decode_veh64.txt

; struct LIST_HEAD //list_head points here {
;     VEH_ENTRY* FLink;
;     VEH_ENTRY* BLink;
; }
;
; struct VEH_ENTRY { //cur_entry points here
;     VEH_ENTRY* FLink;
;     VEH_ENTRY* BLink;
;     DWORD Count;
;     DWORD Alignment;
;     ULONG_PTR VectoredHandler;
; }

; initialize
list_head = LdrpVectorHandlerList + 8
cur_entry = [list_head]
count = 0
log "--- VEH ---"

; walk the linked list
loop:
cmp cur_entry, list_head
je break
; get and decode the handler
encoded = [cur_entry + 8 + 8 + 4 + 4]
count++
call decode_handler
; log the handler
log "Handler {0}: {1}", count, decoded
cur_entry = [cur_entry]
jmp loop

; end of script
break:
log "--- END ---"
ret

; calls RtlDecodePointer to decode the handler address
decode_handler:
; backup registers that are modified by RtlDecodePointer
push rax
push rcx
push rdx
push r8
push r9
push r10
push r11
; call RtlDecodePointer
rcx = encoded
push cip
cip = RtlDecodePointer
rtr
step
; get decoded pointer
decoded = rax
; restore registers
pop r11
pop r10
pop r9
pop r8
pop rdx
pop rcx
pop rax
ret