;;----------------------------------------- .CODE SehHandler proc C uses ebx esi edi pExcept,pFrame ,pContext,pDispatch Assume esi:ptr EXCEPTION_RECORD Assume edi:ptr CONTEXT mov esi,pExcept mov MACRO ExceptType,Exit2SearchAddr Assume esi:ptr EXCEPTION_RECORD Assume edi:ptr CONTEXT mov esi,[pExcept ---------------------------------------- .CODE ;除0错异常处理函数 Div_handler0 proc C uses ebx esi edi pExcept Handler unwinds") jmp @ContiSearch Wri_handler1 endp ;断点中断异常处理函数 Int3_handler2 proc C pExcept
pexcept(https://github.com/pexpect/pexpect)号称自己: ?
.code singlestepHandler proc c pExcept,pFrame,pContext,pDispath pushad assume esi:ptr EXCEPTION_RECORD ,edi:ptr CONTEXT mov esi,[pExcept] mov edi,[pContext] cmp [esi].ExceptionCode,STATUS_SINGLE_STEP
files/polysh-0.4.tar.gz tar -zxvf polysh-0.4.tar.gz cd polysh-0.4 python setup.py install 获取用户输入:pexcept
windows.h" #include "tchar.h" LPVOID g_pOrgFilter = 0; LONG WINAPI ExceptionFilter(PEXCEPTION_POINTERS pExcept LPTOP_LEVEL_EXCEPTION_FILTER)g_pOrgFilter); // 8900 MOV DWORD PTR DS:[EAX], EAX // FFE0 JMP EAX pExcept
进程正常运行时pExcept->ContextRecord->Eip+=4;将发生异常的代码地址加4使得其能够继续运行;进程调试运行时产生无效的内存访问异常,从而无法继续调试。 #include "tchar.h" LPVOID g_pOrgFilter = 0; LONG WINAPI ExceptionFilter(PEXCEPTION_POINTERS pExcept LPTOP_LEVEL_EXCEPTION_FILTER)g_pOrgFilter); // 8900 MOV DWORD PTR DS:[EAX], EAX // FFE0 JMP EAX pExcept