?

很久木有管博客了?? 最近也沒(méi)有學(xué)什么???

Dos系統(tǒng)下發(fā)生異常后,系統(tǒng)會(huì)調(diào)用int 24h服務(wù)例程,然后根據(jù)中斷的返回值決定下一步要做什么,他會(huì)在屏幕上顯示ignore Retry Fail Abort? 讓用戶選擇進(jìn)而進(jìn)行下一步操作

這樣的話? 只要應(yīng)用程序截取int 24h中斷,就可以隨意的"胡作非為"了

?

Windows操作系統(tǒng)對(duì)異常的處理流程相對(duì)復(fù)雜,其依靠80x86的保護(hù)模式機(jī)制來(lái)主動(dòng)捕獲異常.

?

用SetUnhandledExceptionFilter函數(shù)設(shè)置異常處理回調(diào)函數(shù)

<span style="font-family:Microsoft YaHei;font-size:13px;">invoke SetUnhandledExceptionFilter,addr _Handlermov lpOldHandler,eax</span>

函數(shù)返回的是原回調(diào)函數(shù)的地址

?

篩選器回調(diào)函數(shù)的格式如下

_Handler proc lpExceptionInfo

lpExceptionInfo? 指向一個(gè)EXCEPTION_POINTERS結(jié)構(gòu)

<span style="font-family:Microsoft YaHei;font-size:13px;">EXCEPTION_POINTERS STRUCTpExceptionRecord DWORD ? ;指向一個(gè)EXCEPTION_RECORD結(jié)構(gòu)ContextRecord DWORD ? ;指向一個(gè)CONTEXT結(jié)構(gòu)EXCEPTION_POINTERS ENDS</span>

?(1)EXCEPTION_RECORD結(jié)構(gòu)

<span style="font-family:Microsoft YaHei;font-size:13px;">typedef struct _EXCEPTION_RECORD { DWORD ExceptionCode; //異常事件代碼DWORD ExceptionFlags; //異常標(biāo)志 struct _EXCEPTION_RECORD *ExceptionRecord; //下一個(gè)Exception_Record結(jié)構(gòu)地址PVOID ExceptionAddress; DWORD NumberParameters; ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; } EXCEPTION_RECORD, *PEXCEPTION_RECORD; </span>

ExceptionCode指定了一系列的錯(cuò)誤代碼,說(shuō)明了錯(cuò)誤的原因

ExceptionFlags說(shuō)明了錯(cuò)誤的標(biāo)志 ,由一系列的數(shù)據(jù)位組成

位0:代表發(fā)生的異常是否允許被恢復(fù)執(zhí)行,當(dāng)位0被復(fù)位的時(shí)候,表示回調(diào)函數(shù)在對(duì)異常進(jìn)行處理后可以指定讓程序繼續(xù)運(yùn)行,置位時(shí)候表示這個(gè)異常是不可恢復(fù)的,,這個(gè)時(shí)候程序最好進(jìn)行退出前的掃尾工作,并選擇終止應(yīng)用程序,如果這個(gè)時(shí)候非要指定讓程序繼續(xù)執(zhí)行的話,Windows會(huì)再次以EXCEPTION_NONCONTINUABLE_EXCEPTION異常代碼調(diào)用回調(diào)函數(shù).為了程序的可讀性,可以通過(guò)2個(gè)預(yù)定義值來(lái)測(cè)試這個(gè)位,EXCEPTION_CONTINUABLE(定義為0)和EXCEPTION_NONCONTINUABLE(定義為1)

位1:EXCEPTION_UNWINDING標(biāo)志.表示回調(diào)函數(shù)被調(diào)用的原因是進(jìn)行了展開操作

位2:EXCEPTION_UNWINDING_FOR_EXIT標(biāo)志,表示回調(diào)函數(shù)被調(diào)用的原因是進(jìn)行最終退出前的展開操作

當(dāng)異常處理函數(shù)的代碼設(shè)計(jì)得不完善而在運(yùn)行中引發(fā)新的異常時(shí),回調(diào)函數(shù)會(huì)被嵌套調(diào)用,在這種情況下EXCEPTION_RECORD結(jié)構(gòu)中的pExceptionRecord字段會(huì)指向下一個(gè)EXCEPTION_RECORD結(jié)構(gòu)....如果沒(méi)有發(fā)生嵌套異常,這個(gè)值為NULL
?(2)CONTEXT 線程上下文

