#include "stdafx.h"
#include <stdio.h>
#include <windows.h>
#include <winnt.h>

typedef struct _EXCEPTION_REGISTRATION{
    _EXCEPTION_REGISTRATION* ptrb;					                //指向前一个EXCEPTION_REGISTRATION的指针
    PVOID    handler;                                               //当前异常处理回调函数
}EXCEPTION_REGISTRATION,*PEXCEPTION_REGISTRATION;


int SEHTip(PEXCEPTION_RECORD lpExceptionRecord,
			 PEXCEPTION_REGISTRATION lpSEH,
			 PCONTEXT lpContext,
			 LPVOID lpDispatcherContext)
{
	printf("%s,\t异常地址：%08x,\t异常代码：%08x\n","异常触发了",lpExceptionRecord->ExceptionAddress,
		lpExceptionRecord->ExceptionCode);

	lpContext->Eip = (DWORD)lpExceptionRecord->ExceptionAddress + 0x2;			//跳到异常代码+2的位置继续执行
	lpContext->Dr0 = 0;															//清调试寄存器
	lpContext->Dr1 = 0;
	lpContext->Dr2 = 0;
	lpContext->Dr3 = 0;
	lpContext->Dr7 = 0;
	return ExceptionContinueExecution;
}


int main(int argc, char* argv[])
{
	_asm{

		push	fs:[0]
		lea		eax,dword ptr [esp-8]
		xchg	eax,dword ptr fs:[0]
		mov		ebx,offset SEHTip
		push	ebx							//压入异常处理程序
		push	eax							//异常链

		mov		esi,0
		mov		eax,dword ptr [esi]			//触发异常

	}
	_asm{
		add		esp,8						//恢复堆栈
		pop		fs:[0]
	}
	printf("异常处理完毕\n");

	return 0;
}

[课程]Linux pwn 探索篇！