I'm currently reversing file that is packed with PECompact packer. I'm interested in actual algorithm how it unpacks itself rather than having unpacked file.It uses SEH for modifying program flow. So I would like to ask about SEH.So what I have:So I add breakpoint at 0x4517E4 after I pass exception into app I go hereIt does some code modifications and returns 0 (ExceptionContinueExecution from EXCEPTION_DISPOSITION enum). It returns to kernel function, but where should execution be continued from, after it goes back into app? I have tried putting breakpoint at 0x401016 because it is a point where exception occurred and it stopped there, I would like to ask if this is just a coincidence, or it should work this way?I believe it is related to EXCEPTION_RECORD structure ExceptionAddress value. Am I right?So that I really want to know how exception handling determines point, from which program execution should be continued according to different return values from handler function.Also file I'm working on can be downloaded here
Reversing PECompact packed code (How SEH works)
exception;seh