search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.57k stars 5.87k forks source link

Decompile Windows' Structured Exception Handling (SEH) #2477

Open jrmuizel opened 3 years ago

jrmuizel commented 3 years ago

It would be nice if the decompiler could correctly decompile functions that use structured exception handling.

This would involve recognizing exception registration setup code, the scope table, and properly hooking up the control flow.

https://web.archive.org/web/20150318041037/https://www.microsoft.com/msj/0197/exception/exception.aspx has a good overview of how it works.

emteere commented 3 years ago

Good suggestiion. We've had supporting try/catch block scope on the books for a while. The first step was recoverying the SEH information and laying it down so it could be used.

Our plan is to handle sub-function such as exceptions in an upcoming release.

0xThiebaut commented 3 years ago

Just piggy-backing this request to have SEH structures included. This is helpful when reversing exploits setting a malicious handler in the TIB.

famouzkk commented 1 year ago

bump

MajsterTynek commented 1 year ago

bump

Wall-AF commented 6 months ago

Good suggestion. We've had supporting try/catch block scope on the books for a while. The first step was recoverying the SEH information and laying it down so it could be used.

Our plan is to handle sub-function such as exceptions in an upcoming release.

@emteere is this still work-in-progress?

Wall-AF commented 6 months ago

Another reference is https://www.openrce.org/articles/full_view/21.