var
RtlDispatchExceptionNext:
function(excRec: PExceptionRecord; excCtxt:
PContext): integer;
stdcall =
nil;
function RtlDispatchExceptionCallback(excRec: PExceptionRecord; excCtxt:
PContext): integer;
stdcall;
begin
result := RtlDispatchExceptionNext(excRec, excCtxt);
// Exception Handling
end;
procedure InstallExcDispatchHook;
var
c1, c2: dword;
begin
c1 := dword(GetProcAddress(GetModuleHandle('
ntdll.dll'),
'
KiUserExceptionDispatcher'));
if Byte(pointer(c1)^) = $FC
then
inc(c1);
if (dword(pointer(c1)^) = $04244C8B)
and // mov ecx, [esp+4] ; PContext
(dword(pointer(c1 + 4)^)
and $00FFFFFF = $241C8B)
and
// mov ebx, [esp+0] ; PExceptionRecord
(byte(pointer(c1 + 7)^) = $51)
and // push ecx
(byte(pointer(c1 + 8)^) = $53)
and // push ebx
(byte(pointer(c1 + 9)^) = $E8)
and // call RtlDispatchException
VirtualProtect(pointer(c1 + 10), 4, PAGE_EXECUTE_READWRITE, c2)
then
begin
RtlDispatchExceptionNext := pointer(c1 + 14 + dword(pointer(c1 + 10)^));
dword(pointer(c1 + 10)^) := dword(@RtlDispatchExceptionCallback) - c1 - 14;
VirtualProtect(pointer(c1 + 10), 4, c2, c2);
end;
end;