Prcuvu
7e96188088
Windows x64 functions always assume there is at least 4 QWORDs' length of space reserved for register parameters (RCX, RDX, R8 and R9) after the caller return address even though there are less than 4 parameters. MSVC compiler will try to utilize vacant space there. If we forget to reserve that block, the exception handler will abort. Reference: https://docs.microsoft.com/en-us/cpp/build/stack-usage
30 lines
885 B
NASM
30 lines
885 B
NASM
extrn ?MainExceptionHandler@@YAJPEAU_EXCEPTION_POINTERS@@@Z : PROC
|
|
extrn VirtualAlloc : PROC
|
|
|
|
.code
|
|
|
|
; long __stdcall CrashHandler::ExceptionHandler( EXCEPTION_POINTERS *pExc );
|
|
?ExceptionHandler@CrashHandler@@YAJPEAU_EXCEPTION_POINTERS@@@Z PROC
|
|
|
|
push rbp
|
|
mov rbp, rsp
|
|
push rsi
|
|
mov rsi, rcx
|
|
xor rcx, rcx ; lpAddress = nullptr
|
|
mov rdx, 8000h ; dwSize = iSize
|
|
mov r8d, 00003000h; flAllocationType = MEM_COMMIT | MEM_RESERVE
|
|
mov r9d, 04h ; flProtect = PAGE_READWRITE
|
|
call VirtualAlloc ; char *pStack = (char *) VirtualAlloc( nullptr, iSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE );
|
|
add rax, 7FE0h ; pStack += iSize; Reserve register parameter stack area for RCX, RDX, R8 and R9
|
|
mov rcx, rsi ; Restore pExc
|
|
pop rsi
|
|
mov rsp, rax
|
|
call ?MainExceptionHandler@@YAJPEAU_EXCEPTION_POINTERS@@@Z
|
|
mov rsp, rbp
|
|
pop rbp
|
|
ret
|
|
|
|
?ExceptionHandler@CrashHandler@@YAJPEAU_EXCEPTION_POINTERS@@@Z ENDP
|
|
|
|
END
|