On: Abusing Exceptions for Code Execution, Part 1

[rep_lodsb]

Doesn't this require the attacker to already "be on the other side of the airtight hatchway", in order to set up the exception handler?

[yurymik → rep_lodsb]

Yes, but once malware is on the other side, it could be caught by the AV doing static analysis/signature match. This point of this technique is obfuscation and evasion.