Mastering Reverse Engineering

Passing code execution via SEH

One of the most popular anti-debugging tricks is to use SEH to pass code execution. It is popular trick used in Windows computer viruses.  But before we discuss how this trick is used for anti-debugging, let us discuss how SEH works a little.

Exceptions are usually triggered from errors, such as reading bytes from inaccessible memory regions, or by something as simple as division by zero. They can also be triggered by debugger interrupts, INT 3 and INT 1. When an exception occurs, the system jumps right to the exception handler. Normally, the exception handler's job is to do something about the error.

Usually, this job gives an error message notification, leading to a graceful termination of the program. In ...