0

My current understanding of SEH in windows is that when an exception occurs the OS uses the FS:[0] register which contains the address of a _EXCEPTION_RECORD linked list which in turn has a plethora of functions that might or might not handle the exception. My question is, what does _except_handler3 have to do with all of this?

Trey
  • 474
  • 2
  • 9
  • 32
  • 2
    It is the C++ runtime function that implements the exception filter, it detects a C++ exception. Specific to the Microsoft CRT, it uses the SEH plumbing to implement C++ exception handling. – Hans Passant Aug 25 '18 at 18:26
  • 1
    *fs:[0]* is only for *x86*. and it containing pointer to `EXCEPTION_REGISTRATION_RECORD` (look in *winnt.h*) but not `EXCEPTION_RECORD`. the `_except_handler3` is have `PEXCEPTION_ROUTINE` type – RbMm Aug 25 '18 at 19:01
  • 3
    [A Crash Course on the Depths of Win32™ Structured Exception Handling](http://bytepointer.com/resources/pietrek_crash_course_depths_of_win32_seh.htm). Doesn't have information on x64 code, but you appear to be learning about 32-bit code anyway, so that is a good read. – IInspectable Aug 25 '18 at 23:09

0 Answers0