Windows XP下的向量异常处理

作者：Hume/冷雨飘心·发布日期：2002-8-9·

下面是一个例子:
;============================================================
;asm ex,By Hume
;.............
.586
.model flat, stdcall
option casemap :none   ; case sensitive
include c:/hd/hd.h
include c:/hd/mac.h
;~~~~~~~~~~~~~~~~~~~protos
ASSUME  fs:nothing
;~~~~~~~~~~~~~~~~~~~~~~~~~
;;--------------

	.DATA
sztit   db "By Hume,2K2",0

	.DATA?
rd      hK32                    ;Kernel32模块地址
rd      hVec                    ;AddVectoredExceptionHandler函数地址
rd      hRemov                  ;RemoveVectoredExceptionHandler函数地址
rd      hvectorhandler1
rd      hvectorhandler2
;;-----------------------------------------
	.CODE
__Start:
        __msg   begin Testing...

        mov     hK32,$invoke(LoadLibrary,CTEXT("KERNEL32.DLL"))
        JEAXZ   _err_1
        mov     hVec,$invoke(GetProcAddress,eax,CTEXT("AddVectoredExceptionHandler"))
        JEAXZ   _err_2
        mov     hRemov,$invoke(GetProcAddress,hK32,CTEXT("RemoveVectoredExceptionHandler"))
        JEAXZ   _err_2

                ;相当于invoke AddVectoredExceptionHandler,0,offset vEcp1
        sWin32	hVec,0,offset vEcp1     ;First VEH
        mov     hvectorhandler1,eax
        sWin32	hVec,0,offset vEcp2     ;Second....
        mov     hvectorhandler2,eax

        lea     eax,[esp-8]
        xchg    eax,fs:[0]
        push    offset sEh1
        push    eax
                                ;以上是安装VEH回调例程和
                                ;SEh回调例程

        pushfd
        or      dword ptr [esp],100h
        popfd
        nop                     ;Here Exception!->veh1
        nop
     @3:
        mov     esi,CTEXT("Good,Was Solved by VEH No 2")
        JMP     @F

     @1:
        INVOKE	MessageBox,0,CTEXT("Good,Was Solved by VEH No 1"),addr sztit,0
        xor     eax,eax
        mov     eax,[eax]       ;Here!->seh1
        JMP     @1
     @2:
        INVOKE	MessageBox,0,CTEXT("Good,Was Solved by seh No 1"),addr sztit,0
        INT     3               ;VEH2
        JMP     @2


        ;--------------------------------------------
        ; 以下是简单错误处理
        ;--------------------------------------------
_err_1:
        mov     esi,CTEXT("Can't load DLL")
        jmp     @F

_err_2:
        mov     esi,CTEXT("Can't Find function")
        @@:
_xit:
        INVOKE	MessageBox,0,esi,CTEXT("By Hume,2K2"),0

                        ;卸载所有的VEH和SEH处理例程
        pop     fs:[0]
        pop     eax
        sWin32	hRemov,hvectorhandler1
        sWin32	hRemov,hvectorhandler2
	invoke ExitProcess,0

        ;=======================
        Assume  esi:ptr EXCEPTION_RECORD,edi:ptr CONTEXT

vEcp1   proc    USES esi edi ebx pExcetionPointers:DWORD
        mov     eax,pExcetionPointers
        mov     esi,[eax]               ;pEXCEPTION_RECORD
        mov     edi,[eax+4]             ;pCONTEXT

        ;call    dP
        xor     eax,eax
        test    [esi].ExceptionFlags,4+2+1    ;Unwind or serious
        JNE     @NO_HANDLE
        cmp     [esi].ExceptionCode,80000004h ;Single step
        JNE     @NO_HANDLE
        m2m     [edi].regEip,offset @1
        dec     eax             ;mov     eax,EXCEPTION_CONTINUE_EXECUTION

@NO_HANDLE:                     ;mov     eax,EXCEPTION_CONTINUE_SEARCH
        ret
vEcp1   Endp

        ;-----------------------------------------
vEcp2   proc    USES esi edi ebx pExcetionPointers:DWORD
        mov     eax,pExcetionPointers
        mov     esi,[eax]               ;pEXCEPTION_RECORD
        mov     edi,[eax+4]

