Windows Security:The gradual improvement of SEH mechanism

XU You-fu,ZHANG Jin-han,WEN Wei-ping
DOI: https://doi.org/10.3969/j.issn.1671-1122.2009.05.019
2009-01-01
Abstract:SEH(Structured Exception Handling) , a mechanism which is provided by Windows operating system to handle errors or exceptions. However, because of the limitations in SEH 's design, the attacker can make use of SEH exception handling chain to sucessfully attack the system when there is a buffer overflow bug. Therefore, changes of SEH implementation mechanism were made in accordance with different versions of Microsoft Windows operating system. As a result, two improved mechanisms-SafeSEH and SEHOP appeared. Nevertheless, different degrees of defects still exist in these improved mechanisms. This paper provides a profound research on the implementation of and security defects in different versions of the SEH mechanisms through technologies afforded by Microsoft, such as GS, ASLR. Also provided are some improvement advices of the corresponding security defects.
What problem does this paper attempt to address?