C++ EH Exception（0xe06d7363）---捕获过程

书接上文《C++ EH Exception（0xe06d7363）----抛出过程》，下面我们讲下，VC++是如何catch到异常且处理的。

我们知道，在VC++里，C++异常实现的底层机制还是SEH,所以，我们将程序跑起来观察

上图红框框起来的部分就是编译器安装了异常处理链，且将其设置位最后一个节点，也就如下结构

struct VC_EXCEPTION_REGISTRATION
{
     VC_EXCEPTION_REGISTRATION* prev;    //前一个结构体的指针
     FARPROC                    handler; //永远指向_exception_handler4回调函数
     scopetable_entry*          scopetable;//指向scpoetable数组的指针
     int                        _index; //有的书上也叫tryLevel。scopetable项的当前项
     DWORD                      _ebp;   //当前ebp值，用于访问各成员
}

那我们就知道，编译器通过push        0C852F8h 给我们注册了异常处理回调，我们看看 0C852F8处是个什么东西

可以看到，0x0C852F8处是函数__ehhandler$_main，那么__ehhandler$_main干了些什么呢：

首先，是将FuncInfo信息提指针赋值给eax，这个结构如下

这个结构表示的是当前处于的函数的信息，收集发生异常时必须要完成的操作的所有信息。异常处理从funcinfo结构里知道了catchblock的参数，也就是catch块的地址。对于每个函数，VC还收集一份它里面的try语句的位置信息，catch语句能catch住的object type信息，以及每个可能发生异常的情况下要完成的object destructor调用的信息。这些信息构成了function info。

然后jmp 到___CxxFrameHandler3 函数，这个函数如下：

extern "C" _CRTIMP __declspec(naked) EXCEPTION_DISPOSITION __cdecl __CxxFrameHandler3(
/*
    EAX=FuncInfo   *pFuncInfo,          // Static information for this frame
*/
    EHExceptionRecord  *pExcept,        // Information for this exception
    EHRegistrationNode *pRN,            // Dynamic information for this frame
    void               *pContext,       // Context info (we don't care what's in it)
    DispatcherContext  *pDC             // More dynamic info for this frame (ignored on Intel)
) {
    FuncInfo   *pFuncInfo;
    EXCEPTION_DISPOSITION result;

    __asm {
        //
        // Standard function prolog
        //
        push    ebp
        mov     ebp, esp
        sub     esp, __LOCAL_SIZE
        push    ebx
        push    esi
        push    edi
        cld             // A bit of paranoia -- Our code-gen assumes this

        //
        // Save the extra parameter
        //
        mov     pFuncInfo, eax
        }

    EHTRACE_ENTER_FMT1("pRN = 0x%p", pRN);

    result = __InternalCxxFrameHandler( pExcept, pRN, pContext, pDC, pFuncInfo, 0, NULL, FALSE );

    EHTRACE_HANDLER_EXIT(result);

    __asm {
        pop     edi
        pop     esi
        pop     ebx
        mov     eax, result
        mov     esp, ebp
        pop     ebp
        ret     0
        }
}

在这个函数里，通过mov pFuncInfo, eax将funcinfo赋值给本地变量pFuncInfo，传递给__InternalCxxFrameHandler函数。

函数__InternalCxxFrameHandler的代码如下

extern "C" EXCEPTION_DISPOSITION __cdecl __InternalCxxFrameHandler(
    EHExceptionRecord  *pExcept,        // Information for this exception
    EHRegistrationNode *pRN,            // Dynamic information for this frame
    CONTEXT *pContext,                  // Context info
    DispatcherContext *pDC,             // Context within subject frame
    FuncInfo *pFuncInfo,                // Static information for this frame
    int CatchDepth,                     // How deeply nested are we?
    EHRegistrationNode *pMarkerRN,      // Marker node for when checking inside
                                        //  catch block
    BOOLEAN recursive                   // Are we handling a translation?
) {
    EHTRACE_ENTER_FMT2("%s, pRN = 0x%p",
                       IS_UNWINDING(PER_FLAGS(pExcept)) ? "Unwinding" : "Searching",
                       pRN);

