ManualMap - A manual mapper for x86 modules

[Cypher]

I've taken a look today into x64 C++ EH, and found that source of all problems is RtlPcToFileHeader that returns 0 as ImageBase for exception address. But VEH can fix this as always (but unfortunately is uses a dirty hack)

// taken from CRT include <Ehdata.h>
#define EH_MAGIC_NUMBER1        0x19930520    
#define EH_PURE_MAGIC_NUMBER1   0x01994000

LONG CALLBACK VectoredHandler64( _In_ PEXCEPTION_POINTERS ExceptionInfo )
{
    // Assume this is our exception because of ImageBase = 0 and not suitable magic number
    // Not sure if this is 100% valid assumption though
    if(ExceptionInfo->ExceptionRecord->ExceptionInformation[0] == EH_PURE_MAGIC_NUMBER1 
        && ExceptionInfo->ExceptionRecord->ExceptionInformation[3] == 0)
    {
        // magic number (didn't bother to look if it depends on CRT version; this is for vc110)
        ExceptionInfo->ExceptionRecord->ExceptionInformation[0] = (ULONG_PTR)EH_MAGIC_NUMBER1;

        // fix exception image base
        ExceptionInfo->ExceptionRecord->ExceptionInformation[3] = (ULONG_PTR)s_TargetImageBase;    // actual image base of mapped dll
    }

    return EXCEPTION_CONTINUE_SEARCH;
} 

Neat trick! As far as dirty hacks go, this is definitely on the nicer end of the scale. (Besides, manual mapping is just one big dirty hack anyway...)

[Wilbo007]

If you don't know that already you don't need to know it.

'

I want to know! Pretend you're explaining this to a dog with a small attention span.

[Master674]

'

I want to know! Pretend you're explaining this to a dog with a small attention span.

Okay

he is trying to get SafeSEH working for manually mapped modules.

[abuckau907]

"... to [my] dog.." (German Shepherd. Artimus)

"go lay the **** down"

mm spam. Lol you can't un-read this. sry :/

[Jadd]

Maybe OP died?