[MISC] Exception Handler Hooking.

Today I'll be demonstrating a popular hooking method known as exception handler hooking or vectored exception handler hooking (VEH hooking) in C++.

How does it work?

Windows' api allows you to make exception handlers which will be called when a exception (exception is just a fancy word for an error, at runtime.) occurs and you can choose which exceptions your exception handler handles.

The two most popular methods of doing this (also the methods I use in my library) are breakpoint exceptions and page guard exceptions.

1. STATUS_BREAKPOINT exception hook

Breakpoint exceptions are characterized by the INT3 opcode (0xCC) which will invoke the EXCEPTION_BREAKPOINT (STATUS_BREAKPOINT / 0x80000003L).

How do we actually make our handler hook? In order to invoke the breakpoint exception we need to overwrite a function's first initial byte to 0xCC which will cause a breakpoint exception when it is called, this breakpoint exception will then be handled by our handler which will redirect to our function and execute it.
I will be using the Sleep function as a demonstration and redirecting it to print hello.

#include <iostream>
#include <Windows.h>
#include <thread>

void print()
{
	std::cout << "hello!\n";
}

long __stdcall handler(EXCEPTION_POINTERS* exception)
{
	if(exception->ExceptionRecord->ExceptionCode == STATUS_BREAKPOINT && exception->ContextRecord->Eip == reinterpret_cast<std::uint32_t>(&Sleep))
	{
		exception->ContextRecord->Eip = reinterpret_cast<std::uint32_t>(&print);
		return EXCEPTION_CONTINUE_EXECUTION;
	}
	return EXCEPTION_CONTINUE_SEARCH;
}

void main_thread()
{
	AddVectoredExceptionHandler(true, &handler);
	DWORD vp_old_protection{ 0 };
	VirtualProtect(&Sleep, 1, PAGE_EXECUTE_READWRITE, &vp_old_protection);
	*reinterpret_cast<std::uint8_t*>(&Sleep) = 0xCC;
	VirtualProtect(&Sleep, 1, vp_old_protection, &vp_old_protection);
}





bool __stdcall DllMain(HMODULE dll_module, const std::uint32_t reason_for_call, void* reserved)
{
	if(reason_for_call == DLL_PROCESS_ATTACH)
	{
		std::thread{ main_thread }.detach();
	}
	return true;
} 

2. STATUS_GUARD_PAGE_VIOLATION exception hook
This exception is called when a guarded page of memory (PAGE_GUARD) is trying to be accessed. Whenever the page has an access attempt, the PAGE_GUARD flag is removed and the page can now be accessed like normal, in order to keep it on, inside our handler we have to set the page guard flag again every time. In order to invoke this exception simply put this use the PAGE_GUARD protection flag on the desired function then handle it in your handler and make sure to put it back since it's going to be removed.

#include <iostream>
#include <Windows.h>
#include <thread>

void print()
{
	std::cout << "hello!\n";
}

long __stdcall handler(EXCEPTION_POINTERS* exception)
{
	if (exception->ExceptionRecord->ExceptionCode == STATUS_GUARD_PAGE_VIOLATION && exception->ContextRecord->Eip == reinterpret_cast<std::uint32_t>(&Sleep))
	{
		exception->ContextRecord->Eip = reinterpret_cast<std::uint32_t>(&print);
		DWORD vp_old_protection{ 0 };
		VirtualProtect(&Sleep, 1, PAGE_EXECUTE_READ | PAGE_GUARD, &vp_old_protection);
		return EXCEPTION_CONTINUE_EXECUTION;
	}
	return EXCEPTION_CONTINUE_SEARCH;
}

void main_thread()
{
	AddVectoredExceptionHandler(true, &handler);
	DWORD vp_old_protection{ 0 };
	VirtualProtect(&Sleep, 1, PAGE_EXECUTE_READ | PAGE_GUARD, &vp_old_protection);
}

bool __stdcall DllMain(HMODULE dll_module, const std::uint32_t reason_for_call, void* reserved)
{
	if (reason_for_call == DLL_PROCESS_ATTACH)
	{
		std::thread{ main_thread }.detach();
	}
	return true;
}

Thanks for reading! I'll probably soon release exception handler hooking except it hooks every instruction. 

If you have suggestions for things to show let me know! my discord is: expression#9999