How much is pushed onto a 32-bit stack under Windows x86-64 on an exception?
In this this question, I give some background on a parallel language I have implemented. The compiler generates native x86-32 code.
A key implementation decision is
-
The same stack context, if you talking about emulated x32 environment on a x64 box, then its exactly the same size as on a x32 which in my case is 0x3E0 bytes aligned to DWORD.
Everything emulated on WOW64 process should be handled exactly the same at is x32 counter part at least when it comes to functionality, now if you rely on TEB32 for inspect the stack that is a different case, as you can see on this article:
http://www.dumpanalysis.org/blog/index.php/2009/07/07/raw-stack-dump-of-wow64-process/
Sadly there isn't an official paper i could find regarding your question.
Also here is an interesting paper you can read regarding WOW64 emulated process:
http://blog.rewolf.pl/blog/?p=102#.UBTmHaBEUXw
Finally if what you meant is to have an stack made function to handle exceptions it can be done without any worry, i can see here on trace logs after the exception is trigger, how some function made in stack, is receiving the exception before the mine SEH, it seems to be some kind of Avast engine or maybe some spyware, i cant trace it to any knowed module since after the function pass, it is dealloced.
Hope that i've helped on something.
PS: If you can post some extra info maybe the stack log and your function to handle exceptions, we could help more.
讨论(0) -
[Answer complete; see specific values for both Win32 Vista and Win64 Wow64 for Windows7]
==========================================================================Running on 32 bit Windows Vista, doing an IDIV with zero divisor, I get the following values:
EBP@div == x01C00800 // base of heap-allocated stack frame ESP@div == x01C00FF8 // stack at "top" of allocated stack frame ESP@entry to SEH == 0x1C00C30 // ESP measured at first instruction of Structured Exception Handler ContextOffset[ESP]== 0x1C00D2C // Pointer to context block at entry to SEHSo from the ESP=0x1C00FF8 at the point of the divide, to the bottom of the pushed context block, 0x1C00FF8-0x1C00D2C = 0x2CC = 716 bytes are pushed. From the bottom of the pushed context block to the entry at SEH, 0x1C00D2C-0x1C00C30 = 0xFC == 252 bytes are pushed. So, it appears that 716+252 = 968 bytes get pushed (which I find rediculous).
It gets worse. What follows is a dump of the stack frame at entry to SEH; notice the values below 0x1C00C30 down to 0x1C00B78 (see at least the "obvious Win32 return address" 0x77c39534 at 0x1C00BD8) that are not cdcdcdcd; I believe that Windows has stepped on these values while passing control to my SEH. That's 0x1C00B78-0x1C00C30 = 0xB8 = 184 additional bytes. (So, rediculous + unbelievable) = 1152 bytes are needed to get to the SEH, minimum. [Weirdly, a Win32 ThreadStop executed by another thread appears to push nothing on the stopped threads stack]
0x01C00800 01b002f0 00000001 cd4b1b19 cdcdcdcd cdcdcdcd 0000000b cdcdcdcd cdcdcdcd ð.°.......KÍÍÍÍÍÍÍÍÍ....ÍÍÍÍÍÍÍÍ 0x01C00820 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00840 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00860 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00880 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C008A0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C008C0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C008E0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00900 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00920 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00940 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00960 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00980 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C009A0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C009C0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C009E0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00A00 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00A20 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00A40 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00A60 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00A80 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00AA0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00AC0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00AE0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00B00 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00B20 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ffff0000 cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ..ÿÿÍÍÍÍ 0x01C00B40 00000035 00000034 00000001 cdcdcdcd cdcdcdcd f5f55f5f cdcdcdcd cdcdcdcd 5...4.......