    if ((cxxReThrow == false) && (PER_CODE(pExcept) != EH_EXCEPTION_NUMBER) &&
#if defined(_M_X64) || defined(_M_ARM) /*IFSTRIP=IGN*/
        /* On the 64 bit/ARM platforms, ExceptionCode maybe set to STATUS_UNWIND_CONSOLIDATE
            when called from _UnwindNestedFrames during Logical Unwind. _UnwindNestedFrames
            will also set EH_MAGIC_NUMBER1 in the 8 element */
        (!((PER_CODE(pExcept) == STATUS_UNWIND_CONSOLIDATE) && (PER_NPARAMS(pExcept) == 15) && (PER_EXCEPTINFO(pExcept)[8] == EH_MAGIC_NUMBER1))) &&
#endif
        (PER_CODE(pExcept) != STATUS_LONGJUMP) &&
        (FUNC_MAGICNUM(*pFuncInfo) >= EH_MAGIC_NUMBER3) &&
        ((FUNC_FLAGS(*pFuncInfo) & FI_EHS_FLAG) != 0))
    {
        /*
         * This function was compiled /EHs so we don't need to do anything in
         * this handler.
         */
        return ExceptionContinueSearch;
    }

    if (IS_UNWINDING(PER_FLAGS(pExcept)))
    {
        // We're at the unwinding stage of things.  Don't care about the
        // exception itself.  (Check this first because it's easier)

        if (FUNC_MAXSTATE(*pFuncInfo) != 0 && CatchDepth == 0)
        {
            // Only unwind if there's something to unwind
            // AND we're being called through the primary RN.

#if defined(_M_X64) || defined(_M_ARM) /*IFSTRIP=IGN*/

            if (IS_TARGET_UNWIND(PER_FLAGS(pExcept)) && PER_CODE(pExcept) == STATUS_LONGJUMP) {
                    __ehstate_t target_state = __StateFromIp(pFuncInfo,
                                                             pDC,
#if defined(_M_X64)
                                                             pContext->Rip
#elif defined(_M_ARM)
                                                             pContext->Pc
#endif
                                                             );

                    DASSERT(target_state >= EH_EMPTY_STATE
                            && target_state < FUNC_MAXSTATE(*pFuncInfo));

                    __FrameUnwindToState(pRN, pDC, pFuncInfo, target_state);
                    EHTRACE_HANDLER_EXIT(ExceptionContinueSearch);
                    return ExceptionContinueSearch;
            } else if(IS_TARGET_UNWIND(PER_FLAGS(pExcept)) &&
                      PER_CODE(pExcept) == STATUS_UNWIND_CONSOLIDATE)
            {
                PEXCEPTION_RECORD pSehExcept = (PEXCEPTION_RECORD)pExcept;
                __ehstate_t target_state = (__ehstate_t)pSehExcept->ExceptionInformation[3];

                DASSERT(target_state >= EH_EMPTY_STATE
                        && target_state < FUNC_MAXSTATE(*pFuncInfo));
                __FrameUnwindToState((EHRegistrationNode *)pSehExcept->ExceptionInformation[1],
                                     pDC,
                                     pFuncInfo,
                                     target_state);
                EHTRACE_HANDLER_EXIT(ExceptionContinueSearch);
                return ExceptionContinueSearch;
            }
#endif // defined(_M_X64) || defined(_M_ARM)
            __FrameUnwindToEmptyState(pRN, pDC, pFuncInfo);
        }
        EHTRACE_HANDLER_EXIT(ExceptionContinueSearch);
        return ExceptionContinueSearch;     // I don't think this value matters

    } else if (FUNC_NTRYBLOCKS(*pFuncInfo) != 0
        //
        // If the function has no try block, we still want to call the
        // frame handler if there is an exception specification
        //
        || (FUNC_MAGICNUM(*pFuncInfo) >= EH_MAGIC_NUMBER2 && FUNC_PESTYPES(pFuncInfo) != NULL)) {

        // NT is looking for handlers.  We've got handlers.
        // Let's check this puppy out.  Do we recognize it?

        int (__cdecl *pfn)(...);

        if (PER_CODE(pExcept) == EH_EXCEPTION_NUMBER
          && PER_NPARAMS(pExcept) >= 3
          && PER_MAGICNUM(pExcept) > EH_MAGIC_NUMBER3
          && (pfn = THROW_FORWARDCOMPAT(*PER_PTHROW(pExcept))) != NULL) {

            // Forward compatibility:  The thrown object appears to have been
            // created by a newer version of our compiler.  Let that version's
            // frame handler do the work (if one was specified).

