|
Programs often use this type of protection to make it difficult to trace the execution of the program
When an application runs into an exception while its debugged, the debugger will halt (pause).
EXE packers use this to see if the program handles the exception or (if its being debugged) not.
This is done by setting up what it called a Structured Exception Handler (SEH) it is usually set up right before an exception.
The program pushes the "handler" this is where execution will continue at if the program handles it own exceptions.
By pressing SHIFT + F9 you pass the exception to the application and allow it to continue as it normally would even if it weren't debugged.
These exception occur even if the program isn't being debugged, you just don't see them because they are automtically handled by the program.
If you just press F9, F7, F8...etc the program detects that execution did not continue as it should have and terminates itself, or windows terminates it because the exception was not handled.
Some Reading Material:
hxxp://msdn.microsoft.com/library/en-us/ debug/base/structured_exception_handling.asp
Did I explain what you wanted to know?
__________________
Even as darkness envelops and consumes us, wrapping around our personal worlds like the hand that grips around our necks and suffocates us, we must realize that life really is beautiful and the shadows of despair will scurry away like the fleeting roaches before the light.
|