How to catch SEH thrown from ntdll.dll's TppRaiseInvalidParameter?

332 Views Asked by At

I am using MSVC2019 and COM and compiling using /EHa getting a SEH from ntdll.dll from TppRaiseInvalidParameter that I am trying to catch but seem unable to. I know exactly why the exception is thrown, but that is not the issue here.

I tried using all the mechanisms described in the MSDN docs (__try/__except, _set_se_translator, SetUnhandledExceptionFilter), but none seem to trigger in this case. I also tried raising exceptions using RaiseException and RtlRaiseException (used by TppRaiseInvalidParameter) and those seem to be caught no problem in the __except handler.

The only thing I've been able to spot in TppRaiseInvalidParameter is that it calls __SEH_prolog4_GS at the beginning, but from what I've read that is normal code generated by the compiler for SEHs, but I'm new to SEHs in general.

My questions are: why can't I catch that exception? Is there any way to catch it?

Minimal code for reproduction

extern "C"
{
    void (WINAPI* TppRaiseInvalidParameter)();
}

void func()
{
    __try
    {
        HMODULE ntdll;
        GetModuleHandleExA(GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, "ntdll.dll", &ntdll);
        TppRaiseInvalidParameter = reinterpret_cast<decltype(TppRaiseInvalidParameter)>((LONG)ntdll + 0x104EBDL); // it's not an exported function and your offset may be different
        TppRaiseInvalidParameter();
    }
    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        puts("exception caught");
    }
}
0

There are 0 best solutions below