I've just created a new vc++ exe with this simple code:
#include<stdio.h> #include<string.h> #include<windows.h> int ExceptionHandler(void); int main(int argc,char *argv[]){ char temp[512]; printf("Application launched"); try { throw "error"; } catch (... ) { ExceptionHandler(); } return 0; } int ExceptionHandler(void) { printf("Exception"); return 0; } The app is extremely simple, and an exe file depending on kernel32.dll and MSVCR100D.dll is created.
When I try to import and debug it into OllyDbg (I just wanted to see the SEH chain in the stack window) it says "Module 'testseh' has entry point outside the code (as specified in the PE header). Maybe this file is self-extracting or self-modifying. Please keep it in mind when setting breakpoints!" and no code is executed, it jumps directly to the ntdll.dll crash part (in fact the exe is crashing but I can't step by step the printf instructions)
How come this behaviour? The exe doesn't rely on CLI neither CLR, am I missing something?