3

I am trying to read through Matt Pietrek article on "A Crash Course on the Depths of Win32 Structured Exception Handling" linked here. In the section titled Compiler-level SEH, he writes:

Now that you know that a _try block corresponds to an EXCEPTION_REGISTRATION structure on the stack, what about the callback function within the EXCEPTION_ REGISTRATION? Using Win32 terminology, the exception callback function corresponds to the filter-expression code. To refresh your memory, the filter-expression is the code in parens after the _except keyword. It's this filter-expression code that decides whether the code in the subsequent {} block will execute.

At this point, I am a bit confused. All along, until this point I thought that the callback function is the function that is going to handle the exception, i.e. the code inside the _except block. Kindly help me understand this.

Also, if the filter-expression code corresponds with the callback function, then what corresponds to the code inside '{}' after the filter-expression?

Improve this question

1 Answer 1

Reset to default
4

In case of the compiler-level SEH, the callback invoked by the OS is the compiler-provided function, usually __except_handler3 or similar. Once called, it inspects the stack, retrieves the trylevel, looks up the corresponding scopetable entry and calls the exception filter (lpfnFilter). If the filter returns non-zero, the handler (lpfnHandler) is invoked - this is the code corresponding to the code inside the __except/__finally block. For a specific example, check Appendix I here: http://www.openrce.org/articles/full_view/21

Note that C++ EH uses a somewhat more complicated approach compared to "simple" SEH to ensure proper semantics (such as automatic object destruction during unwinding), so it's not as easy to map back to source code, but doable (see Appendix II in the above article).

BTW, in recent Visual Studio versions, Microsoft provides almost complete CRT source, including the implementation of __except_handlerN and ___CxxFrameHandler, so you could look there too (e.g. \Program Files (x86)\Microsoft Visual Studio 11.0\VC\crt\src\eh\frame.cpp).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.