Mastering Reverse Engineering

A typical SEH setup

Based on what we've learned, let's make use of a regular flow of code, then use SEH as an anti-debugging trick. The following code will be our original code:

push eaxmov eax, 0x12345678mov ebx, 0x87654321and eax, ebxpop eax

After placing the SEH anti-debugging trick, the code would look something like this:

    mov eax, dword ptr FS:[0]    push 0x00401000    push eax    mov dword ptr FS:[0], esp    mov al, [0]RDTSC (with CPUID to force a VM Exit)VMM instructions i.e. VMCALLVMEXIT0x00401000:    push eax    mov eax, 0x12345678    mov ebx, 0x87654321    and eax, ebx    pop eax

What we did here was to manually set up the SEH. Fortunately, Windows has a feature that can also set up exception handlers called Vectored Exception Handler. The API that registers ...