Misusing Structured Exception Handlers
Created the Monday 13 June 2022. Updated 5 months, 2 weeks ago.
Structured Exceptions Handlers or SEH chain is a linked list of functions that are used to handle exceptions in a program. These can be misused to fool the disassemblers. FS segment register is used to gain access to thread environment block (TEB), the first structure in TEB is thread information block (TIB) and the first element in TIB is a pointer to SEH chain and it functions as a stack.