltimateK sp1 running on VMware.
76e40d9c 8b1b mov ebx,dword ptr [ebx] ; ebx = E_R->Next
76e40d6d 3b5df8 cmp ebx,dword ptr [ebp-8] ; <-- (1) ebx = E_R struct < 12c000 ?
76e40d70 0f829ad1feff jb ntdll!RtlDispatchException+0x19d (76e2df10)
76e40d76 8d4308 lea eax,[ebx+8] ; eax = E_R+8 (scopetable)
76e40d79 3b45f4 cmp eax,dword ptr [ebp-0Ch]
76e40d7c 0f878ed1feff ja ntdll!RtlDispatchException+0x19d (76e2df10) ; 12e5dc > [12db00] ( 130000 )
76e40d82 f6c303 test bl,3 ; bl & 3 ( Not 4-byte alignment ? )
76e40d85 0f8585d1feff jne ntdll!RtlDispatchException+0x19d (76e2df10) ; not 4-byte alignment?
76e40d8b 8b4304 mov eax,dword ptr [ebx+4] ; eax = [E_R+4] (_exception_handler)
76e40d8e 3b45f8 cmp eax,dword ptr [ebp-8]
76e40d91 7209 jb ntdll!RtlDispatchException+0x96 (76e40d9c) ; exception handler < 0012c000 ?
76e40d93 3b45f4 cmp eax,dword ptr [ebp-0Ch]
76e40d96 0f8274d1feff jb ntdll!RtlDispatchException+0x19d (76e2df10) ; exception handler < 00130000 ?
76e40d9e 3bdf cmp ebx,edi
76e40da0 75cb jne ntdll!RtlDispatchException+0x67 (76e40d6d) ; ebx != FFFFFFFFh ?



Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close