SEH不起作用的问题跟踪

关建词 _except_handler4、_except_handler3、_ValidateEH3RN

问题：

写了一个程序(shell，你懂的)，发现SEH捕捉不到异常，网上搜了一下没找到相关内容，下面的代码是为了写文章简单写的例子代码

__try
{
	_asm int 3;
}
__except(1)
{
    printf("except\r\n");
}

分析：

VS2008里跟踪调试，确实没捕捉到，SEH没源码不好调，祭出OD

载入，定位到代码

012D1040 > $  55            push ebp
012D1041   .  8BEC          mov ebp,esp
012D1043   .  6A FF         push -1
012D1045   .  68 D8D02D01   push 012DD0D8
012D104A   .  68 B49A2D01   push _except_handler3igionObjecterr 'DLo>;  SE 处理程序安装
012D104F   .  64:A1 0000000>mov eax,dword ptr fs:[0]
012D1055   .  50            push eax
012D1056   .  64:8925 00000>mov dword ptr fs:[0],esp
012D105D   .  83EC 08       sub esp,8
012D1060   .  53            push ebx
012D1061   .  56            push esi
012D1062   .  57            push edi
012D1063   .  8965 E8       mov dword ptr ss:[ebp-18],esp
012D1066   .  C745 FC 00000>mov dword ptr ss:[ebp-4],0
012D106D   .  CC            int3
012D106E   .  C745 FC FFFFF>mov dword ptr ss:[ebp-4],-1
012D1075   .  EB 1D         jmp short 012D1094
012D1077   .  B8 01000000   mov eax,1
012D107C   .  C3            retn
012D107D   .  8B65 E8       mov esp,dword ptr ss:[ebp-18]
012D1080   .  68 2CCB2D01   push 012DCB2C                            ;  ASCII "except1
"
012D1085   .  E8 B7060000   call printfc_crttProcess4lockonFilterm_L>
012D108A   .  83C4 04       add esp,4
012D108D   .  C745 FC FFFFF>mov dword ptr ss:[ebp-4],-1
012D1094   >  33C0          xor eax,eax
012D1096   .  8B4D F0       mov ecx,dword ptr ss:[ebp-10]
012D1099   .  64:890D 00000>mov dword ptr fs:[0],ecx
012D10A0   .  5F            pop edi
012D10A1   .  5E            pop esi
012D10A2   .  5B            pop ebx
012D10A3   .  8BE5          mov esp,ebp
012D10A5   .  5D            pop ebp
012D10A6   .  C3            retn

可以看到代码一开始就安装了一个SEH异常处理，handler是VC内自带的 _except_handler3

转到_except_handler3(012D9AB4)下个断点，F8单步执行012D106D的 int3时触发了异常，在_except_handler3断了下来

012D9AB4 >/$  55            push ebp                                 ;  结构异常处理程序
012D9AB5  |.  8BEC          mov ebp,esp
012D9AB7  |.  83EC 08       sub esp,8
012D9ABA  |.  53            push ebx
012D9ABB  |.  56            push esi
012D9ABC  |.  57            push edi
012D9ABD  |.  55            push ebp
012D9ABE  |.  FC            cld
012D9ABF  |.  8B5D 0C       mov ebx,dword ptr ss:[ebp+C]
012D9AC2  |.  8B45 08       mov eax,dword ptr ss:[ebp+8]
012D9AC5  |.  F740 04 06000>test dword ptr ds:[eax+4],6
012D9ACC  |.  0F85 C3000000 jnz 012D9B95
012D9AD2  |.  8945 F8       mov dword ptr ss:[ebp-8],eax
012D9AD5  |.  8B45 10       mov eax,dword ptr ss:[ebp+10]
012D9AD8  |.  8945 FC       mov dword ptr ss:[ebp-4],eax
012D9ADB  |.  8D45 F8       lea eax,dword ptr ss:[ebp-8]
012D9ADE  |.  8943 FC       mov dword ptr ds:[ebx-4],eax
012D9AE1  |.  8B73 0C       mov esi,dword ptr ds:[ebx+C]
012D9AE4  |.  8B7B 08       mov edi,dword ptr ds:[ebx+8]
012D9AE7  |.  53            push ebx
012D9AE8  |.  E8 E3010000   call _ValidateEH3RNssAndSpinCountrr 'DLo>
012D9AED  |.  83C4 04       add esp,4
012D9AF0  |.  0BC0          or eax,eax
012D9AF2  |.  0F8E 8F000000 jle 012D9B87
012D9AF8  |>  83FE FF       /cmp esi,-1
012D9AFB  |.  0F84 8D000000 |je 012D9B8E
012D9B01  |.  8D0C76        |lea ecx,dword ptr ds:[esi+esi*2]
012D9B04  |.  8B448F 04     |mov eax,dword ptr ds:[edi+ecx*4+4]
012D9B08  |.  0BC0          |or eax,eax
012D9B0A  |.  74 66         |je short 012D9B72
012D9B0C  |.  56            |push esi
012D9B0D  |.  55            |push ebp
012D9B0E  |.  8D6B 10       |lea ebp,dword ptr ds:[ebx+10]
012D9B11  |.  33DB          |xor ebx,ebx
012D9B13  |.  33C9          |xor ecx,ecx
012D9B15  |.  33D2          |xor edx,edx
012D9B17  |.  33F6          |xor esi,esi
012D9B19  |.  33FF          |xor edi,edi
012D9B1B  |.  FFD0          |call eax
012D9B1D  |.  5D            |pop ebp
012D9B1E  |.  5E            |pop esi
012D9B1F  |.  8B5D 0C       |mov ebx,dword ptr ss:[ebp+C]
012D9B22  |.  0BC0          |or eax,eax
012D9B24  |.  74 4C         |je short 012D9B72
012D9B26  |.  78 58         |js short 012D9B80
012D9B28  |.  6A 01         |push 1
012D9B2A  |.  FF75 08       |push dword ptr ss:[ebp+8]
012D9B