#if defined(_DEBUG) || defined(_SYSCRT_DEBUG)
            if (_ValidateExecute((FARPROC)pfn)) {
#endif
                EXCEPTION_DISPOSITION result =
                    (EXCEPTION_DISPOSITION)pfn(pExcept, pRN, pContext, pDC,
                                               pFuncInfo, CatchDepth,
                                               pMarkerRN, recursive);
                EHTRACE_HANDLER_EXIT(result);
                return result;
#if defined(_DEBUG) || defined(_SYSCRT_DEBUG)
            } else {
                _inconsistency(); // Does not return; TKB
            }
#endif

        } else {

            // Anything else: we'll handle it here.
            FindHandler(pExcept, pRN, pContext, pDC, pFuncInfo, recursive,
              CatchDepth, pMarkerRN);
        }

        // If it returned, we didn't have any matches.

        } // NT was looking for a handler

    // We had nothing to do with it or it was rethrown.  Keep searching.
    EHTRACE_HANDLER_EXIT(ExceptionContinueSearch);
    return ExceptionContinueSearch;

} // InternalCxxFrameHandler

而__InternalCxxFrameHandler里调用FindHandler来寻找最终的catch块，FindHandler函数代码如下：

static void FindHandler(
    EHExceptionRecord *pExcept,         // Information for this (logical)
                                        //   exception
    EHRegistrationNode *pRN,            // Dynamic information for subject frame
    CONTEXT *pContext,                  // Context info
    DispatcherContext *pDC,             // Context within subject frame
    FuncInfo *pFuncInfo,                // Static information for subject frame
    BOOLEAN recursive,                  // TRUE if we're handling the
                                        //   translation
    int CatchDepth,                     // Level of nested catch that is being
                                        //   checked
    EHRegistrationNode *pMarkerRN       // Extra marker RN for nested catch
                                        //   handling
)
{
    EHTRACE_ENTER;

    BOOLEAN IsRethrow = FALSE;
    BOOLEAN gotMatch = FALSE;

    // Get the current state (machine-dependent)
#if defined(_M_X64) || defined(_M_ARM_NT) /*IFSTRIP=IGN*/
    __ehstate_t curState = __StateFromControlPc(pFuncInfo, pDC);
    EHRegistrationNode EstablisherFrame;
    /*
     * Here We find what is the actual State of current function. The way we
     * do this is first get State from ControlPc.
     *
     * Remember we have __GetUnwindTryBlock to remember the last State for which
     * Exception was handled and __GetCurrentState for retriving the current
     * state of the function. Please Note that __GetCurrentState is used
     * primarily for unwinding purpose.
     *
     * Also remember that all the catch blocks act as funclets. This means that
     * ControlPc for all the catch blocks are different from ControlPc of parent
     * catch block or function.
     *
     * take a look at this example
     * try {
     *   // STATE1 = 1
     *   try {
     *     // STATE2
     *     // THROW
     *   } catch (...) { // CatchB1
     *     // STATE3
     *     // RETHROW OR NEW THROW
     *   }
     * } catch (...) { // CatchB2
     * }
     *
     * If we have an exception comming from STATE3, the FindHandler will be
     * called for CatchB1, at this point we do the test which State is our
     * real state, curState from ControlPc or state from __GetUnwindTryBlock.
     * Since curState from ControlPc is greater, we know that real State is
     * curState from ControlPc and thus we update the UnwindTryBlockState.
     *
     * On further examination, we found out that there is no handler within
     * this catch block, we return without handling the exception. For more
     * info on how we determine if we have handler, have a look at
     * __GetRangeOfTrysToCheck.
     *
     * Now FindHandler will again be called for parent function. Here again
     * we test which is real State, state from ControlPc or State from
     * __GetUnwindTryBlock. This time state from __GetUnwindTryBlock is correct.
     *
     * Also look at code in __CxxCallCatchBlock, you will se that as soon as we get
     * out of last catch block, we reset __GetUnwindTryBlock state to -1.
     */

