#pragma once #include "../Include/Winheaders.h" #include "../Process/MemBlock.h" namespace blackbone { /// /// x64 exception module info /// struct ExceptionModule { ptr_t base; ptr_t size; }; /// /// x64 module table /// struct ModuleTable { ptr_t count; // Number of used entries ExceptionModule entry[250]; // Module data }; /// /// Exception handling support for arbitrary code /// class MExcept { public: BLACKBONE_API MExcept() = default; BLACKBONE_API ~MExcept() = default; /// /// Inject VEH wrapper into process /// Used to enable execution of SEH handlers out of image /// /// Target process /// Target module /// Partial exception support /// Error code BLACKBONE_API NTSTATUS CreateVEH( class Process& proc, ModuleData& mod, bool partial ); /// /// Removes VEH from target process /// /// Target process /// Partial exception support /// Mosule type /// Status code BLACKBONE_API NTSTATUS RemoveVEH( class Process& proc, bool partial, eModType mt ); /// /// Reset data /// BLACKBONE_API inline void reset() { _pModTable.Free(); } private: MExcept( const MExcept& ) = delete; MExcept& operator =(const MExcept&) = delete; private: MemBlock _pVEHCode; // VEH function codecave MemBlock _pModTable; // x64 module address range table uint64_t _hVEH = 0; // VEH handle static uint8_t _handler32[]; static uint8_t _handler64[]; }; }