Skip to content
Snippets Groups Projects
Commit 95c7feba authored by Callum Prentice's avatar Callum Prentice
Browse files

Remove the scary 32bit exception handler that patches kernel32.dll since it...

Remove the scary 32bit exception handler that patches kernel32.dll since it was (a) scary, (b) didn't work on 64 bit and (c) likely the cause of a lot of anti-virus false positives
parent 45f67f4e
No related branches found
No related tags found
No related merge requests found
...@@ -100,33 +100,8 @@ LPTOP_LEVEL_EXCEPTION_FILTER WINAPI MyDummySetUnhandledExceptionFilter( ...@@ -100,33 +100,8 @@ LPTOP_LEVEL_EXCEPTION_FILTER WINAPI MyDummySetUnhandledExceptionFilter(
BOOL PreventSetUnhandledExceptionFilter() BOOL PreventSetUnhandledExceptionFilter()
{ {
// WARNING: This won't work on 64-bit Windows systems so we turn it off it. // remove the scary stuff that also isn't supported on 64 bit Windows
// It should work for any flavor of 32-bit Windows we care about. return TRUE;
// If it's off, sometimes you will see an OS message when a plugin crashes
#ifndef _WIN64
HMODULE hKernel32 = LoadLibraryA( "kernel32.dll" );
if ( NULL == hKernel32 )
return FALSE;
void *pOrgEntry = GetProcAddress( hKernel32, "SetUnhandledExceptionFilter" );
if( NULL == pOrgEntry )
return FALSE;
unsigned char newJump[ 100 ];
DWORD dwOrgEntryAddr = (DWORD)pOrgEntry;
dwOrgEntryAddr += 5; // add 5 for 5 op-codes for jmp far
void *pNewFunc = &MyDummySetUnhandledExceptionFilter;
DWORD dwNewEntryAddr = (DWORD) pNewFunc;
DWORD dwRelativeAddr = dwNewEntryAddr - dwOrgEntryAddr;
newJump[ 0 ] = 0xE9; // JMP absolute
memcpy( &newJump[ 1 ], &dwRelativeAddr, sizeof( pNewFunc ) );
SIZE_T bytesWritten;
BOOL bRet = WriteProcessMemory( GetCurrentProcess(), pOrgEntry, newJump, sizeof( pNewFunc ) + 1, &bytesWritten );
return bRet;
#else
return FALSE;
#endif
} }
//////////////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////////////////
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment