From 75154bbf18d6fb8f58b5aed8233c502646c0892e Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <wballenthin@hex-rays.com>
Date: Wed, 20 May 2026 12:48:20 +0200
Subject: [PATCH] tests: add test for disabled code hook after import dispatch

see #290
---
 tests/bins/seh_iat_after_resolved_x86.c      |  98 +++++++++++++++++++
 tests/bins/seh_iat_after_resolved_x86.exe.xz | Bin 0 -> 1660 bytes
 tests/test_iat_after_seh.py                  |  11 +++
 3 files changed, 109 insertions(+)
 create mode 100644 tests/bins/seh_iat_after_resolved_x86.c
 create mode 100644 tests/bins/seh_iat_after_resolved_x86.exe.xz
 create mode 100644 tests/test_iat_after_seh.py

diff --git a/tests/bins/seh_iat_after_resolved_x86.c b/tests/bins/seh_iat_after_resolved_x86.c
new file mode 100644
index 0000000..36a6824
--- /dev/null
+++ b/tests/bins/seh_iat_after_resolved_x86.c
@@ -0,0 +1,98 @@
+#include <windows.h>
+
+#ifndef ExceptionContinueExecution
+#define ExceptionContinueExecution 0
+#endif
+
+#define SPEAKEASY_RESERVED_DIVISOR 0xFEEE0000
+
+typedef DWORD (WINAPI *fn_void_to_dword)(void);
+
+typedef struct seh_record {
+    struct seh_record *next;
+    void *handler;
+} seh_record;
+
+static fn_void_to_dword resolved_get_tick_count;
+
+static fn_void_to_dword manual_resolve(HMODULE base, const char *name) {
+    BYTE *b = (BYTE *)base;
+    IMAGE_DOS_HEADER *dos = (IMAGE_DOS_HEADER *)b;
+    IMAGE_NT_HEADERS *nt = (IMAGE_NT_HEADERS *)(b + dos->e_lfanew);
+    IMAGE_EXPORT_DIRECTORY *exp = (IMAGE_EXPORT_DIRECTORY *)(
+        b + nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
+
+    DWORD *names = (DWORD *)(b + exp->AddressOfNames);
+    WORD *ords = (WORD *)(b + exp->AddressOfNameOrdinals);
+    DWORD *funcs = (DWORD *)(b + exp->AddressOfFunctions);
+
+    for (DWORD i = 0; i < exp->NumberOfNames; i++) {
+        const char *sym = (const char *)(b + names[i]);
+        const char *a = sym;
+        const char *c = name;
+        while (*a && *c && *a == *c) {
+            a++;
+            c++;
+        }
+        if (*a == 0 && *c == 0) {
+            return (fn_void_to_dword)(b + funcs[ords[i]]);
+        }
+    }
+    return 0;
+}
+
+static EXCEPTION_DISPOSITION __cdecl seh_handler(
+    EXCEPTION_RECORD *record,
+    void *frame,
+    CONTEXT *context,
+    void *dispatcher
+) {
+    volatile DWORD tick = 0;
+    volatile DWORD pid;
+    seh_record *seh = (seh_record *)frame;
+
+    (void)record;
+    (void)context;
+    (void)dispatcher;
+
+    __asm__ __volatile__(
+        "movl %0, %%fs:0\n\t"
+        :
+        : "r"(seh->next)
+        : "memory"
+    );
+
+    if (resolved_get_tick_count) {
+        tick = resolved_get_tick_count();
+    }
+    pid = GetCurrentProcessId();
+    ExitProcess((UINT)(tick ^ pid));
+    return ExceptionContinueExecution;
+}
+
+void __cdecl mainCRTStartup(void) {
+    seh_record seh;
+    HMODULE k32 = GetModuleHandleA("kernel32.dll");
+    resolved_get_tick_count = manual_resolve(k32, "GetTickCount");
+
+    __asm__ __volatile__(
+        "movl %%fs:0, %%eax\n\t"
+        "movl %%eax, (%0)\n\t"
+        "movl %1, 4(%0)\n\t"
+        "movl %0, %%fs:0\n\t"
+        :
+        : "r"(&seh), "r"(seh_handler)
+        : "eax", "memory"
+    );
+
+    __asm__ __volatile__(
+        "xorl %%edx, %%edx\n\t"
+        "movl $1, %%eax\n\t"
