1. Baidu Encyclopedia

Set exception capture function

When the exception is not handled, the system will call setunhandledexception filter exception handling Function

For example, when some programs make mistakes, they will report to the user that the program makes mistakes. For example, QQ

Part of exception handling

When an exception occurs, such as memory access violation, the CPU hardware will find this problem and generate an exception (you can understand it as an interrupt)

The CPU then switches the code flow to the exception handling service routine. The operating system exception handling service routine will check whether the current process is in debugging state

If yes, notify the debugger that an exception has occurred. If not, the operating system will view the current thread Is the exception frame chain (FS[0]) installed? If so SEH (try... Catch...), call SEH and decide whether to expand globally or locally according to the returned result. If all sehs in the exception chain do not handle this exception and the process is still in debugging state, the operating system will notify the debugger of an exception again (secondary exception). If it has not been processed, the default of the operating system is called exception handling The code is unhandledexception handler, but the operating system allows you to Hook this function through SetUnhandledException Filter function To set. Most exceptions can be caught in this way, but Stack overflow . the overwritten may not be captured.

Most protective shells use exception handling technology to jump out of the normal code instruction flow to confuse Cracker.

2. Online article reference:

Use setunhandledexception filter under window to capture the crash of the program_ bingqingsuimeng's column - CSDN blog_ setunhandledexceptionfilter

Simply use the setunhandledexception filter () function to crash the program gracefully

Although it is a product of a large company, QQ will still collapse under our toss, but it always crashes gracefully and ends with its own dialog box. And send the report, removing the system default send report dialog box.

So I patted my head to make my program crash more decent.

After thinking about the general idea, I think I can use a process to monitor the target program. Indeed, you can get the information about the crash of the target program, know when it crashed, and do additional operations, but there is no way to remove the default send error dialog box.

Then someone said whether they had used a method similar to a hook to check out where this thing was.

Finally, I checked the Internet and found that the function setunhandledexception filter solved everything.

After summarizing the data found in the following, there are three return values of this function:

EXCEPTION_EXECUTE_HANDLER   equ   one   It means that I have handled the exception and can end gracefully   
EXCEPTION_CONTINUE_SEARCH   equ   0   It means that I don't handle it, and others come, so windows calls the default handler, displays an error box, and ends   
EXCEPTION_CONTINUE_EXECUTION   equ  - one   Indicates that the error has been fixed. Please continue from the place where the exception occurred  

The specific application methods are as follows:

#include   <windows.h>   
    
  long   __stdcall   callback(_EXCEPTION_POINTERS*   excp)   
  {   
  MessageBox(0,"Error","error",MB_OK);   
  printf("Error   address   %x/n",excp->ExceptionRecord->ExceptionAddress);   
  printf("CPU   register:/n");   
  printf("eax   %x   ebx   %x   ecx   %x   edx   %x/n",excp->ContextRecord->Eax,   
  excp->ContextRecord->Ebx,excp->ContextRecord->Ecx,   
  excp->ContextRecord->Edx);   
  return   EXCEPTION_EXECUTE_HANDLER;   
  }
    
  int   main(int   argc,char*   argv[])   
  {   
  SetUnhandledExceptionFilter(callback);   
  _asm   int   3   //Just to crash the program
  return   0;   
  }

3. Practical use

Operating environment VS2015 QT5.51   Client program

LONG WINAPI catchExceptionFileter(_EXCEPTION_POINTERS* pExceptionInfo)
{
    //Get the exception information in pExceptionInfo. For details, see_ EXCEPTION_ Points definition
    //Other custom processing (pop-up, report, log, etc.)
}

int main(int argc,char *argv[])
{
    //Program other operations
    //Exception detection acquisition
 LPTOP_LEVEL_EXCEPTION_FILTERpException=SetUnhandledExceptionFilter(catchExceptionFileter);
 _asm   int   3   //Just to crash the program
}