How to Defeat SEH Anti-Debugging

-

There are much better articles that describe what Structured Exception Handling(SEH) is and honestly, I'm still trying to wrap my head around it so don't take what I write as gospel. If you have a better understanding and I get something wrong, please correct me. I really want to understand this. With that being said, I couldn't find an easy way to circumvent/defeat it so this is what I came up with.

Structured Exception Handling is a Windows mechanism to allow programs to handle exceptions/interrupts. This is accomplished by adding handlers to a linked list of exception handlers. This linked list is stored in the Thread Environment Block(TEB) structure. It can be referenced by fs:[0] on x86 binaries or gs:[0] on x64 binaries.

 The TIB struct:

 
Note that TEB is just an extended TIB structure. The EXCEPTION_REGISTRATION_RECORD struct:

 

These two structures were talked about ad nauseam when I was doing my research but I couldn't get it to function how other articles wrote about it. Instead, I was running into the undocumented exception handling used by the Microsoft C runtime library. 

Before we proceed further, this is the code we will be analyzing:

 
The code should hopefully be self-explanatory. Inside of the try block, I'm de-referencing an invalid pointer which will lead to an exception being thrown. If you execute this outside of a debugger, you will see, "Execute real logic" but if you execute it inside of a debugger, you will get an exception access violation.

 
So this here is what I was looking to solve when I originally began to research. I wanted to know how to get my debugger to execute the exception handler. Sure you could just nop out code indiscriminately but what if you nopped out too much or too little? I wanted to know for sure that the code I was executing was the code that should be getting executed. Again, if you know of a better way, please reach out. But what I realized was that before pushing __except_handler4, a structure was being pushed onto the stack. 

 
If you look at the 7th element(28 bytes in), you have the address for the finally block. After you encounter the exception, you can modify EIP and point it to this address. You'll then be able to continue the intended execution flow. Two instructions down from where the error is throw you see a call to this address. After the call the stack is cleaned up. If you try and return back to main after the normal logic path is taken, you will get another error. Just modify EIP to jump to the clean up and done. 

Comments

Post a Comment

Popular posts from this blog

Crackme: antilagvip's medium crackme

-
Image
Download here: https://crackmes.one/crackme/68e6377b2d267f28f69b7447 MD5: 406af7cd43808f1de221d36d8c7d12d6 SHA1:  736c3fee49a93c60731a2f137545b75311646f9f SHA256: 588211672f26f28731da0d30f2691f23542ea7a825f553a5edc9087dbf52b86e This is listed as a C/C++ x64 executable with a difficulty rating of 3.0. The author is antilagvip and the executable is written for Windows.   The authors description: the right key get the code.. sounds simple right?   This was a fun challenge. I went through the motions. I loaded this in Detect it Easy. It isn't packed. It's a console application. Strings aren't encoded/encrypted. I also loaded it into PE Bear and just looked around. Nothing interesting jumped out at me.   I've talked about how to find the main function in previous posts so I'm just going jump in and say that it is located at 0x140001180. Pretty basic stuff, it prompts you for a key and waits for input. It calls a function that validates whether your key is valid and ...
Read more

Crackme: git's simple crackme medium-hard

-
Image
Download here: https://crackmes.one/crackme/68e2b4652d267f28f69b738e MD5: 49c66031be227cc5982daadfd7368e9d SHA1: 0f01dfd5c1775dd7b605c992903d67bbafa3051f SHA256: 67b06c9c003f0c26c319d82b1fc6436207eaf0e3ed31f438312be8349225272f This is listed as a C/C++ x64 executable with a difficulty rating of 2.5. The author is git and the executable is written for Windows. The authors description: medium-hard crackme with antidebug checks obfuscated strings and key With this crack me, I'm going to take a bit of a different approach. I'm not going to use a decompiler. Taking a look at the strings, I can see some base64 encoded strings. Other than that, Detect it Easy believes this was compiled using Visual Studio 2022 as a console application. It does not appear to be packed. IDA shows us a long series of various debugger checks. At this point, I will manually step through the code and navigate the executable to the good boy. The base64 decode function takes the encoded string and a buffer a...
Read more

Crackme: atherusti's First C program

-
Image
Download here: https://crackmes.one/crackme/68c96889224c0ec5dcedc063 MD5: fdb187c953ae9e0e98e18b1fc0683ef1 SHA1: e1f4f4a1e0629ba38cfa567c45cbee6092aabf0a SHA256: 03832f7e8e8fdfd6ee87ef4efb3eab52252edbfe246c9d2bfdd39166a27c9e30 This is listed as a C/C++ x64 executable with a difficulty rating of 2.0. The author is atherusti and the executable is written for Windows. The authors description: never coded before making this crackme, get the password That's a really interesting first programming project but I'm all for it. Let's tear this bad boy apart and see how they did. The first thing that immediately jumps out to me is seeing that it is actually an x86 executable. No big deal but its something to keep in mind. Our calling conventions are going to change. I also don't expect to see a shadow stack. One final note, this is a console application. Taking a look at the string entries doesn't really reveal anything. I find that a little strange. They must be encoded/encry...
Read more