A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about user-mode development.
 #20073  by dash
 Fri Jul 12, 2013 6:23 pm
Hello.
I'm doing process injection into remote process thread (using WriteProcessMemory with reallocations and CreateRemoteThread) and without using CRT (C-runtime). I'd like to use exceptions in my remote thread, but since I'm not using CRT I must use SEH exceptions. They work correctly without CRT in original process, but when I inject function into remote thread, the program crash when exception is thrown -- __except will not properly catch the exception.

How can I make SEH exceptions work in remote thread? I'm using the same entry point in original process and also in injected process, so the __SEH_prolog is executed in both threads. I'm compiling with /EHa option.

Thank you.
 #20102  by dash
 Sat Jul 13, 2013 8:33 pm
Based on this link, I've successfully installed own _exception_handler, however this implementations does not call the __except block -- it just skip it and continue to _resume_at_safe_place. How can I implement _exception_handler that will correctly work with __except and __finally blocks?

Thank you.