Geek Answers Handbook

SetUnhandledExceptionFilter: continue execution 1 operation code next

I am working on an Xbox1 emulator in Delphi, and since I am running games on a local processor, I need to create fault tolerant for ring0 teams that may occur inside the game code.

To catch these instructions, I found out that SetUnhandledExceptionFilter can register a function that will be called with exceptions other than Delphi (provided that JITEnable is set to a value above 0). Signature of registered callback function:

function ExceptionFilter(E: LPEXCEPTION_POINTERS): Integer; stdcall;

Inside this function, I can test illegal instructions like this:

// STATUS_PRIVILEGED_INSTRUCTION = $C0000096
if E.ExceptionRecord.ExceptionCode = STATUS_PRIVILEGED_INSTRUCTION then

One of the offending teams is WVINDB ($ 0F, $ 09), which I can detect as follows:

 // See if the instruction pointer is a WBINVD opcode :
 if  (PAnsiChar(E.ExceptionRecord.ExceptionAddress)[0] = #$0F)
 and (PAnsiChar(E.ExceptionRecord.ExceptionAddress)[1] = #$09) then

( , ), - :

  begin
    // Skip the WBINVD instruction, and continue execution :
    Inc(DWORD(E.ExceptionRecord.ExceptionAddress), 2);
    Result := EXCEPTION_CONTINUE_EXECUTION;
    Exit;
  end;

, . , (E.ContextRecord.Eip), - ContextRecord .

, ?

PS: , , ExceptionFilter, - ; ?

DebugHook := 0; // Act as if there no debugger
// Trigger a privileged instruction exception via this ring0 instruction :
asm
  WBINVD
end;
// Prove that my exception-filter worked :
ShowMessage('WBINVD succesfully ignored!');
+5
1

SetUnhandledExceptionFilter Delphi, , , ?

Exception AddVectoredExceptionHandler, callback, EXCEPTION_POINTERS. Context ao EIP, .

EXCEPTION_CONTINUE_EXECUTION Callback, EIP.

+3

More articles:


All Articles