    _GetEstablisherFrame(pRN, pDC, pFuncInfo, &EstablisherFrame);
    if (curState > __GetUnwindTryBlock(pRN, pDC, pFuncInfo)) {
        __SetState(&EstablisherFrame, pDC, pFuncInfo, curState);
        __SetUnwindTryBlock(pRN, pDC, pFuncInfo, /*curTry*/ curState);
    } else {
        curState = __GetUnwindTryBlock(pRN, pDC, pFuncInfo);
    }
#else
    __ehstate_t curState = GetCurrentState(pRN, pDC, pFuncInfo);
#endif
    DASSERT(curState >= EH_EMPTY_STATE && curState < FUNC_MAXSTATE(*pFuncInfo));

    // Check if it's a re-throw.  Use the exception we stashed away if it is.
    if (PER_IS_MSVC_EH(pExcept) && PER_PTHROW(pExcept) == NULL) {

        if (_pCurrentException == NULL) {
            // Oops!  User re-threw a non-existant exception!  Let it propogate.
            EHTRACE_EXIT;
            return;
        }

        pExcept = _pCurrentException;
        pContext = _pCurrentExContext;
        IsRethrow = TRUE;
#if _EH_RELATIVE_OFFSETS /*IFSTRIP=IGN*/
        _SetThrowImageBase((ptrdiff_t)pExcept->params.pThrowImageBase);
#endif

        DASSERT(_ValidateRead(pExcept));
        DASSERT(!PER_IS_MSVC_EH(pExcept) || PER_PTHROW(pExcept) != NULL);

        //
        // We know it is a rethrow -- did we come here as a result of an
        // exception re-thrown from CallUnexpected() ?
        //
        if( _pCurrentFuncInfo != NULL )
        {
            ESTypeList* pCurrentFuncInfo = _pCurrentFuncInfo;   // remember it in a local variable
            _pCurrentFuncInfo = NULL;   // and reset it immediately -- so we don't forget to do it later

            // Does the exception thrown by CallUnexpected belong to the exception specification?

            if( IsInExceptionSpec(pExcept, pCurrentFuncInfo) )
            {
                // Yes it does -- so "continue the search for another handler at the call of the function
                // whose exception-specification was violated"
                ;
            }
            else
            {
                // Nope, it does not. Is std::bad_exception allowed by the spec?

                if( Is_bad_exception_allowed(pCurrentFuncInfo) )
                {
                    // yup -- so according to the standard, we need to replace the thrown
                    // exception by an implementation-defined object of the type std::bad_exception
                    // and continue the search for another handler at the call of the function
                    // whose exception-specification was violated.

                    // Just throw bad_exception -- we will then come into FindHandler for the third time --
                    // but make sure we will not get here again

                    __DestructExceptionObject(pExcept, TRUE);   // destroy the original object

                    throw std::bad_exception();
                }
                else
                {
                    terminate();
                }
            }
        }
    }

    if (PER_IS_MSVC_EH(pExcept)) {
        // Looks like it's ours.  Let's see if we have a match:
        //
        // First, determine range of try blocks to consider:
        // Only try blocks which are at the current catch depth are of interest.

        unsigned curTry;
        unsigned end;

        if( FUNC_NTRYBLOCKS(*pFuncInfo) > 0 )
        {
            TryBlockMapEntry *pEntry = __GetRangeOfTrysToCheck(pRN,
                                                            pFuncInfo,
                                                            CatchDepth,
                                                            curState,
                                                            &curTry,
                                                            &end,
                                                            pDC);

            // Scan the try blocks in the function:
            for (; curTry < end; curTry++, pEntry++) {
                HandlerType *pCatch;
#if _EH_RELATIVE_OFFSETS
                __int32 const *ppCatchable;
#else
                CatchableType * const *ppCatchable;
#endif
                CatchableType *pCatchable;
                int catches;
                int catchables;

                if (TBME_LOW(*pEntry) > curState || curState > TBME_HIGH(*pEntry)) {
                    continue;
                }

                // Try block was in scope for current state.  Scan catches for this
                // try:
                pCatch  = TBME_PCATCH(*pEntry, 0);
                for (catches = TBME_NCATCHES(*pEntry); catches > 0; catches--,
                pCatch++) {