ÍÍÍÍÍÍÍÍ__õõÍÍÍÍÍÍÍÍ 0x01C00B60 cdcdcdcd cdcdcdcd ffff0000 cdcdcdcd cdcdcdcd 0190bfa8 52b396ac 52b396ac ÍÍÍÍÍÍÍÍ..ÿÿÍÍÍÍÍÍÍͨ¿..¬–.R¬–.R 0x01C00B80 cdcdcdcd 0190bfa8 cdcdcdcd 00000011 00000000 01c00d18 cdcdcdcd cdcdcdcd ÍÍÍͨ¿..ÍÍÍÍ..........À.ÍÍÍÍÍÍÍÍ 0x01C00BA0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00BC0 cdcdcdcd cdcdcdcd 00000000 cdcdcdcd 01c00c30 77c39534 cdcdcdcd 00000011 ÍÍÍÍÍÍÍÍ....ÍÍÍÍ0.À.4.ÃwÍÍÍÍ.... 0x01C00BE0 00000000 01c00c30 77c39598 77c395b1 43e4d1f4 00000000 01c00d18 00456c00 ....0.À.˜.Ãw±.ÃwôÑäC......À..lE. 0x01C00C00 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 00000000 00400000 01c00bf0 cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ......@.ð.À.ÍÍÍÍ 0x01C00C20 0184ff74 77c09aa2 35e18e8c 01c00c50 77c65dd9 01c00d18 0184ff74 01c00d2c tÿ..¢šÀwŒŽá5P.À.Ù]Æw..À.tÿ..,.À. 0x01C00C40 01c00cec 0184ff74 77c65ded 0184ff74 01c00d00 77c65dab 01c00d18 0184ff74 ì.À.tÿ..í]Æwtÿ....À.«]Æw..À.tÿ.. 0x01C00C60 01c00d2c 01c00cec 00456c00 00000000 01c00d18 0184ff74 77c39442 01c00d18 ,.À.ì.À..lE.......À.tÿ..B”Ãw..À. 0x01C00C80 0184ff74 01c00d2c 01c00cec 00456c00 7ffde08c 01c00d18 01b00300 cdcdcdcd tÿ..,.À.ì.À..lE.Œàý...À...°.ÍÍÍÍ 0x01C00CA0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00CC0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x01C00CE0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 00000072 01850000 0184c000 00cdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍr........À..ÍÍÍ. 0x01C00D00 01c00800 77c65c37 00c00d18 01c00d2c 01c00d18 01c00d2c c0000094 00000000 ..À.7\Æw..À.,.À...À.,.À.”..À.... 0x01C00D20 00000000 023eb44c 00000000 0001003f 00000000 00000000 00000000 00000000 ....L´>.....?................... 0x01C00D40 00000000 00000000 ffff037b ffff2120 ffffffff 02383596 051f001b 02382ecc ........{.ÿÿ !ÿÿÿÿÿÿ–58.....Ì.8. 0x01C00D60 ffff0023 00000000 c0000000 00004000 00000000 c000c000 00000000 80000000 #.ÿÿ.......À.@.......À.À.......€ 0x01C00D80 0000c001 00000000 c0008000 00000000 c0000000 0000c001 00000000 c002e000 .À.......€.À.......À.À.......à.À 0x01C00DA0 00000000 80000000 00003fff 40000000 4010a51c 00000000 00000000 0000003b .......€ÿ?.....@.¥.@........;... 0x01C00DC0 00000023 00000023 7ffde08c 01b00300 0190bfa8 00000000 00000000 00000063 #...#...Œàý...°.¨¿..........c... 0x01C00DE0 01c00800 023eb44c 0000001b 00010246 01c00ff8 00000023 2120037b 051f0000 ..À.L´>.....F...ø.À.#...{. !.... 0x01C00E00 02383596 0000001b 02382ecc 00000023 00001f80 0000ffff 00000000 c0000000 –58.....Ì.8.#...€...ÿÿ.........À 0x01C00E20 00004000 00000000 00000000 c0000000 0000c000 00000000 00000000 80000000 .@.............À.À.............€ 0x01C00E40 0000c001 00000000 00000000 80000000 0000c000 00000000 00000000 c0000000 .À.............€.À.............À 0x01C00E60 0000c001 00000000 00000000 e0000000 0000c002 00000000 00000000 80000000 .À.............à.À.............€ 0x01C00E80 00003fff 00000000 00000000 a51c4000 00004010 00000000 00000000 00000000 ÿ?...........@.¥.@.............. 0x01C00EA0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x01C00EC0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x01C00EE0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x01C00F00 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x01C00F20 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x01C00F40 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x01C00F60 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x01C00F80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x01C00FA0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x01C00FC0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x01C00FE0 00000000 00000000 00000000 00000000 00000000 00000000 52b396ac 01c00b78 ........................¬–.Rx.À. ========================================================================================Running on 64 bit Windows 7, running 32 bit process under WOW64, doing an IDIV with zero divisor, I get the following values:
EBP@div == x02100800 // base of heap-allocated stack frame ESP@div == x02100FF8 // stack at "top" of allocated stack frame ESP@entry to SEH == 0x02100BD4 // ESP measured at first instruction of Structured Exception Handler ContextOffset[ESP]== 0x02100D10 // Pointer to context block at entry to SEHSo from the ESP=0x02100FF8 at the point of the divide, to the bottom of the pushed context block, 0x02100FF8-0x02100D10 = 0x2E8 = 744 bytes are pushed (Win32 pushed 716). From the bottom of the pushed context block to the entry at SEH, 0x02100D10-0x02100BD4 = 0x132 == 316 bytes are pushed (Windows32 pushed 252). So, it appears that 744+316 = 1060 bytes get pushed (which I find worse than the rediculous amount pushed by Win32).
