
Misusing Structured Exception Handlers
Structured Exceptions Handlers or SEH chain is a linked list of functions that are used to handle exceptions in a program. These can be misused to fool the disassemblers. FS segment register is used to gain access to thread environment block (TEB), the first structure in TEB is thread information block (TIB) and the first element in TIB is a pointer to SEH chain and it functions as a stack.