[MISC] Vectored Exception Handler Instruction Hooking

Today I'll be teaching you how to use vectored exception handlers to hook all instructions to be executed within your own program. This can easily be implemented into a dll but I'll be basing this off a repository I have in github:

https://github.com/expressiongz/vectored-exception-handler-instruction-hook

In order to understand this properly, you should read my last post about vectored exception handler hooks (https://wearedevs.net/forum/t/27290)

where I explain what they are and how to use them and two popular methods of hooking with them.

#include <iostream>
#include <Windows.h>

long __stdcall handler(EXCEPTION_POINTERS* exception) {

    if (exception->ExceptionRecord->ExceptionCode == STATUS_GUARD_PAGE_VIOLATION) {
        std::cout << "[stepper] Triggered page fault. Enabled single step\n";
        exception->ContextRecord->EFlags |= 0x100;
        return EXCEPTION_CONTINUE_EXECUTION;
    }

	if (exception->ExceptionRecord->ExceptionCode == STATUS_SINGLE_STEP) {
        std::printf("[stepper] Hooked instruction -> 0x%p\n", exception->ExceptionRecord->ExceptionAddress);
        exception->ContextRecord->EFlags |= 0x100;
        return EXCEPTION_CONTINUE_EXECUTION;
    }
    return EXCEPTION_CONTINUE_SEARCH;
}

int main() {
    AddVectoredExceptionHandler(true, &handler);
    DWORD vp_old_protection{ 0 };
    VirtualProtect(&printf, 1, PAGE_EXECUTE_READ | PAGE_GUARD, &vp_old_protection);
    std::cout << "ty kind virtualprotect";
    return 0;
}

This hook makes use of the STATUS_GUARD_PAGE_VIOLATION exception we previously mentioned, it works by enabling single step mode which just means only one instruction will be executed and then it will invoke the STATUS_SINGLE_STEP exception, like PAGE_GUARD single step mode is removed after a instruction is executed, so we need to repeatedly set it.

I havent explained much of the code because in my previous post I have already explained how these types of hooks work.