# windows internals

Published articles for windows internals.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Having a look at the Windows' User/Kernel exceptions dispatcher

DevFeed: [Having a look at the Windows' User/Kernel exceptions dispatcher](<https://devfeed.tech/articles/having-a-look-at-the-windows-user-kernel-exceptions-dispatcher-39692.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2013/10/12/having-a-look-at-the-windows-userkernel-exceptions-dispatcher/>)

Author: Axel "0vercl0k" Souchet

Published: 2013-10-12T21:03:00Z

Content type: tutorial

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [Exception](<https://devfeed.tech/topics/exception.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Monitoring](<https://devfeed.tech/topics/monitoring.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [x86](<https://devfeed.tech/topics/x86.md>), [Assembly](<https://devfeed.tech/topics/assembly.md>)

Tags: [coding](<https://devfeed.tech/tags/coding.md>), [cpu](<https://devfeed.tech/tags/cpu.md>), [exception](<https://devfeed.tech/tags/exception.md>), [exceptions](<https://devfeed.tech/tags/exceptions.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [interrupt](<https://devfeed.tech/tags/interrupt.md>), [monitoring](<https://devfeed.tech/tags/monitoring.md>), [process](<https://devfeed.tech/tags/process.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [seh](<https://devfeed.tech/tags/seh.md>), [windows](<https://devfeed.tech/tags/windows.md>), [windows-internals](<https://devfeed.tech/tags/windows-internals.md>)

### AI overview

This article explains how Windows user- and kernel-mode exception dispatch works on Windows 7 x86. It also describes creating a userland proof of concept that monitors process exceptions and generates reports, including hooking ntdll!KiUserExceptionDispatcher with Detours.

### Source excerpt

Introduction The purpose of this little post is to create a piece of code able to monitor exceptions raised in a process (a bit like gynvael's ExcpHook but in userland), and to generate a report with information related to the exception. The other purpose is to have a look ...