DWORD  scratch;

EXCEPTION_DISPOSITION
__cdecl
_except_handler(
struct _EXCEPTION_RECORD *ExceptionRecord,
	void * EstablisherFrame,
struct _CONTEXT *ContextRecord,
	void * DispatcherContext )
{
	unsigned i;

	// Indicate that we made it to our exception handler
	DbgPrint( "Hello from an exception handler\n" );

	// Change EAX in the context record so that it points to someplace
	// where we can successfully write
	ContextRecord->Eax = (DWORD)&scratch;

	// Tell the OS to restart the faulting instruction
	return ExceptionContinueExecution;
}

void TestException()
{

	DWORD handler = (DWORD)_except_handler; 
	__asm
	{ 
		// 创建 EXCEPTION_REGISTRATION 结构：
		push handler 	// handler函数的地址
		push FS:[0] 	// 前一个handler函数的地址
		mov FS:[0],ESP 	// 装入新的EXECEPTION_REGISTRATION结构
	} 

	__asm
	{
		mov eax,0     	// EAX清零
		mov [eax], 1 	// 写EAX指向的内存从而故意引发一个错误
	} 

	DbgPrint( "After writing!\n" ); 
	__asm
	{ 
		// 移去我们的 EXECEPTION_REGISTRATION 结构记录
		mov eax,[ESP]    	// 获取前一个结构
		mov FS:[0], EAX 	// 装入前一个结构
		add esp, 8       	// 将 EXECEPTION_REGISTRATION 弹出堆栈
	} 

}

[培训]科锐逆向工程师培训第53期2025年7月8日开班！