#include <stdio.h>
#include <Windows.h>
LONG WINAPI VectoredHandler1(struct _EXCEPTION_POINTERS* ExceptionInfo)
{
ULONG code = ExceptionInfo->ExceptionRecord->ExceptionCode;
ULONG_PTR address = (ULONG_PTR)ExceptionInfo->ExceptionRecord->ExceptionAddress;
return 0;
}
LONG WINAPI VectoredHandler2(struct _EXCEPTION_POINTERS* ExceptionInfo)
{
ULONG code = ExceptionInfo->ExceptionRecord->ExceptionCode;
ULONG_PTR address = (ULONG_PTR)ExceptionInfo->ExceptionRecord->ExceptionAddress;
return 1;
}
LONG WINAPI VectoredHandler3(struct _EXCEPTION_POINTERS* ExceptionInfo)
{
ULONG code = ExceptionInfo->ExceptionRecord->ExceptionCode;
ULONG_PTR address = (ULONG_PTR)ExceptionInfo->ExceptionRecord->ExceptionAddress;
return 2;
}
int main()
{
LIST_ENTRY* ExceptionHandler = (LIST_ENTRY*)AddVectoredExceptionHandler(1, VectoredHandler1);
LIST_ENTRY* ExceptionHandler2 = (LIST_ENTRY*)AddVectoredExceptionHandler(1, VectoredHandler2);
ULONG64(WINAPI * RtlEncodePointer)(PVOID a1);
ULONG64(WINAPI * RtlDecodePointer)(PVOID a1);
(FARPROC&)RtlEncodePointer = GetProcAddress(GetModuleHandleA("ntdll.dll"), "RtlEncodePointer");
(FARPROC&)RtlDecodePointer = GetProcAddress(GetModuleHandleA("ntdll.dll"), "RtlDecodePointer");
printf("VectoredHandler1=%p,%p\n", ExceptionHandler,VectoredHandler1);
printf("VectoredHandler2=%p,%p\n", ExceptionHandler2,VectoredHandler2);
printf("VectoredHandler3=%p\n", VectoredHandler3);
printf("----HOOK前的VEH----\n");
LIST_ENTRY* curNode = ExceptionHandler;
do
{
ULONG64 FuncAdd = RtlDecodePointer(((ULONG64**)curNode)[0x20 / 8]);
printf("FuncAdd=%p,%p\n", curNode, FuncAdd);
curNode = (LIST_ENTRY * )curNode->Flink;
} while (curNode!= ExceptionHandler);
printf("----HOOK中----\n");
curNode = ExceptionHandler;
do
{
ULONG64 FuncAdd = RtlDecodePointer(((ULONG64**)curNode)[0x20 / 8]);
if (FuncAdd==(ULONG64)VectoredHandler2)
{
((ULONG64**)curNode)[0x20 / 8] = (ULONG64*)RtlEncodePointer(VectoredHandler3);
printf("HookFuncAdd=%p-->%p\n", FuncAdd, VectoredHandler3);
break;
}
curNode = (LIST_ENTRY*)curNode->Flink;
} while (curNode != ExceptionHandler);
printf("----HOOK后的VEH----\n");
curNode = ExceptionHandler;
do
{
ULONG64 FuncAdd = RtlDecodePointer(((ULONG64**)curNode)[0x20 / 8]);
printf("FuncAdd=%p,%p\n", curNode, FuncAdd);
curNode = (LIST_ENTRY*)curNode->Flink;
} while (curNode != ExceptionHandler);
getchar();
}
