How McSema Handles C++ Exceptions

Summary: Trail of Bits researchers describe how McSema, their binary lifter, recovers C++ exception-based control flow by parsing the exception table stored in the .eh_frame and .eh_framehdr sections, including the language-specific data area with its call site and action tables. The work required changes to control flow graph recovery, lifting, and runtime components, including a new --abi-libraries flag that lets lifted and native code share one stack so stack unwinding can work.
What's compelling: Exception information is spread across multiple tables and the operations that drive it - stack unwinding, personality function calls, exception table decoding - happen outside the compiled program's own code, which is why most binary analysis tools cannot follow it. For anyone lifting or analyzing compiled C++ for security review, that gap means throw and catch paths can go unseen.

Read the original at Trail of Bits Blog ↗