附件:SEH2b.rar
这是一个很基础的基于seh的程序（利用T标志产生单步异常），但trw无法正常调试（各位试试看）。由于原作者放弃升级，希望各位高手能在百忙之中进行改进，使国之瑰宝继续发扬光大。
:00401000 6851104000 push 00401051
:00401005 64FF3500000000 push dword ptr fs:[00000000]
:0040100C 64892500000000 mov dword ptr fs:[00000000], esp
:00401013 9C pushfd
:00401014 810C2400010000 or dword ptr [esp], 00000100
:0040101B 9D popfd
:0040101C 90 nop 在此之前，只要trw被呼出过，就无法产生异常
:0040101D EB2B jmp 0040104A
:0040101F 90 nop
:00401020 90 nop
:00401021 90 nop
:00401022 90 nop
:00401023 90 nop
:00401024 90 nop
:00401025 90 nop
:00401026 90 nop
:00401027 90 nop
:00401028 90 nop
:00401029 90 nop
:0040102A 90 nop
:0040102B 90 nop
:0040102C 90 nop
:0040102D 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"SEH"
|
:0040102F 6800304000 push 00403000
* Possible StringData Ref from Data Obj ->"Hello,SEH!"
|
:00401034 6804304000 push 00403004
:00401039 6A00 push 00000000
* Reference To: USER32.MessageBoxA, Ord:01BBh
|
:0040103B E844000000 Call 00401084
:00401040 648F0500000000 pop dword ptr fs:[00000000]
:00401047 83C404 add esp, 00000004
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040101D(U)
|
:0040104A 6A00 push 00000000
* Reference To: KERNEL32.ExitProcess, Ord:0075h
|
:0040104C E839000000 Call 0040108A
:00401051 55 push ebp
:00401052 8BEC mov ebp, esp
:00401054 53 push ebx
:00401055 8B4510 mov eax, dword ptr [ebp+10]
:00401058 8D1D2D104000 lea ebx, dword ptr [0040102D]
:0040105E 8998B8000000 mov dword ptr [eax+000000B8], ebx
:00401064 33DB xor ebx, ebx
:00401066 895804 mov dword ptr [eax+04], ebx
:00401069 895808 mov dword ptr [eax+08], ebx
:0040106C 89580C mov dword ptr [eax+0C], ebx
:0040106F 895810 mov dword ptr [eax+10], ebx
:00401072 C7401855010000 mov [eax+18], 00000155
:00401079 B800000000 mov eax, 00000000
:0040107E 5B pop ebx
:0040107F C9 leave
:00401080 C21000 ret 0010
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
