flat assembler
Message board for the users of flat assembler.

Index > Windows > How does try/catch works at assembly level?

Author
Thread Post new topic Reply to topic
Teehee



Joined: 05 Aug 2009
Posts: 570
Location: Brazil
Teehee 21 Jul 2010, 11:39
Code:
try
{
}
catch (Exception)
{
}    

_________________
Sorry if bad english.
Post 21 Jul 2010, 11:39
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20416
Location: In your JS exploiting you and your system
revolution 21 Jul 2010, 11:44
Here is my old try/catch/finally macro.
Code:
struct SEH
    PrevLink        dd      ?       ;the address of the previous seh structure
  CurrentHandler  dd      ?       ;the address of the exception handler
       SafeOffset      dd      ?       ;The offset where it's safe to continue execution
  PrevEsp         dd      ?       ;the old value in esp
       PrevEbp         dd      ?       ;The old value in ebp
ends

macro try handler {
       local   .catch,catch_list,.finally
  try@catch_list equ catch_list
       try@.finally equ .finally
   try@.catch equ .catch
       pushd   ebp
 pushd   esp
 pushd   .catch
      pushd   handler
     pushd   [fs:0]
  mov     [fs:0],esp
      mov     [esp+SEH.PrevEsp],esp
        catch_list equ
    macro catch exception \{
       \local .address
      match ,catch_list\\{
       jmp     .finally
      \\}
      match any,exception \\{
        catch_list equ catch_list, exception .address
       .address:
      \\}
      match ,exception \\{
      .catch:
 match catchlist,catch_list\\\{irp except_addr,catchlist\\\\{match except _addr,except_addr\\\\\{
 cmp     eax,except
  jz      _addr \\\\\} \\\\} \\\}
  catch_list equ
      \\}
    \}
}
try@catch_list equ
try@.finally equ
try@.catch equ
macro finally {
    local here
      match ,try@.catch\{
       display 'Finally without try',13,10
       halt
      \}
      if ~ defined try@.catch | defined here
      match any,try@.catch\{
        try@.catch:
     here=1
      \}
      end if
      match clst,try@catch_list\{match any,clst\\{
 display 'Pending catches not cleared with "catch"',13,10
        halt
      \\} \}
      match any,try@.finally\{
   try@.finally:
      \}
 mov     esp,[fs:0]
      popd    [fs:0]
  add     esp,16
      purge catch
 restore try@.catch,try@catch_list,try@.finally
}    


edit: I forgot to include a generic handler:
Code:
generic_handler:
    ;edx=exception address
    ;eax=exception code
      virtual at esp+4
  .pExcept        dd      ?
   .pFrame         dd      ?
   .pContext       dd      ?
   .pDispatch      dd      ?
      end virtual
      mov     ecx,[.pFrame]
       mov     eax,[.pContext]
     sub     eax,-80h
    mov     edx,[eax+CONTEXT.Eip-080h]
  mov     [eax+CONTEXT.Edx-080h],edx
  mov     edx,[ecx+SEH.SafeOffset]
    mov     [eax+CONTEXT.Eip-080h],edx
  mov     edx,[ecx+SEH.PrevEsp]
       mov     [eax+CONTEXT.Esp-080h],edx
  mov     edx,[ecx+SEH.PrevEbp]
       mov     [eax+CONTEXT.Ebp-080h],edx
  mov     edx,[.pExcept]
      mov     edx,[edx+EXCEPTION_RECORD.ExceptionCode]
    mov     [eax+CONTEXT.Eax-080h],edx
  xor     eax,eax
     ret     16    


Last edited by revolution on 21 Jul 2010, 11:48; edited 1 time in total
Post 21 Jul 2010, 11:44
View user's profile Send private message Visit poster's website Reply with quote
Teehee



Joined: 05 Aug 2009
Posts: 570
Location: Brazil
Teehee 21 Jul 2010, 11:47
wow, thats so big.. but i can't understand macros yet. Sad
Post 21 Jul 2010, 11:47
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20416
Location: In your JS exploiting you and your system
revolution 21 Jul 2010, 13:29
It is probably easier just to make your code correct and never generate exceptions.

Try/catch is the only way I know of to use into in a Windows proggy. But who ever used it anyway even in the DOS days when you could?
Post 21 Jul 2010, 13:29
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20416
Location: In your JS exploiting you and your system
revolution 21 Jul 2010, 13:32
BTW: did you know that the WM_TIMER callback is run under the API try/catch block? This means you can't use int3 to trigger a debugger, it gets swallowed by the handler and your proggy continues to run. Sad
Post 21 Jul 2010, 13:32
View user's profile Send private message Visit poster's website Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid 21 Jul 2010, 14:11
Most often I have seen try/catch implemented in C using setjmp() / longjmp() mechanism.

Basically you just save stack pointer and address where to jump on every "try", stack up these structures, and on exception go back over them until you find appropriate catch for the type of exception that was thrown.

This becomes useful when you have ability to automatically call "destructors" of objects that needs some extra code upon release (like open file handles, allocated memory, etc.). This is not very much possible to do (in sane way) in ASM or C, and so try/catch isn't used so often either.
Post 21 Jul 2010, 14:11
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20416
Location: In your JS exploiting you and your system
revolution 21 Jul 2010, 15:21
vid wrote:
Most often I have seen try/catch implemented in C using setjmp() / longjmp() mechanism.
Does that use the SEH mechanism? Or is it just an internal C error check and jump?
Post 21 Jul 2010, 15:21
View user's profile Send private message Visit poster's website Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid 21 Jul 2010, 15:52
Depends on implementation Wink

Supposing we are speaking of Windows, I never checked. However, I saw it used somewhere in HAL.DLL, and I am not really so sure SEH can be used there. In userland, my guess would be SEH is used.
Post 21 Jul 2010, 15:52
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
b1528932



Joined: 21 May 2010
Posts: 287
b1528932 21 Jul 2010, 23:16
in userland, exceptions will NEVER occur. And if they do there is nbothing u can do about them, just kill the app.
In kernel mode however, its diffrent story.

Windows provide SEH. structure at address 0 holds NT_TIB, and NT_TIB holds exception records. each one is called by exception handler (well not exactly, exception handler return control to userland first, then userland function calls them). If they return something - next is invoked, if theyt return something else - execution is halted.

you have to change ip/registers manually to fix the exception issue.
Post 21 Jul 2010, 23:16
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20416
Location: In your JS exploiting you and your system
revolution 22 Jul 2010, 00:03
b1528932 wrote:
in userland, exceptions will NEVER occur.
Are you sure? "cli" will cause an exception.
b1528932 wrote:
And if they do there is nbothing u can do about them, just kill the app.
Nothing? But you can use SEH to catch it and recover if wanted.
Post 22 Jul 2010, 00:03
View user's profile Send private message Visit poster's website Reply with quote
baldr



Joined: 19 Mar 2008
Posts: 1651
baldr 25 Aug 2010, 09:20
Teehee,

There are try/catch and __try/__catch. They are different. Matt Pietrek described them in MSJ June 1997 "Under the hood" column; OpenRCE contains fine article about MSVC implementation details.
Post 25 Aug 2010, 09:20
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2024, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.