                    // Scan all types that thrown object can be converted to:
                    ppCatchable = THROW_CTLIST(*PER_PTHROW(pExcept));
                    for (catchables = THROW_COUNT(*PER_PTHROW(pExcept));
                    catchables > 0; catchables--, ppCatchable++) {

#if _EH_RELATIVE_OFFSETS
                        pCatchable = (CatchableType *)(_GetThrowImageBase() + *ppCatchable);
#else
                        pCatchable = *ppCatchable;
#endif

                        if (!__TypeMatch(pCatch, pCatchable, PER_PTHROW(pExcept))) {
                            continue;
                        }

                        // OK.  We finally found a match.  Activate the catch.  If
                        // control gets back here, the catch did a re-throw, so
                        // keep searching.

                        gotMatch = TRUE;

                        CatchIt(pExcept,
                                pRN,
                                pContext,
                                pDC,
                                pFuncInfo,
                                pCatch,
                                pCatchable,
                                pEntry,
                                CatchDepth,
                                pMarkerRN,
                                IsRethrow
#if defined (_M_X64) || defined(_M_ARM_NT)
                                , recursive
#endif
                                );
                        goto NextTryBlock;

                    } // Scan posible conversions
                } // Scan catch clauses
    NextTryBlock: ;
            } // Scan try blocks
        } // if FUNC_NTRYBLOCKS( pFuncInfo ) > 0
#if defined(_DEBUG) || defined(_SYSCRT_DEBUG)
        else
        {
            //
            // This can only happen if the function has an exception specification
            // but no try/catch blocks
            //
            DASSERT( FUNC_MAGICNUM(*pFuncInfo) >= EH_MAGIC_NUMBER2 );
            DASSERT( FUNC_PESTYPES(pFuncInfo) != NULL );
        }
#endif

#if defined(_M_IX86)
        if (recursive) {
            //
            // A translation was provided, but this frame didn't catch it.
            // Destruct the translated object before returning; if destruction
            // raises an exception, terminate.
            //
            // This is not done for Win64 platforms.  On those, the translated
            // object is destructed in __CxxCallCatchBlock.
            //
            __DestructExceptionObject(pExcept, TRUE);
        }
#endif

#if (!defined(_M_ARM) || defined(_M_ARM_NT))
        //
        // We haven't found the match -- let's look at the exception spec and see if our try
        // matches one of the listed types.
        //
        if( !gotMatch && FUNC_MAGICNUM(*pFuncInfo) >= EH_MAGIC_HAS_ES && FUNC_PESTYPES(pFuncInfo) != NULL )
        {
            if( !IsInExceptionSpec(pExcept, FUNC_PESTYPES(pFuncInfo)) )
            {
                // Nope, it does not. Call unexpected

                //
                // We must unwind the stack before calling unexpected -- this makes it work
                // as if it were inside catch(...) clause
                //
#if defined (_M_X64) || defined(_M_ARM_NT) /*IFSTRIP=IGN*/
                EHRegistrationNode *pEstablisher = pRN;
                EHRegistrationNode EstablisherFramePointers;
                pEstablisher = _GetEstablisherFrame(pRN, pDC, pFuncInfo, &EstablisherFramePointers);
                PVOID pExceptionObjectDestroyed = NULL;
                _UnwindNestedFrames(pRN,
                                    pExcept,
                                    pContext,
                                    pEstablisher,
                                    NULL,
                                    -1,
                                    pFuncInfo,
                                    pDC,
                                    recursive
                                    );
#else
                EHExceptionRecord *pSaveException = _pCurrentException;
                CONTEXT *pSaveExContext = _pCurrentExContext;

                _pCurrentException = pExcept;
                _pCurrentExContext = pContext;

                if (pMarkerRN == NULL) {
                    _UnwindNestedFrames(pRN, pExcept);
                } else {
                    _UnwindNestedFrames(pMarkerRN, pExcept);
                }
                __FrameUnwindToEmptyState(pRN, pDC, pFuncInfo);

                CallUnexpected(FUNC_PESTYPES(pFuncInfo));
                _pCurrentException = pExcept;
                _pCurrentExContext = pContext;
#endif
            }
        }
#endif // !defined(_M_ARM)

    } // It was a C++ EH exception
    else {
        // Not ours.  But maybe someone told us how to make it ours.
        if( FUNC_NTRYBLOCKS(*pFuncInfo) > 0 ) {
            if (!recursive) {
                FindHandlerForForeignException(pExcept, pRN, pContext, pDC,
                pFuncInfo, curState, CatchDepth, pMarkerRN);
            } else {
                // We're recursive, and the exception wasn't a C++ EH!
                // Translator threw something uninteligable.

