Own GPF handler

Index > Windows > Own GPF handler

Author

Thread

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid 17 Oct 2003, 08:35

how can i install my own GPF handler under Confused

Win(NT/XP). It should handle some of GPFs, and pass others to standard Confused

win GPF handler

17 Oct 2003, 08:35

pelaillo
Missing in inaction

Joined: 19 Jun 2003
Posts: 878
Location: Colombia

pelaillo 17 Oct 2003, 09:48

Jeremy Gordon has written an article that can be useful for you: http://www.jorgon.freeserve.co.uk/Except32.zip

17 Oct 2003, 09:48

roticv

Joined: 19 Jun 2003
Posts: 374
Location: Singapore

roticv 17 Oct 2003, 12:21

push _error_handler
xor eax, eax
push fs:[eax]
mov fs:[eax], esp
...

_error_handler:
..

Correct me if i am wrong. You can use a call to place the push _error_handler.

17 Oct 2003, 12:21

comrade

Joined: 16 Jun 2003
Posts: 1150
Location: Russian Federation

comrade 17 Oct 2003, 13:02

You can also use SetUnhandledExceptionFilter, but you cannot recover from it.

_________________
comrade (comrade64@live.com; http://comrade.ownz.com/)

17 Oct 2003, 13:02

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid 17 Oct 2003, 14:15

roticv: so THAT is value at fs:[0], which is always changed by VC compiled programs. I was wondering what it could be. Is FS segment documented?
And error handler is normal ring3 code with full access to API?

17 Oct 2003, 14:15

scientica
Retired moderator

Joined: 16 Jun 2003
Posts: 689
Location: Linköping, Sweden

scientica 17 Oct 2003, 14:17

Here's an excerpt from Jeremy Gordon's article: http://win32assembly.online.fr/Exceptionhandling.html

Quote:

Type 2 â€“ the "per-thread" exception handler
This type of handler is typically used to guard certain areas of code and is established by altering the value held by the system at FS:[0]. Each thread in your program has a different value for the segment register FS, so this exception handler will be thread specific. It will be called if an exception occurs during the execution of code protected by the handler.

The value in FS is a 16-bit selector which points to the "Thread Information Block", a structure which contains important information about each thread. The very first dword in the Thread Information Block points to a structure which we are going to call an "ERR" structure.

The "ERR" structure is at least 2 dwords as follows:-
1st dword +0 Pointer to next ERR structure
2nd dword +4 Pointer to own exception handler

btw, I think that VC want's it's own error hadnler, possibly it uses exceptions for other purposes than trapping GPFs.

_________________
... a professor saying: "use this proprietary software to learn computer science" is the same as English professor handing you a copy of Shakespeare and saying: "use this book to learn Shakespeare without opening the book itself.
- Bradley Kuhn

17 Oct 2003, 14:17

roticv

Joined: 19 Jun 2003
Posts: 374
Location: Singapore

roticv 17 Oct 2003, 17:14

Most compilers (include some variants of C) make extensive use of seh to recover from GPF.

I think the best documentation on seh is still by Jeremy Gordon. However stuffs on TIB (Thread information Block) is not well documentated as far as i know.

17 Oct 2003, 17:14

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum