Exceptional behavior: the Windows 8.1 X64 SEH Implementation
Summary: Cisco Talos published an analysis of how 64-bit Windows 8.1 implements Structured Exception Handling, which is not stack-based and instead relies on an Exception Directory, RUNTIME_FUNCTION and UNWIND_INFO structures, and a kernel-managed Frame Unwind. The write-up traces RtlDispatchException, RtlVirtualUnwind, the _C_specific_handler routine, and special cases including consolidation unwinds and collided unwinds, noting the kernel-mode implementation differs in three respects from user mode.
Key Takeaway: Because x64 exception handling moved off the stack, many classic SEH attacks no longer work against 64-bit binaries, and the researcher's stated goal was to correctly characterize strange behavior tied to Patchguard on Windows 8.1 - the same mechanism a rootkit had already disarmed on Windows 7.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026