                // Two choices here: we could let the new exception take over, or we could abort. We abort.
                terminate();
            }
        }
    } // It wasn't our exception

    DASSERT( _pCurrentFuncInfo == NULL );   // never leave it initialized with something

    EHTRACE_EXIT;
}

在FindHandler函数里找到合适的catch块后，就调用CatchIt函数，代码如下：

////////////////////////////////////////////////////////////////////////////////
//
// CatchIt - A handler has been found for the thrown type.  Do the work to
//   transfer control.
//
// Description:
//     Builds the catch object
//     Unwinds the stack to the point of the try
//     Calls the address of the handler (funclet) with the frame set up for that
//       function but without resetting the stack.
//     Handler funclet returns address to continue execution, or NULL if the
//       handler re-threw ("throw;" lexically in handler)
//     If the handler throws an EH exception whose exception info is NULL, then
//       it's a re-throw from a dynamicly enclosed scope.
//
// It is an open question whether the catch object is built before or after the local unwind.
//
// Returns:
//     No return value.  Returns iff handler re-throws.
static void CatchIt(
    EHExceptionRecord *pExcept,         // The exception thrown
    EHRegistrationNode *pRN,            // Dynamic info of function with catch
    CONTEXT *pContext,                  // Context info
    DispatcherContext *pDC,             // Context within subject frame
    FuncInfo *pFuncInfo,                // Static info of function with catch
    HandlerType *pCatch,                // The catch clause selected
    CatchableType *pConv,               // The rules for making the conversion
    TryBlockMapEntry *pEntry,           // Description of the try block
    int CatchDepth,                     // How many catches are we nested in?
    EHRegistrationNode *pMarkerRN,      // Special node if nested in catch
    BOOLEAN IsRethrow                   // Is this a rethrow ?
#if defined(_M_X64) || defined(_M_ARM_NT) /*IFSTRIP=IGN*/
    , BOOLEAN recursive
#endif // defined(_POWERPC)
) {
    EHTRACE_ENTER_FMT1("Catching object @ 0x%p", PER_PEXCEPTOBJ(pExcept));

    EHRegistrationNode *pEstablisher = pRN;

#if defined(_M_X64) || defined(_M_ARM)  /*IFSTRIP=IGN*/
    EHRegistrationNode EstablisherFramePointers;
    pEstablisher = _GetEstablisherFrame(pRN, pDC, pFuncInfo, &EstablisherFramePointers);
#else
    void *continuationAddress;
#endif // defined(_POWERPC)

    // Copy the thrown object into a buffer in the handler's stack frame,
    // unless the catch was by elipsis (no conversion) OR the catch was by
    // type without an actual 'catch object'.

    if (pConv != NULL) {
        __BuildCatchObject(pExcept, pEstablisher, pCatch, pConv);
    }

    // Unwind stack objects to the entry of the try that caught this exception.

#if defined(_M_X64) || defined(_M_ARM)  /*IFSTRIP=IGN*/
    // This call will never return. This call will end up calling CxxCallCatchBlock
    // through RtlUnwind (STATUS_CONSULIDATE_FRAMES) mechanism.
    _UnwindNestedFrames(pRN,
                        pExcept,
                        pContext,
                        pEstablisher,
                        __GetAddress(HT_HANDLER(*pCatch), pDC),
                        TBME_LOW(*pEntry),
                        pFuncInfo,
                        pDC,
#if defined(_M_ARM) && !defined(_M_ARM_NT)
                        FALSE
#else
                        recursive
#endif
                        );
#else

    if (pMarkerRN == NULL) {
        _UnwindNestedFrames(pRN, pExcept);
    } else {
        _UnwindNestedFrames(pMarkerRN, pExcept);
    }


    __FrameUnwindToState(pEstablisher, pDC, pFuncInfo, TBME_LOW(*pEntry));

    // Call the catch.  Separated out because it introduces a new registration
    // node.

