Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I read here that

/SAFESEH is only valid when linking for x86 targets. /SAFESEH is not supported for platforms that already have the exception handlers noted. For example, on x64 and Itanium, all exception handlers are noted in the PDATA.

What does this mean? Is the SEH chain checked with a x64 target (stored into the PDATA structure) ? Or there is no safeSEH check with x64 targets?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

SafeSEH is a mechanism that protects stack-based exception handler chains from being overwritten. However, on x64 and Itanium architectures, the exception handlers are table-based (i.e. stored in PDATA) and therefore cannot be overwritten directly by a stack buffer overflow - they're simply not on the stack. As such, SafeSEH is irrelevant to those systems.

share|improve this answer
    
Ah now I got it, thank you! –  John Smith Oct 29 '12 at 11:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.