It gets worse. What follows is a dump of the stack frame at entry to SEH; notice the values below 0x02100BD4 down to 0x021009D8 (see at least the "obvious Win32 return address" 0x77c39534 at 0x021009D8) that are not cdcdcdcd; I believe that Windows has stepped on these values while passing control to my SEH. That's 0x02100BD4-0x021009D8 = 0x1FC = 508 additional bytes. (So, rediculous + unbelievable) = 1568 bytes are needed to get to the SEH, minimum.
0x02100800 020402f0 00000001 fa0ad4b0 cdcdcdcd cdcdcdcd 0000000b cdcdcdcd cdcdcdcd ð.......°Ô.úÍÍÍÍÍÍÍÍ....ÍÍÍÍÍÍÍÍ 0x02100820 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x02100840 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x02100860 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x02100880 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x021008A0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x021008C0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x021008E0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x02100900 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x02100920 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x02100940 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x02100960 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x02100980 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x021009A0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x021009C0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 74fce2d9 00000000 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÙâüt.... 0x021009E0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x02100A00 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 002bbfc8 00000000 02040300 00000000 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÈ¿+............. 0x02100A20 fffd708c 00000000 77791266 00000000 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd Œpýÿ....f.yw....ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x02100A40 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ 0x02100A60 0010001f 00001f80 002b0023 0053002b 002b002b 00010246 00000000 00000000 ....€...#.+.+.S.+.+.F........... 0x02100A80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100AA0 00000000 00000000 00000063 00000000 00000000 00000000 00000000 00000000 ........c....................... 0x02100AC0 002bbfc8 00000000 02100ff8 00000000 02100800 00000000 02040300 00000000 È¿+.....ø....................... 0x02100AE0 fffd708c 00000000 0000002b 00000000 76f612ea 00000000 00000000 00000000 Œpýÿ....+.......ê.öv............ 0x02100B00 002fe7e0 00000000 fffd5000 00000000 002ffd20 00000000 002ff170 00000000 àç/......Pýÿ.... ý/.....pñ/..... 0x02100B20 74f32450 00000000 0281b1a4 00000000 2120037b 051f0000 027b359f 00000011 P$ót....¤±......{. !....Ÿ5{..... 0x02100B40 00000000 02100cc0 00001f80 0000ffff 00000000 80000000 00004001 00000000 ....À...€...ÿÿ.........€.@...... 0x02100B60 00000000 c0000000 0000c000 00000000 00000000 00000000 00000000 00000000 .......À.À...................... 0x02100B80 02100bd8 00000011 00000000 02100bd8 7797b2da 7797b2f3 72982375 00000000 Ø...........Ø...Ú.—wó.—wu#˜r.... 0x02100BA0 02100cc0 00456c00 0000c002 00000000 00000000 80000000 00000000 00400000 À....lE..À.............€......@. 0x02100BC0 02100b98 dfb28000 0203ff74 779971d5 071ce70d 02100bf8 7797b459 02100cc0 ˜....€.ßtÿ..Õq™w.ç..ø...Y´—wÀ... 0x02100BE0 0203ff74 02100d10 02100c94 0203ff74 7797b46d 0203ff74 02100ca8 7797b42b tÿ......”...tÿ..m´—wtÿ..¨...+´—w 0x02100C00 02100cc0 0203ff74 02100d10 02100c94 00456c00 00000000 02100cc0 0203ff74 À...tÿ......”....lE.....