If there are canaries on stack, why does not the exception handler check the integrity of canaries? Why does it continue executing a manipulated exception handler?
Will corrupting a canary trigger an exception? Is this a common way to trigger an exception at SEH overwrite attacks?
Why does the attack have to set the handler address to "pop-pop-ret", then jumping to the destination address, e.g., inserted shell code? I mean, why not set the handler address directly to the destination address?
I understand there are mitigation now against such attacks, I still want to know more details. Thanks.