A hookless VEH (Vectored Exception Handler) detection mechanism
For a very detailed writeup please view this blog post
You can see the address of the VEH aswell as the amount of registered VEHs
int main() {
AllocConsole();
freopen_s((FILE**)stdout, "CONOUT$", "w", stdout);
void* pHandlerCall = reinterpret_cast<void*>(SignatureScan("ntdll.dll", "\x81\xC3\x00\x00\x00\x00\x8D\x7B", "xx????xx"));
void* pHandlerList = *reinterpret_cast<void**>(SignatureScan("ntdll.dll", "\x81\xC3\x00\x00\x00\x00\x8D\x7B", "xx????xx") + 0x02);
std::cout << "[+] Handler Call 0x" << pHandlerCall << std::endl;
std::cout << "[+] Handler List 0x" << pHandlerList << std::endl;
AddVectoredExceptionHandler(true, VEH);
PVECTORED_HANDLER_LIST vectored_handler_list_ = reinterpret_cast<PVECTORED_HANDLER_LIST>(pHandlerList);
PLIST_ENTRY forward_link = vectored_handler_list_->ExecuteHandlerList.Flink;
int i = 0;
for (PLIST_ENTRY link = forward_link; link != &vectored_handler_list_->ExecuteHandlerList; link = link->Flink) {
PVECTORED_HANDLER_ENTRY handler_entry = reinterpret_cast<PVECTORED_HANDLER_ENTRY>(link);
void* decoded_pointer = (handler_entry->Old.Refs < sizeof(ULONG)) ? DecodePointer(handler_entry->Old.Handler) : DecodePointer(handler_entry->New.Handler);
std::cout << " Entry" << "[" << i << "]" << " => 0x" << decoded_pointer << std::endl;
i++;
}
return 0;
}