I'm trying to unserstand the flow of Exception Dispatching on Windows and I saw that the Exception Dispatcher doesn't check for handlers on the IDT. to my knowledge the flow of Exception Handling (for a User mode process) is: 1st Debugger Exception handler that was written by the proggramer (SEH) 2st Debugger Exception port -> Subsystem trying to translate the Exception to a signal Error port -> CSRSS calls WER, which execute a handler that terminates the process
None of these levels includes using the first IDT's entries (those that contain handlers for exceptions like page fault). So my question is, when these entries are being used and by who?