What is veh-dumper?

Veh dumper is a tool for people who reverse engineer Windows programs, meaning they take compiled software apart to understand how it works, often using a program called IDA. It targets a specific technical mechanism inside Windows programs called vectored exception handlers, which are special functions a program can register to catch and respond to errors while it is running. Malware and copy protection systems sometimes hide important logic inside these handlers, which makes them a common target for analysis. The tool works by being injected into a running program as a DLL, a type of Windows code library. Once inside, it finds every registered exception handler and continue handler, then pulls out the raw code that belongs to just that one handler rather than dumping the entire program. For each handler, it also traces every reference the code makes to nearby data, every function it directly calls, and every indirect call it makes through a lookup table, following those calls a limited number of steps deep. When a handler calls into a standard Windows system file, the tool does not bother dumping that system code. Instead it labels the call with the real function name, so an analyst reading the result immediately understands what is being called instead of seeing a meaningless address. Each handler is packaged back up as a small standalone Windows executable file that opens directly and correctly inside IDA, with everything positioned at the right memory address and the entry point already pointing at the right spot. Results are written into a folder next to the injected file, along with a log file and a text report per handler describing what was found. To build it you need Visual Studio 2022 with a fairly recent version of C++. Getting the tool running requires injecting it into a target process using any standard DLL injection method, since it has no separate configuration or command line arguments of its own. It has been tested on a recent build of Windows 11 and includes internal limits to stop it from running away on unusually large handlers. The project is released under the MIT license.