<span style="font-family:Microsoft YaHei;font-size:13px;">typedef struct _CONTEXT { // // The flags values within this flag control the contents of // a CONTEXT record. // // If the context record is used as an input parameter, then // for each portion of the context record controlled by a flag // whose value is set, it is assumed that that portion of the // context record contains valid context. If the context record // is being used to modify a threads context, then only that // portion of the threads context will be modified. // // If the context record is used as an IN OUT parameter to capture // the context of a thread, then only those portions of the thread's // context corresponding to set flags will be returned. // // The context record is never used as an OUT only parameter. // DWORD ContextFlags; // // This section is specified/returned if CONTEXT_DEBUG_REGISTERS is // set in ContextFlags. Note that CONTEXT_DEBUG_REGISTERS is NOT // included in CONTEXT_FULL. // DWORD Dr0; DWORD Dr1; DWORD Dr2; DWORD Dr3; DWORD Dr6; DWORD Dr7; // // This section is specified/returned if the // ContextFlags word contians the flag CONTEXT_FLOATING_POINT. // FLOATING_SAVE_AREA FloatSave; // // This section is specified/returned if the // ContextFlags word contians the flag CONTEXT_SEGMENTS. // DWORD SegGs; DWORD SegFs; DWORD SegEs; DWORD SegDs; // // This section is specified/returned if the // ContextFlags word contians the flag CONTEXT_INTEGER. // DWORD Edi; DWORD Esi; DWORD Ebx; DWORD Edx; DWORD Ecx; DWORD Eax; // // This section is specified/returned if the // ContextFlags word contians the flag CONTEXT_CONTROL. // DWORD Ebp; DWORD Eip; DWORD SegCs; // MUST BE SANITIZED DWORD EFlags; // MUST BE SANITIZED DWORD Esp; DWORD SegSs; // // This section is specified/returned if the ContextFlags word // contains the flag CONTEXT_EXTENDED_REGISTERS. // The format and contexts are processor specific // BYTE ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION]; } CONTEXT; typedef CONTEXT *PCONTEXT; </span>

(3)異常處理程序的返回值

回調(diào)函數(shù)返回后,Windows執(zhí)行默認(rèn)的異常處理程序,這個(gè)程序會(huì)根據(jù)回調(diào)函數(shù)的返回值決定如何進(jìn)行下一步動(dòng)作

回調(diào)函數(shù)的返回值可以有3種取值:EXCEPTION_EXECUTE_HANDLER(定義為1),EXCEPTION_CONTINUE_SEARCH(定義為0)和EXCEPTION_CONTINUE_EXECUTION(定義為-1)

當(dāng)返回值為1時(shí),進(jìn)程將被終止,但是在終止之前,系統(tǒng)不會(huì)顯示出錯(cuò)提示對(duì)話框;當(dāng)返回值為0時(shí),系統(tǒng)同樣將終止程序,但是在終止之前會(huì)顯示出錯(cuò)的提示對(duì)話框.使用這2種返回值的時(shí)候,異常處理程序完成的工作一般是退出前的掃尾工作.

當(dāng)返回值為-1時(shí),系統(tǒng)將CONTEXT設(shè)置回去的并繼續(xù)執(zhí)行程序..

?

當(dāng)異常的標(biāo)志位為EXCEPTION_NONCONTINUABLE的標(biāo)志位時(shí)候,不應(yīng)該設(shè)置EXCEPTION_CONTINUE_EXECUTION返回值,這樣只會(huì)引發(fā)一個(gè)新的異常

?

一個(gè)異常處理的小程序? ...

<span style="font-family:Microsoft YaHei;font-size:13px;"> .386.model flat,stdcalloption casemap:none ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> include windows.inc include user32.inc include kernel32.inc includelib user32.lib includelib kernel32.lib ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>L macro var:VARARGLOCAL @lbl.const@lbl db var,0.codeexitm <offset @lbl> endm .data? lpOldHandler dd ? .code ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ;功能: 篩選器 ---全局的 Handler --------- 異常處理程序 ;參數(shù): 指向一個(gè)EXCEPTION_POINTERS ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> _Handler proc _lpExceptionPointLOCAL @szBuffer[256]:bytepushad;關(guān)聯(lián)esi到EXCEPTION_POINTERS結(jié)構(gòu)體mov esi,_lpExceptionPointassume esi:ptr EXCEPTION_POINTERSmov edi,[esi].ContextRecord ;指向一個(gè)EXCEPTION_RECORD結(jié)構(gòu)mov esi,[esi].pExceptionRecord ;指向一個(gè)Thread Context結(jié)構(gòu)assume esi:ptr EXCEPTION_RECORD,edi:ptr CONTEXT;彈出異常信息invoke wsprintf,addr @szBuffer,L("異常發(fā)生的位置:%08x,異常代碼:%08X,標(biāo)志:%08X"),[edi].regEip,[esi].ExceptionCode,[esi].ExceptionFlagsinvoke MessageBox,NULL,addr @szBuffer,L("哈哈--異常啦"),MB_OK;回到安全地方mov [edi].regEip,offset _SafePlaceassume edi:nothing,esi:nothingpopadmov eax,EXCEPTION_CONTINUE_EXECUTIONret _Handler endpstart:invoke SetUnhandledExceptionFilter,addr _Handlermov lpOldHandler,eax;下面是引發(fā)異常的指令xor eax,eaxmov dword ptr [eax],0;這里的代碼沒(méi)有被執(zhí)行哦invoke MessageBox,NULL,L("這里沒(méi)有被執(zhí)行哦"),L("------"),MB_OK;安全地方 _SafePlace:invoke MessageBox,NULL,L("哈哈 到安全地方啦"),L("成功"),MB_OKinvoke SetUnhandledExceptionFilter,lpOldHandler invoke ExitProcess,NULL ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> end start</span>

?

?

?

?

?

總結(jié)

以上是生活随笔為你收集整理的Windows使用筛选器来处理异常的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。

如果覺(jué)得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。