        ;call    dP
        xor     eax,eax
        test    [esi].ExceptionFlags,4+2+1    ;Unwind or serious
        JNE     @NO_HANDLE
        cmp     [esi].ExceptionCode,80000003h ;STATUS_BREAKPOINT
        JNE     @NO_HANDLE

        m2m     [edi].regEip,offset @3
        dec     eax              ;mov     eax,EXCEPTION_CONTINUE_EXECUTION

@NO_HANDLE:                      ;mov     eax,EXCEPTION_CONTINUE_SEARCH
        ret
vEcp2   Endp

        ;-----------------------------------------

sEh1    proc    USES esi edi ebx pExcept:DWORD,pFrame:DWORD,pContext:DWORD,pDispatch:DWORD
        mov     esi,pExcept
        mov     edi,pContext

        ;call    dP

        xor     eax,eax
        inc     eax
        test    [esi].ExceptionFlags,6+1         ;Unwind & Serious
        jne     @F
        cmp     [esi].ExceptionCode,0C0000005h  ;STATUS_ACCESS_VIOLATION
        jne     @F

        m2m     [edi].regEip,offset @2
        dec     eax
 @@:
        ret
sEh1    endp

       ;Release assume
       Assume  esi:Nothing,edi:Nothing
;-----------------------------------------

        ;FOR    debug purpose,Rubbish,....you can del it!
.data
fmt     db "The Cur EIP IS: %08X   Cur Excpt NUM is: %08X",0dh,0ah
        db "The Ecpt FLAGS VALUE in HEX: %X",0dh,0ah
        db "Common REG DUMP:",0dh,0ah
        db "EAX: %08X       EBX: %08X",0dh,0ah
        db "ECX: %08X       EDX: %08X",0dh,0ah
        db "ESI: %08X       EDI: %08X",0dh,0ah
.code
                ;DUMP   THREAD CONTEXTS Need esi:pt Excpt_Record
                ;edi: pt Context
dP      proc
local   buf[256]:byte
        pushad
        mov     eax,(EXCEPTION_RECORD ptr [esi]).ExceptionFlags
        INVOKE	wsprintf,addr buf,offset fmt,(CONTEXT PTR [edi]).regEip,(dword ptr [esi]),eax,/
                        (CONTEXT PTR [edi]).regEax,(CONTEXT PTR [edi]).regEbx,/
                        (CONTEXT PTR [edi]).regEcx,(CONTEXT PTR [edi]).regEdx,/
                        (CONTEXT PTR [edi]).regEsi,(CONTEXT PTR [edi]).regEdi
        INVOKE	MessageBox,0,addr buf,CTEXT("VEH Detector...debug purpose...Hume"),0
        popad
        ret
dP      endp

END	__Start


;==============================================================
    下面附例子用到的几个宏:
    CTEXT,相信诸位见过多次了,不多说.
    sWin32:相当于push syntax call label
    rd:    数据定义DWORD
    m2m:   相当于push syn1 pop syn2
    JEAXZ  :eax=0,jmp des
    $incoke():inline coding

    详细请下载在我主页上的最新头文件
    revargs     MACRO args:VARARG
        LOCAL   target
        target     TEXTEQU <>
	IFNB
		FOR     arg,
			IFNB
			target     CATSTR ,,target
			ENDIF
		ENDM
		target     SUBSTR target,1,@SizeStr(%target)-1
	ENDIF
	EXITM   target
        ENDM

        sWin32	Macro	label:REQ,args:VARARG		;Which allow no protos discalaiming
        %	FOR	pxx,		;But you need to guarantee the
                   IFNB 				;the syntax yourself
                     push	pxx
                   ENDIF
                ENDM
                call	label
        ENDM

        m2m MACRO M1, M2                          ;mov is too boring!
              push M2
              pop  M1
        ENDM

        $invoke Macro fun:REQ,args:VARARG
        IFNB
           invoke	fun,&args
        ELSE
	   invoke	fun
        ENDIF
        EXITM
        ENDM

        rd	Macro label:REQ,count
	        IFNB
	                label dd &count dup(?)
	        ELSE
	                label	dd ?
	        ENDIF
        EndM

        JEAXZ	MACRO	Destination			;Like JECXZ,for Convinient
                test	eax,eax
                je	Destination
        ENDM


                                                The way OF Hume,2002.7
                                                humewen@21cn.com
                                                humeasm.yeah.net