How to Patch the windows API SetUnhandledExceptionFIlter in 64 bit machine

[Sendil kumar]

Hi All,

I have an application, where I have patched the windows API SetUnhandledExc eptionFilter function. It works fine in 32 bit machine, but ,complains an error when I ran the application in 64 bit machine.

Can any one help to solve this?

Thanks,
Sendil

[weaknessforcats]

What do you mean that you patched a Win32 API function?

Plus, what kind of error are you getting? Which OS?

[Sendil kumar]

What do you mean that you patched a Win32 API function?

Plus, what kind of error are you getting? Which OS?

I have stolen 5 bytes from the address of SetUnhandledExc eptionFilter in Kernel32.dll and added my patch bytes( 0x33, 0xC0, 0xC2, 0x04, 0x00 ) to it.
So, the SetUnhandledExc eptionFilter will never get executed when ever a call is made. This technique is used to enforce your own exception filter so that no one can re-set their own filter once you patched.

When I executed the same in my 64-bit machine it give access violation error.

Thanks,
Sendil

[weaknessforcats]

It looks like Microsoft has fixed a bug.

I have no advice since I have never heard of anyone doing stuff like this. I'm just a C++ junkie.

Clearly the address of SetUnhandledExc eptionFilter is outside your process address space.