hi guys,

i'm looking for help in creating a loader with exception (SEH) handler

does anyone have a MASM example of a loader that handles exceptions ??

thanx, JohnDoe1
Posted on 2004-04-06 11:58:50 by JohnDoe1
Posted on 2004-04-06 12:12:10 by f0dder

i want to write a loader for my project i created in VB
need to be able to catch the SEH's from that program

i want to start the process of the vb exe as a sort of debuggee

so i can catch any info on it.. i thought that was called a loader....
Posted on 2004-04-06 12:39:07 by JohnDoe1
SEH's are per-thread, so this would require some work. I also don't quite see the usefulness of this, perhaps you could elaborate a bit more and convince me you're not trying to use this for crax0ring?
Posted on 2004-04-06 12:51:14 by f0dder
well, if i would want to crack a program

i could use a template and then i prolly wouldn't need SEH handling...

i created a program in vb that has an activeX component that load a HOOK dll

to intercept all create processes...

this is because i want to be able to write a license tracking system for use at our office

the program i wrote functions ok, but... i get errors on unhooking the dll

and on returning values to the hooked dll... ( but the program doesn't crash however
just don't get the result i was expecting)

if i was able to have a loader that could catch all seh' exceptions
and write them to a textfile or whatsoever

i could prolly see on what part of the memory the problems occurs and then readjust / rewrite my code...

using the debug function in vb itself didn't help me....

convinced ??
Posted on 2004-04-06 13:11:56 by JohnDoe1
I don't know about a loader, but if we're talking about the code address stored in FS:[0], you can chain into it like this:

push offset myhandler
xor ebx,ebx
db 64h ;FS segment override prefix
push [ebx] ;push dword ptr FS:[0] without arousing suspicion
db 64h
mov [ebx],esp

You'll want to restore FS:[0] later, I think. MASM doesn't seem to like us playing with FS.
Posted on 2004-10-31 03:21:22 by LarryH

assume fs:nothing
Posted on 2004-10-31 05:25:46 by roticv