Windows kernel reading notes--seh structured exception handling

SEH is the generic name for the exception distribution and processing mechanism in Windows systems, and its implementation is distributed in many different modules.

SEH provides two functions for terminating processing and exception handling .

Finalization processing guarantees that the program in the end processing block must be executed

1 __try 2 {3// code 4} to protect 5 __finally 6 {7// End processing block 8 }

How to exit the protection block: normal end and abnormal end two types of

1. Normal End

Normal execution and sequential entry to the end processing block is called normal end

2. Non-normal end

Because of an exception or because of a process control statement such as return, Goto, break, continue, and so on, leaving the protected block is called an abnormal end.

Use abnormaltermination in the finalization processing block to obtain the exit mode of the protected block.

The __leave keyword is used in the protected block and immediately ends the protected block. belongs to normal exit.

Exception handling features for handling exceptions

1 __try 2 {3// protected block 4} 5 __except (filter expression) 6 {7// exception handling block 8 }

Provides two macros that can be used within a filter expression or exception-handling block

GetExceptionCode () returns the exception code

GetExceptionInformation () returns a exception_pointers structure

1 struct _exception_pointers {2  pexception_record exceptionrecord;//exception record pointer 3   PCONTEXT          contextrecord;//thread Context pointer 4 } exception_pointers, *pexception_pointers;

A filter expression can be a constant, or a function call can be a conditional expression, but the last value must be one of 1, 0, 1.

Exception_continue_search (0) This protection block does not handle exceptions, the system continues to search other protection blocks

Exception_continue_execution (1) has handled the exception, the program goes back to the anomaly and continues to run.

Exception_execute_handle (-1) Allow this protection block to handle this

Windows kernel reading notes--seh structured exception handling