This proof of concept reverse engineering code demonstrates SEHOP chain validation.
e333c142682d7f51d57c80a04d7397a465c342670021b893a2ad3c2f1ef6da5b
Reverse Engineering code of SEHOP Chain Validation
by x90c (geinblues@gmail.com)
--[ sehop_chain_validation.c ]--
typedef struct _EXCEPTION_REGISTRATION_RECORD
{
struct _EXCEPTION_REGISTRATION_RECORD *Next;
PEXCEPTION_ROUTINE Handler;
} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;
/* first E_R struct of ebx[E_R->Next] to search */
register _EXCEPTION_REGISTRATION_RECORD *E_R = first_E_R_struct;
SEHOP_CHAIN_VALIDATION:
{
/* E_R and E_R->scopetable(E_R+8) isn't in the stack area? */
if(E_R < stack_bottom || E_R->scopetable > stack_top)
SEHOP_validation_error();
/* E_R struct isn't 4-byte alignment ? */
if(!(E_R & 0x3))
SEHOP_validation_error();
/*
* E_R->Handler isn't in the stack area(0x12c000 ~ 0x130000)?
* If stack ASLR then the address range will be changed.
*/
if(E_R->Handler < stack_bottom || E_R->Handler > stack_top))
SEHOP_validation_error();
else
E_R->Handler();
E_R = E_R->Next; /* Move to next chain record */
/*
* Next is the symbolic record(last chain record)?
* The symbolic record(last chain record) can be final exception registration record
* for ntdll!FinalExceptionHandler.
*/
if(E_R != 0xFFFFFFFF)
goto SEHOP_CHAIN_VALIDATION;
}
-- [ eoc ] --
Disassemble In Win Vista UltimateK sp1 running on VMware.
76e40d9c 8b1b mov ebx,dword ptr [ebx] ; ebx = E_R->Next
76e40d6d 3b5df8 cmp ebx,dword ptr [ebp-8] ; <-- (1) ebx = E_R struct < 12c000 ?
76e40d70 0f829ad1feff jb ntdll!RtlDispatchException+0x19d (76e2df10)
76e40d76 8d4308 lea eax,[ebx+8] ; eax = E_R+8 (scopetable)
76e40d79 3b45f4 cmp eax,dword ptr [ebp-0Ch]
76e40d7c 0f878ed1feff ja ntdll!RtlDispatchException+0x19d (76e2df10) ; 12e5dc > [12db00] ( 130000 )
76e40d82 f6c303 test bl,3 ; bl & 3 ( Not 4-byte alignment ? )
76e40d85 0f8585d1feff jne ntdll!RtlDispatchException+0x19d (76e2df10) ; not 4-byte alignment?
76e40d8b 8b4304 mov eax,dword ptr [ebx+4] ; eax = [E_R+4] (_exception_handler)
76e40d8e 3b45f8 cmp eax,dword ptr [ebp-8]
76e40d91 7209 jb ntdll!RtlDispatchException+0x96 (76e40d9c) ; exception handler < 0012c000 ?
76e40d93 3b45f4 cmp eax,dword ptr [ebp-0Ch]
76e40d96 0f8274d1feff jb ntdll!RtlDispatchException+0x19d (76e2df10) ; exception handler < 00130000 ?
76e40d9e 3bdf cmp ebx,edi
76e40da0 75cb jne ntdll!RtlDispatchException+0x67 (76e40d6d) ; ebx != FFFFFFFFh ?