I have studied Frame-based Exception Handling which ended with the attached code of a simple exception handling.

As I understand an exception causes kernel32 to act and
1. seaches for an exception handler.
2 If no handler is found, kernel seaches for a debugger.
3.If no debugger is present, kernel terminate the process.

Kernel provides the ExceptionHandler process with pointers to EXCEPTION_RECORD structure, CONTEXT structure and StackFrame. This part I am very uncertain about. I have not found anything in MSDN or elsewhere about the handler process. Is it a callback process? Where can I lern more about it?

The ExceptionHandler process can be coded to do whatever you want. In my example I have choosen to show exception code and address of access-violation in a messagebox.

This is tested only on Win2k.

Best regards
Posted on 2003-08-26 14:29:08 by minor28
it works just fine in WinXP, nice work minor28.
Posted on 2003-08-26 14:48:11 by mistronr1
Works in Win98SE...
Posted on 2003-08-26 17:46:04 by NaN
Works in my Win98SE, too. In "ExceptionHandler proc" you have forgotten to return eax and ecx, you need to add this:
assume eax:nothing
assume ecx:nothing

otherwise the compiler will show you errors if you add code after that proc.
Posted on 2003-08-28 02:12:52 by Ultrano
A very good article about win32 SEH is

"A Crash Course on the Depths of Win32 Structured Exception Handling" by Matt Pietrek

in MSDN periodicals (MSJ 01/1997)

It requires some C knowlegde
Posted on 2003-08-28 06:48:37 by japheth
There also my article on using structured exception handling in assembler, sample code and test executable viewable on-line and downloadable from here
Posted on 2003-09-06 06:14:52 by jorgon

I will take a closer look at the two articales.

Best regards
Posted on 2003-09-07 11:58:06 by minor28