À...tÿ.. 0x02100C20 7797b3ce 02100cc0 0203ff74 02100d10 02100c94 00456c00 fffd708c 02100cc0 Î.—wÀ...tÿ......”....lE.ŒpýÿÀ... 0x02100C40 02040300 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100C60 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100C80 00000000 00000000 00000000 00000000 00000000 00000000 00000072 02040000 ........................r....... 0x02100CA0 0203c000 00000000 02100800 77930133 00100cc0 02100d10 02100cc0 02100d10 .À..........3.“wÀ.......À....... 0x02100CC0 c0000094 00000000 00000000 0281b1a4 00000000 00000000 00000000 00000000 ”..À........¤±.................. 0x02100CE0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100D00 00000000 00000000 00000000 00000000 0001003f 00000000 00000000 00000000 ................?............... 0x02100D20 00000000 00000000 00000000 0000037b 00002120 0000ffff 027b359f 051f0023 ............{... !..ÿÿ..Ÿ5{.#... 0x02100D40 027b2ecc 0000002b 00000000 80000000 00004001 00000000 c000c000 00000000 Ì.{.+..........€.@.......À.À.... 0x02100D60 80000000 0000c001 00000000 c0008000 00000000 c0000000 0000c001 00000000 ...€.À.......€.À.......À.À...... 0x02100D80 c002e000 00000000 80000000 00003fff 80000000 400fdfb2 00000000 0000002b .à.À.......€ÿ?.....€.ß.@....+... 0x02100DA0 00000053 0000002b 0000002b fffd708c 02040300 002bbfc8 00000000 00000000 S...+...+...Œpýÿ....È¿+......... 0x02100DC0 00000063 02100800 0281b1a4 00000023 00010246 02100ff8 0000002b 2120037b c.......¤±..#...F...ø...+...{. ! 0x02100DE0 051f0000 027b359f 00000023 027b2ecc 0000002b 00001f80 0000ffff 00000000 ....Ÿ5{.#...Ì.{.+...€...ÿÿ...... 0x02100E00 80000000 00004001 00000000 00000000 c0000000 0000c000 00000000 00000000 ...€.@.............À.À.......... 0x02100E20 80000000 0000c001 00000000 00000000 80000000 0000c000 00000000 00000000 ...€.À.............€.À.......... 0x02100E40 c0000000 0000c001 00000000 00000000 e0000000 0000c002 00000000 00000000 ...À.À.............à.À.......... 0x02100E60 80000000 00003fff 00000000 00000000 dfb28000 0000400f 00000000 00000000 ...€ÿ?...........€.ß.@.......... 0x02100E80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100EA0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100EC0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100EE0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100F00 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100F20 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100F40 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100F60 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100F80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100FA0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ................................ 0x02100FC0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 fffffd34 ............................4ýÿÿ 0x02100FE0 000002e4 fffffd34 000002cc 00000019 00000000 00000063 52b396ac 02100b78 ä...4ýÿÿÌ...........c...¬–.Rx...Final summary for cost to enter SEH:
- Windows32 pushes 968 bytes and trashes 184 bytes beyond that; you need 1152 bytes of additional stack beyond what you have at the point of the trap.
- Windows64 (WOW64) pushes 1060 bytes and trashes 508 bytes beyond that; you need 1568 bytes in addition to what you have at the point of the trap.
Its damn hard to define a "small activation record" scheme in the face of Windows profligate use of stack space.
I'd guess that exception handling under Windows must be exceeding slow, to boot; it takes time to read and write all those bytes.
I'll likely try this again with a beta version of Windows8. I expect to to be disgusted.
讨论(0)
加载中...
- 热议问题