    EHTRACE_FMT2("Move from state %d to state %d", __GetUnwindState(pRN, pDC, pFuncInfo), TBME_HIGH(*pEntry) + 1);
    SetState(pRN, pDC, pFuncInfo, TBME_HIGH(*pEntry) + 1);

    continuationAddress = CallCatchBlock(pExcept,
                                         pEstablisher,
                                         pContext,
                                         pFuncInfo,
                                         __GetAddress(HT_HANDLER(*pCatch), pDC),
                                         CatchDepth,
                                         0x100);

    // Transfer control to the continuation address.  If no continuation then
    // it's a re-throw, so return.

    if (continuationAddress != NULL) {

        _JumpToContinuation(continuationAddress, pRN);
        // No return.

    }
    EHTRACE_EXIT;
#endif
}

在CatchIt函数里调用了CallCatchBlock函数，代码如下：

////////////////////////////////////////////////////////////////////////////////
//
// CallCatchBlock - continuation of CatchIt.
//
// This is seperated from CatchIt because it needs to introduce an SEH/EH frame
//   in case the catch block throws.  This frame cannot be added until unwind of
//   nested frames has been completed (otherwise this frame would be the first
//   to go).

static void *CallCatchBlock(
    EHExceptionRecord *pExcept,         // The exception thrown
    EHRegistrationNode *pRN,            // Dynamic info of function with catch
    CONTEXT *pContext,                  // Context info
    FuncInfo *pFuncInfo,                // Static info of function with catch
    void *handlerAddress,               // Code address of handler
    int CatchDepth,                     // How deeply nested in catch blocks
                                        //   are we?
    unsigned long NLGCode               // NLG destination code
) {
    EHTRACE_ENTER;

    // Address where execution resumes after exception handling completed.
    // Initialized to non-NULL (value doesn't matter) to distinguish from
    // re-throw in __finally.
    void *continuationAddress = handlerAddress;

    BOOL ExceptionObjectDestroyed = FALSE;

    // The stack pointer at entry to the try must be saved, in case there is
    // another try inside this catch.  We'll restore it on our way out.
    void *saveESP = PRN_STACK(pRN);

    // Push this catch block's frame info on a linked list
    FRAMEINFO FrameInfo;
    FRAMEINFO *pFrameInfo = _CreateFrameInfo(&FrameInfo, PER_PEXCEPTOBJ(pExcept));

    // Save the current exception in case of a rethrow.  Save the previous value
    // on the stack, to be restored when the catch exits.
    EHExceptionRecord *pSaveException = _pCurrentException;
    CONTEXT *pSaveExContext = _pCurrentExContext;

    _pCurrentException = pExcept;
    _pCurrentExContext = pContext;

    __try {
        __try {
            // Execute the handler as a funclet, whose return value is the
            // address to resume execution.

            continuationAddress = _CallCatchBlock2(pRN, pFuncInfo,
              handlerAddress, CatchDepth, NLGCode);
        } __except(EHTRACE_EXCEPT(ExFilterRethrow(exception_info()))) {
            cxxReThrow=false;
            // Here we are exiting the catch block on rethrow out of this
            // catch block. To keep the order of destruction and construction
            // same when the the rethrow was from function or was inline, here
            // we unwind to the parent state for this catch.
            UnwindMapEntry *pUnwindMap = pFuncInfo->pUnwindMap;
            int cState = GetCurrentState(pRN, handlerAddress, pFuncInfo);
            TryBlockMapEntry *pTryBlockMap = pFuncInfo->pTryBlockMap;
            unsigned int i;
            for (i = 0; i < pFuncInfo->nTryBlocks; i++) {
                if (cState > pTryBlockMap[i].tryHigh &&
                    cState <= pTryBlockMap[i].catchHigh) {
                    cState = pTryBlockMap[i].tryHigh +1;
                    cState = pUnwindMap[cState].toState;
                    break;
                }
            }
            __FrameUnwindToState(pRN, NULL, pFuncInfo, cState);
            // If the handler threw a typed exception without exception info or
            // exception object, then it's a re-throw, so return.  Otherwise
            // it's a new exception, which takes precedence over this one.
            continuationAddress = NULL;
        }
    } __finally {
        EHTRACE_SAVE_LEVEL;
        EHTRACE_FMT1("Executing __finally, %snormal termination", _abnormal_termination() ? "ab" : "");

