vehdetector's Introduction

VEHDetector

A hookless VEH (Vectored Exception Handler) detection mechanism

How it works

For a very detailed writeup please view this blog post

Usage

You can see the address of the VEH aswell as the amount of registered VEHs

int main() {
	AllocConsole();
	freopen_s((FILE**)stdout, "CONOUT$", "w", stdout);
	void* pHandlerCall = reinterpret_cast<void*>(SignatureScan("ntdll.dll", "\x81\xC3\x00\x00\x00\x00\x8D\x7B", "xx????xx"));
	void* pHandlerList = *reinterpret_cast<void**>(SignatureScan("ntdll.dll", "\x81\xC3\x00\x00\x00\x00\x8D\x7B", "xx????xx") + 0x02);

	std::cout << "[+] Handler Call 0x" << pHandlerCall << std::endl;
	std::cout << "[+] Handler List 0x" << pHandlerList << std::endl;

	AddVectoredExceptionHandler(true, VEH);

	PVECTORED_HANDLER_LIST vectored_handler_list_ = reinterpret_cast<PVECTORED_HANDLER_LIST>(pHandlerList);
	PLIST_ENTRY forward_link = vectored_handler_list_->ExecuteHandlerList.Flink;

	int i = 0;
	for (PLIST_ENTRY link = forward_link; link != &vectored_handler_list_->ExecuteHandlerList; link = link->Flink) {
		PVECTORED_HANDLER_ENTRY handler_entry = reinterpret_cast<PVECTORED_HANDLER_ENTRY>(link);
		void* decoded_pointer = (handler_entry->Old.Refs < sizeof(ULONG)) ? DecodePointer(handler_entry->Old.Handler) : DecodePointer(handler_entry->New.Handler);

		std::cout << "	Entry" << "[" << i << "]" << " => 0x" << decoded_pointer << std::endl;

		i++;
	}

	return 0;
}

Recommend Projects