+        "divl (%%ecx)\n\t"
+        :
+        : "c"(SPEAKEASY_RESERVED_DIVISOR)
+        : "eax", "edx", "memory"
+    );
+
+    ExitProcess(1);
+}
diff --git a/tests/bins/seh_iat_after_resolved_x86.exe.xz b/tests/bins/seh_iat_after_resolved_x86.exe.xz
new file mode 100644
index 0000000000000000000000000000000000000000..c6b76b7f6702bbf6c80fc9553a9d696621ecc8ca
GIT binary patch
literal 1660
zcmV-?27~$iH+ooF000E$*0e?f03iVu0001VFXf})8$Sj)T>vJQj&J}M_v{6`>h%AV
z0WU=FeCG8D8AJjp|5MG@(G>okVVr^$_6d5dYqafD5S}K=anHp^E6D32MgBqhvssUF
z1POp|I&5CWR0Z6qClLx<pN~<wyk+n(gCL5+sO$2<CC!AFrX)@yp>bDXR&d;11xc0e
zP2-m;PDjcpldwqXk2?Az_46<WuK}ep>ko>$6lhQYaaa4d4p-c-ODwT9e4eeg`p#gS
zF(T<2JsGxO7=T>t=@PL*OTY11t$HRRU=Y>*WX7;&bo2!ZnDIdRX`A{2G{+3JVv!}j
z0p6sBZbwL*adSsG8upNPjEi5y?R{?F8!4hic}Ml<_P9P5hHB*G#_>F*S|`erDXa<5
zkcA{=pH~HjT-hZ^QRUa3_4gg{0v3Gr`Mhe%yd?F2R_iAe57U;diD*v&$LKHqN7GFG
zJORR13#TrC<@g%x$ZKXOOKci$g+$X5fXo9#KA;2L_VHM%QUsXJ;TV~F_akrcJpLwG
z*p0fDYLBz^>0^tAZ<ZF~SrJHt^*i2g^SE59etU7wYiaXNa_cR^P~kAsxfUK<2ILka
z&f&iCBOkdpMLjFTrwvC<EB+EFCWdL%YufGHoahN<4GD8Et8#!Wbkf1J1BS7oIkys#
zG;hwZ@8sH1EKL%G1-yBAo*KZMcdS|_7!r9=bfQR9^<5;cdCW$zaU?<b0Dx#{sj=M9
zHwmsIV6q?;4KwXiiHZ+e5pxRWt4Ro$X?mz73cYOG<hK5(5v?~)GogRVBbtm?QZ3jk
zf_%Ltq{!=I=6cku<c>WF;&D8US&QXL*6!zSf<LV2r#?xJH+vYK5DtaaKZ<&AQUij&
z6*X$kB*n%p04TS7xXz`3TQVsj?JPjCg;<zvv#swLLrM@uT&ZsA_ZAr}_;g1@r9ERV
zNCrYkYz%-2oLAR)(?kJO4k>0VG1JSG9E(aD|H#OPE$u!6t@gy6EKbE)8F$`HHWDQ$
z>x5!vtu{su<xg^MUqs@dSh3Yl{Q?FbFBfC`HHDsVh{MB6kdk{~v!;e5Zo-!t<dupZ
z37ccc*%WPZ2A!)t+|Z4k-ClP~zCw`YI471O4psu?b}njdO**EhaYhK*v;o-Q47=_U
zh?tul_FnA2b6-f};<db~QsYv64q>+Aw`#rofvpm_i|TVOd|cX*5ih}k8t%+dLsg&?
zp}P*M12{QE<JPfriBV?B3G%?GIjRXP&#6yJ48=l%Sc@LtokK)(x-?``EPV**0a>ys
z-W+6`a#PExVF!56#Uj;bFYX-D(!PLpxmUMN3)#unLR*a&AC#VJeY}_-nUPVE)k4nI
zp{rIe^p94r4;W@L@~ap$oU^u#i0wdEGxpBksF3g)wk$_(MCWW_)cSPl^<c?vAj8D|
zC#{dFL2OS+Ie$2r6kt;bt(zdZ#Tt>ZIrh1DqhQRDwF*@mj5GU1bY$Z(2*48um<DPf
z8r)WwbJ_+pUL_TAmpuG~fUtfY3e;8^1xq)@vuI2GHIM;u`L*X!5edxkDJA*{D?_`m
zwxk_7A^Xt-Rfr)ae()^Fo7haygjMEzQ&I5P5DzD!Q>pwJ*0K^$<L&OH383RUyEM&F
z;X5`cYw8g(8)pEoQ_fCr_7tQ2n(M1nw%s@#1<Hs}w~N_7WG7*KsEfe5aJl+rdToJm
zG#v~$V5|)^BN7R+{UR0Yg6fJ2Vn@}0=6LjSJsGU{2-Or#RYUYoSaF<<ujAjKh?EtC
ze&1N`EN<tIJxRo{n8sLOg}H)Us#(bCB6_rXWQ>1PWd(1|<m9$#4X_0AUhM#=bM3vp
z@(yKHMp5^H$-4fJccd${Fjc9c>Dw?j`J|ghELAqVz&~?kQIl@iAxur%6lWl05h8q|
zkzmE+Aq-YBL)!iUQd-{IAgo6lh<0jX_X}l7^zcT|-TjLQH)0(uwLk}deC@@bH%hS^
z0F<Bk0EP=FwNffkK3lS+-iKRPxquBDp4w^-27kl9k``BVe2Ciuj<cYD1E=!SF&R>2
z;gWM1e-TqoHn<480EJ(W?we9W3v_K@F6y-SG?{W=jx!IHgIW&^?YcQS8effp=D;@b
z3>Nxg0i)omXEeQ_LS<qC?uGyW0001z5txDm4pP+s0o4q^HUI!*!~GJm#Ao{g00000
G1X)_#Qw>@G

literal 0
HcmV?d00001

diff --git a/tests/test_iat_after_seh.py b/tests/test_iat_after_seh.py
new file mode 100644
index 0000000..48d83cb
--- /dev/null
+++ b/tests/test_iat_after_seh.py
@@ -0,0 +1,11 @@
+def test_iat_call_after_seh_resolved_pointer_call(config, load_test_bin, run_test):
+    data = load_test_bin("seh_iat_after_resolved_x86.exe.xz")
+    report = run_test(config, data)
+    ep = report.entry_points[0]
+
+    apis = [e.api_name for e in (ep.events or []) if e.event == "api"]
+    assert "kernel32.GetTickCount" in apis
+    assert "kernel32.GetCurrentProcessId" in apis
+    assert "kernel32.ExitProcess" in apis
+    assert apis.index("kernel32.GetTickCount") < apis.index("kernel32.GetCurrentProcessId")
+    assert ep.error is None