逆向分析NtDLL.dll!RtlUnwind函数

引言：RtlUnwind是Kernel32.dll!_except_handler3中的全局展开函数。

7C957A40 ; int __stdcall RtlUnwind(PVOID TargetFrame, PVOID TargetIp, 7C957A40 PEXCEPTION_RECORD ExceptionRecord, PVOID ReturnValue) 7C957A40 7C957A40 varExceptionRecord= EXCEPTION_RECORD ptr -37Ch 7C957A40 varExcptRecordTemp= EXCEPTION_RECORD ptr -32Ch 7C957A40 varDispatcherContext= dword ptr -2DCh 7C957A40 StackBottom = dword ptr -2D8h 7C957A40 StackTop = dword ptr -2D4h 7C957A40 varContext = CONTEXT ptr -2D0h 7C957A40 varSecurityCookie= dword ptr -4 7C957A40 TargetFrame = dword ptr 8 7C957A40 TargetIp = dword ptr 0Ch 7C957A40 ExceptionRecord = dword ptr 10h 7C957A40 ReturnValue = dword ptr 14h 7C957A40 7C957A40 ; FUNCTION CHUNK AT .text:7C96EAFF SIZE 000000C5 BYTES 7C957A40 7C957A40 mov edi, edi 7C957A42 push ebp 7C957A43 mov ebp, esp 7C957A45 sub esp, 37Ch 7C957A4B mov eax, ___security_cookie; XP SP2固定值:0BB40h 7C957A50 push esi 7C957A51 mov esi, [ebp+ExceptionRecord] 7C957A54 mov [ebp+varSecurityCookie], eax 7C957A57 push edi 7C957A58 lea eax, [ebp+StackTop] 7C957A5E push eax ; StackTop 7C957A5F lea eax, [ebp+StackBottom] 7C957A65 push eax ; StackBottom 7C957A66 call _RtlpGetStackLimits@8 ; 获取当前线程堆栈的界限,分别存放在StackTop、StackBottom 7C957A6B xor edi, edi ; edi清零 7C957A6D cmp esi, edi 7C957A6F jnz short loc_7C957A9C ; if(ExceptionRecord!=NULL) goto loc_7C957A9C 7C957A71 mov eax, [ebp+4] ; 获取RtlUnwind的返回地址 7C957A74 lea esi, [ebp+varExceptionRecord] 7C957A7A mov [ebp+varExceptionRecord.ExceptionCode], 0C0000027h ; STATUS_UNWIND(ntstatus.h) 7C957A84 mov [ebp+varExceptionRecord.ExceptionFlags], edi 7C957A8A mov [ebp+varExceptionRecord.ExceptionRecord], edi 7C957A90 mov [ebp+varExceptionRecord.ExceptionAddress], eax ; RtlUnwind的返回地址 7C957A96 mov [ebp+varExceptionRecord.NumberParameters], edi 7C957A9C 7C957A9C loc_7C957A9C: ; CODE XREF: RtlUnwind(x,x,x,x)+2Fj 7C957A9C cmp [ebp+TargetFrame], edi 7C957A9C ; [loc_7C957A9C ~ loc_7C957AA9)的分析： 7C957A9C ; 7C957A9C ; //设置当前异常SEH帧的ExceptionFlags标识,为全局展开做准备 7C957A9C ; if(TargetFrame==NULL) 7C957A9C ; varExceptionRecord.ExceptionFlags|=EXCEPTION_UNWIND_CONTEXT 7C957A9C ; else 7C957A9C ; varExceptionRecord.ExceptionFlags|=EXCEPTION_UNWINDING(exsup.inc) 7C957A9F jz loc_7C957B77 7C957AA5 or dword ptr [esi+4], 2 ; EXCEPTION_UNWINDING(exsup.inc) 7C957AA9 7C957AA9 loc_7C957AA9: ; CODE XREF: RtlUnwind(x,x,x,x)+13Bj 7C957AA9 push ebx 7C957AAA lea eax, [ebp+varContext] 7C957AB0 push eax 7C957AB1 mov [ebp+varContext.ContextFlags], 10007h 7C957AB1 ; CONTEXT_i486|CONTEXT_CONTROL|CONTEXT_INTEGER|CONTEXT_SEGMENTS(WinNT.h) 7C957ABB call _RtlpCaptureContext@4 7C957ABB ; 填充varContext，注意填充后： 7C957ABB ; varContext->Eip=[ebp+4],即:RtlUnwind的返回地址 7C957ABB ; varContext->Ebp=[ebp+0],即:RtlUnwind调用者的ebp 7C957ABB ; varContext->Esp= ebp+8 ,即:&TargetFrame 7C957AC0 mov eax, [ebp+ReturnValue] 7C957AC3 add [ebp+varContext._Esp], 10h ; _Esp等于没有压栈调用RtlUnwind之前的esp值 7C957ACA mov [ebp+varContext._Eax], eax 7C957AD0 call _RtlpGetRegistrationHead@0 ; 从FS:[0]获取首个SEH异常帧(链表形式) 7C957AD5 mov ebx, eax 7C957AD7 cmp ebx, 0FFFFFFFFh 7C957ADA jz loc_7C96EB9A ; //FS:[0]已不存在任何SEH异常帧!RtlUnwind退出! 7C957ADA ; if(FS:[0]==0xFFFFFFFF) 7C957ADA ; { 7C957ADA ; //TargetFrame还存在的话，抛出异常并退出! 7C957ADA ; if(TargetFrame!=0xFFFFFFFF) 7C957ADA ; return ZwRaiseException(&varExceptionRecord,&varContext,0); 7C957ADA ; 7C957ADA ; //退出! 7C957ADA ; return ZwContinue(&varContext,0); 7C957ADA ; } 7C957AE0 xor edi, edi ; edi=0 7C957AE2 inc edi ; edi=1 7C957AE3 7C957AE3 loc_7C957AE3: ; CODE XREF: RtlUnwind(x,x,x,x)+122j 7C957AE3 cmp ebx, [ebp+TargetFrame] 7C957AE6 jz short loc_7C957B67 ; 判断当前FS:[0]异常帧是否为TargetFrame? 7C957AE8 cmp [ebp+TargetFrame], 0 7C957AEC jz short loc_7C957AF7 7C957AEE cmp [ebp+TargetFrame], ebx 7C957AF1 jb loc_7C96EAFF ; [loc_7C957AE3 ~ loc_7C957AF7)代码分析： 7C957AF1 ; 7C957AF1 ; if(FS:[0]==TargetFrame) 7C957AF1 ; { 7C957AF1 ; ZwContinue(&varContext,0) 7C957AF1 ; } 7C957AF1 ; else if(TargetFrame && TargetFrame < FS:[0]) 7C957AF1 ; { 7C957AF1 ; //如果存在某个异常帧在堆栈上的位置比异常链表的头部还低,说明出了错! 7C957AF1 ; //EXCEPTION_NONCONTINUABLE标识当前进程不能再继续进行，必须终止! 7C957AF1 ; varExcptRecordTemp.Numbe