有没有办法在 Hex-Rays 反编译器输出中显示异常处理程序?

逆向工程 艾达 六线谱 反编译器 例外
2021-06-27 04:28:22

有没有办法在反编译代码中显示这些异常处理程序?

在此处输入图片说明

如果__try不查看反汇编,我无法判断一个块在一个块中。

__int64 __fastcall NtDCompositionGetBatchId(int a1, unsigned int a2, _DWORD *a3)
{
  _DWORD *v3; // r14
  __int64 v4; // r8
  int v5; // er13
  __int64 v6; // rcx
  _DWORD *v7; // rdx
  _DWORD *v8; // rdi
  signed int v9; // esi
  __int64 v10; // rbx
  __int64 *v11; // r15
  __int64 v12; // rax
  struct _ERESOURCE *v13; // rbx
  __int64 v14; // rcx
  __int64 v15; // rax
  struct _ERESOURCE *v16; // rdi
  int v17; // er12
  __int64 v19; // [rsp+38h] [rbp-50h]
  int v20; // [rsp+44h] [rbp-44h]
  unsigned int v21; // [rsp+98h] [rbp+10h]

  v21 = a2;
  v3 = a3;
  v4 = a2;
  v5 = a1;
  if ( !v3 )
    return (unsigned int)-1073741811;
  v6 = *(_QWORD *)MmUserProbeAddress;
  v7 = v3;
  if ( (unsigned __int64)v3 >= *(_QWORD *)MmUserProbeAddress )
    v7 = *(_DWORD **)MmUserProbeAddress;
  *v7 = *v7;
  v8 = 0i64;
  v9 = 0;
  v10 = 0i64;
  v11 = 0i64;
  v12 = PsGetCurrentProcessWin32Process(v6, v7, v4);
  if ( v12 )
    v11 = *(__int64 **)(v12 + 256);
  if ( v11 )
  {
    v13 = (struct _ERESOURCE *)v11[1];
    KeEnterCriticalRegion();
    ExAcquireResourceExclusiveLite(v13, 1u);
    v14 = *v11;
    v10 = 0i64;
    LODWORD(v19) = v5;
    *(__int64 *)((char *)&v19 + 4) = 0i64;
    v20 = 0;
    v15 = RtlLookupElementGenericTable(v14, &v19);
    if ( v15 )
      v10 = *(_QWORD *)(v15 + 8);
    if ( v10 )
    {
      _InterlockedIncrement((volatile signed __int32 *)(v10 + 8));
      v8 = 0i64;
    }
    else
    {
      v9 = -1073741790;
    }
    ExReleaseResourceLite((PERESOURCE)v11[1]);
    KeLeaveCriticalRegion();
  }
  else
  {
    v9 = -1073741823;
  }
  if ( v10 )
  {
    v16 = *(struct _ERESOURCE **)(v10 + 32);
    KeEnterCriticalRegion();
    ExAcquireResourceExclusiveLite(v16, 1u);
    v8 = (_DWORD *)v10;
  }
  if ( v9 >= 0 )
  {
    if ( (*(unsigned int (__fastcall **)(_DWORD *))(*(_QWORD *)v8 + 8i64))(v8) == 1 )
      goto LABEL_16;
    v9 = -1073741811;
    (**(void (__fastcall ***)(_DWORD *))v8)(v8);
  }
  v8 = 0i64;
LABEL_16:
  if ( v9 >= 0 )
  {
    if ( v21 == 2 )
    {
      v17 = v8[96];
    }
    else if ( v21 )
    {
      if ( v21 == 1 )
        v17 = v8[95];
      else
        v17 = 0;
    }
    else
    {
      v17 = v8[94];
    }
    (**(void (__fastcall ***)(_DWORD *))v8)(v8);
    if ( v9 >= 0 )
      *v3 = v17;
  }
  return (unsigned int)v9;
}
1个回答

Hex-Rays 反编译器不支持反编译异常处理代码:

以下是我们的反编译器(所有处理器)最重要的限制:

  • 不支持异常处理
  • 不执行类型恢复
  • 不执行全局程序分析

(从 7.3.181105 版本开始)