0:000> db 008d0e30
008d0e30 08 0e 8d 00 48 47 77 77-01 00 00 00 bb af 78 41 ....HGww......xA
~~向后指针 ~~向前指针 ~~有效标志 ~~加密的VEH处理函数入口
注意如果是最前面的VEH,它的向前指针是指向LdrpVectorHandlerList中的.
008d0e40 ab ab ab ab ab ab ab ab-00 00 00 00 00 00 00 00 ................
008d0e50 b6 97 b9 01 fe 49 00 00-c4 00 8a 00 30 51 8a 00 .....I......0Q..
008d0e60 ee fe ee fe ee fe ee fe-ee fe ee fe ee fe ee fe ................
008d0e70 ee fe ee fe ee fe ee fe-ee fe ee fe ee fe ee fe ................
008d0e80 ee fe ee fe ee fe ee fe-ee fe ee fe ee fe ee fe ................
008d0e90 ee fe ee fe ee fe ee fe-ee fe ee fe ee fe ee fe ................
008d0ea0 ee fe ee fe ee fe ee fe-ee fe ee fe ee fe ee fe ................
附X32 SEH的快速查找:
0:000> dt ntdll!_EXCEPTION_REGISTRATION_RECORD -l next poi(7efdd000) (这个值是TEB的基址)
next at 0x14f644
---------------------------------------------
+0x000 Next : 0x0014f810 _EXCEPTION_REGISTRATION_RECORD
+0x004 Handler : 0x776e71f5 _EXCEPTION_DISPOSITION ntdll!_except_handler4+0
next at 0x14f810
---------------------------------------------
+0x000 Next : 0xffffffff _EXCEPTION_REGISTRATION_RECORD
+0x004 Handler : 0x776e71f5 _EXCEPTION_DISPOSITION ntdll!_except_handler4+0
next at 0xffffffff
---------------------------------------------
+0x000 Next : ????
+0x004 Handler : ????
Memory read error 00000003