        // Restore the saved stack pointer, so the stack can be reset when
        // we're done.
        PRN_STACK(pRN) = saveESP;

        // Pop this catch block's frame info
        _FindAndUnlinkFrame(pFrameInfo);

        // Restore the 'current exception' for a possibly enclosing catch
        _pCurrentException = pSaveException;
        _pCurrentExContext = pSaveExContext;

        // Destroy the original exception object if we're not exiting on a
        // re-throw and the object isn't also in use by a more deeply nested
        // catch.  Note that the catch handles destruction of its parameter.

        if (PER_IS_MSVC_EH(pExcept) && !ExceptionObjectDestroyed
          && continuationAddress != NULL
            && _IsExceptionObjectToBeDestroyed(PER_PEXCEPTOBJ(pExcept))
            ) {
            __DestructExceptionObject(pExcept, abnormal_termination());
        }

        EHTRACE_RESTORE_LEVEL(!!_abnormal_termination());
    }
    EHTRACE_EXIT;
    return continuationAddress;
}

在CallCatchBlock又调用_CallCatchBlock2函数，代码如下：

void *_CallCatchBlock2(
    EHRegistrationNode *pRN,            // Dynamic info of function with catch
    FuncInfo           *pFuncInfo,      // Static info of function with catch
    void               *handlerAddress, // Code address of handler
    int                CatchDepth,      // How deeply nested in catch blocks are we?
    unsigned long      NLGCode
) {
    EHTRACE_ENTER;

    //
    // First, create and link in our special guard node:
    //
    CatchGuardRN CGRN = { NULL,
                          (void*)CatchGuardHandler,
                          __security_cookie ^ (UINT_PTR)&CGRN,
                          pFuncInfo,
                          pRN,
                          CatchDepth + 1
#if defined(ENABLE_EHTRACE)
                          , __ehtrace_level
#endif
    };

    __asm {
        mov     eax, FS:[0]     // Fetch frame list head
        mov     CGRN.pNext, eax // Link this node in
        lea     eax, CGRN       // Put this node at the head
        mov     FS:[0], eax
        }

    //
    // Call the catch
    //
    void *continuationAddress = _CallSettingFrame( handlerAddress, pRN, NLGCode );

    //
    // Unlink our registration node
    //
    __asm {
        mov     eax, CGRN.pNext // Get parent node
        mov     FS:[0], eax     // Put it at the head
        }

    EHTRACE_EXIT;

    return continuationAddress;
    }

在_CallCatchBlock2函数调用_CallSettingFrame函数来实现代码如下

_CallSettingFrame proc stdcall, funclet:IWORD, pRN:IWORD, dwInCode:DWORD
    ; FPO = 0 dwords locals allocated in prolog
    ;       3 dword parameters
    ;       8 bytes in prolog
    ;       4 registers saved (includes locals to work around debugger bug)
    ;       1 EBP is used
    ;       0 frame type = FPO
    .FPO    (0,3,8,4,1,0)

    sub    esp,4
    push    ebx
    push    ecx
    mov    eax,pRN
    add    eax,0Ch            ; sizeof(EHRegistrationNode) -- assumed to equal 0Ch
    mov    dword ptr [ebp-4],eax
    mov    eax,funclet
    push    ebp            ; Save our frame pointer
        push    dwInCode
    mov    ecx,dwInCode
    mov    ebp,dword ptr [ebp-4]    ; Load target frame pointer
    call    _NLG_Notify1        ; Notify debugger
    push    esi
    push    edi
    call    eax            ; Call the funclet
_NLG_Return::
    pop    edi
    pop    esi
    mov    ebx,ebp
    pop    ebp
        mov     ecx,dwInCode
    push    ebp
    mov    ebp,ebx
    cmp    ecx, 0100h
    jne    _NLG_Continue
        mov     ecx, 02h
_NLG_Continue:
        push    ecx
    call    _NLG_Notify1        ; Notify debugger yet again
    pop    ebp            ; Restore our frame pointer
    pop    ecx
    pop    ebx
    ret    0Ch
_CallSettingFrame ENDP

    END

最终在_CallSettingFrame函数里通过 call eax 执行了catch块里的语句

 整个捕获过程的调用链如下：