UWP-SEH-Exception-Sniffing-POC/a_1authrowhook.asm
2022-01-23 02:39:33 +00:00

29 lines
607 B
NASM

; crinkle the linkers load order
; a.obj < (anything else).obj
; A/B/C:\... < ntstc_msvcrt's d:\os\obj\...
PUBLIC _CxxThrowException
EXTERN _SEHReport : proc
EXTERN gGxxThrowRefDll : qword
.code
_CxxThrowException PROC
MOV R8, [RSP]
push RCX
push RDX
SUB RSP, 24 ; yo wtf, we have [0, -8], [-8, -8], [-16, -8] writes in our stack?! stdcall compiler optimizer conflicting with the reality that stdcall does not exist under x64?
MOV RAX, [_SEHReport]
CALL RAX
ADD RSP, 24
POP RDX
POP RCX
XOR RAX, RAX
JMP gGxxThrowRefDll
_CxxThrowException ENDP
END