HITB 2011 CTF - Reversing Vectored Exception Handling (VEH)

Introduction

Today we will have a look at a CTF binary from HITB pre qualifications CTF 2011:

http://conference.hackinthebox.org/hitbsecconf2011ams/?p=1333

This is an interesting binary to reverse because Vectored Exception Handling (VEH) was used in the challenge. As this was new to me, I documented how it works and wanted to share a short reversing write-up of the binary.

You can download the binary (windows_challenge.exe) here

Thanks to skier_ and the HITB crew for generating such an awesome CTF binary.

Come along...........and enjoy!

Fancy

Note: I used windows XP SP3 so maybe the addresses here in this video may differ from the addresses on your box.

Video

Interesting links:

http://msdn.microsoft.com/en-us/magazine/cc301714.aspx
http://msdn.microsoft.com/en-us/library/ms681420%28v=vs.85%29.aspx
http://msdn.microsoft.com/en-us/library/ms679274%28v=vs.85%29.aspx

© Corelan Consulting BV. All rights reserved. ​The contents of this page may not be reproduced, redistributed, or republished, in whole or in part, for commercial or non-commercial purposes without prior written permission from Corelan Consulting bv. See our Terms of Use & Privacy Policy (https://www.corelan.be/index.php/legal) for more details.