725{
729 PRUNTIME_FUNCTION FunctionEntry;
733
734
736
737
738 if (TargetFrame !=
NULL)
739 {
740 StackHigh = (
ULONG64)TargetFrame + 1;
741 }
742
743
745
746
751
752
754 {
756 {
758 }
759
760
762 if (FunctionEntry ==
NULL)
763 {
764
765
766 UnwindContext.Rip = *(
DWORD64*)UnwindContext.Rsp;
767 UnwindContext.Rsp +=
sizeof(
DWORD64);
768
770 {
771
773 }
774 continue;
775 }
776
777
779
780
782 ImageBase,
783 UnwindContext.Rip,
784 FunctionEntry,
785 &UnwindContext,
789
790
794 {
796
797
799 {
802 }
803
806 }
807
808
809 if (ExceptionRoutine !=
NULL)
810 {
811
813 {
814
816 }
817
818
820 &UnwindContext,
823
824
830
831
833
834
835 do
836 {
837
842
843
846
847
849 {
851 {
852
854 {
857 }
858
859
861 }
863 {
866 }
867 }
868
870 {
871
872
873
874
875
877
878
879
880
883 UnwindContext.Rip,
885 &UnwindContext,
889
890
893
894
895
896
897
899 continue;
900 }
901
902
904 {
907 }
909 }
910
911
915 {
918
920 {
922 }
923 else
924 {
926 }
927 }
928
930 {
931 break;
932 }
933
935 {
936
938 }
939 }
940
942 {
944 }
945
946
948
949
951
952
955}
UINT32 void void ** ReturnValue
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn UINT32 *TableIdx UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 ACPI_BUFFER *RetPathPtr ACPI_OBJECT_HANDLER void *Data ACPI_OBJECT_HANDLER void **Data ACPI_STRING ACPI_OBJECT_LIST ACPI_BUFFER *ReturnObjectBuffer ACPI_DEVICE_INFO **ReturnBuffer ACPI_HANDLE ACPI_HANDLE ACPI_HANDLE *OutHandle ACPI_HANDLE *OutHandle void *Context void *Context ACPI_EVENT_HANDLER Handler UINT32 UINT32 ACPI_GPE_HANDLER void *Context UINT32 HandlerType
VOID NTAPI RtlpCheckLogException(IN PEXCEPTION_RECORD ExceptionRecord, IN PCONTEXT ContextRecord, IN PVOID ContextData, IN ULONG Size)
VOID NTAPI RtlpGetStackLimits(OUT PULONG_PTR LowLimit, OUT PULONG_PTR HighLimit)
@ ExceptionContinueSearch
@ ExceptionCollidedUnwind
@ ExceptionNestedException
@ ExceptionContinueExecution
EXCEPTION_ROUTINE * PEXCEPTION_ROUTINE
enum _EXCEPTION_DISPOSITION EXCEPTION_DISPOSITION
void __cdecl __debugbreak(void)
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Reserved_ ULONG _In_opt_ PUNICODE_STRING _In_ ULONG _Out_opt_ PULONG Disposition
NTSYSAPI NTSTATUS NTAPI ZwRaiseException(_In_ PEXCEPTION_RECORD ExceptionRecord, _In_ PCONTEXT Context, _In_ BOOLEAN SearchFrames)
DECLSPEC_NORETURN NTSYSAPI VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status)
_IRQL_requires_same_ _In_ PVOID EstablisherFrame
_IRQL_requires_same_ _In_ PVOID _Inout_ struct _CONTEXT _In_ PVOID DispatcherContext
#define STATUS_INVALID_DISPOSITION
#define STATUS_UNWIND_CONSOLIDATE
#define STATUS_BAD_FUNCTION_TABLE
EXCEPTION_DISPOSITION NTAPI RtlpExecuteHandlerForUnwind(_Inout_ struct _EXCEPTION_RECORD *ExceptionRecord, _In_ PVOID EstablisherFrame, _Inout_ struct _CONTEXT *ContextRecord, _In_ PVOID DispatcherContext)
#define EXCEPTION_NONCONTINUABLE
PEXCEPTION_ROUTINE NTAPI RtlVirtualUnwind(_In_ ULONG HandlerType, _In_ ULONG64 ImageBase, _In_ ULONG64 ControlPc, _In_ PRUNTIME_FUNCTION FunctionEntry, _Inout_ PCONTEXT Context, _Outptr_ PVOID *HandlerData, _Out_ PULONG64 EstablisherFrame, _Inout_opt_ PKNONVOLATILE_CONTEXT_POINTERS ContextPointers)
VOID RtlRestoreContext(_In_ PCONTEXT ContextRecord, _In_ PEXCEPTION_RECORD ExceptionRecord)
PRUNTIME_FUNCTION NTAPI RtlLookupFunctionEntry(IN DWORD64 ControlPc, OUT PDWORD64 ImageBase, OUT PUNWIND_HISTORY_TABLE HistoryTable)
Locates the RUNTIME_FUNCTION entry corresponding to a code address. https://learn....
static __inline BOOL RtlpIsStackPointerValid(_In_ ULONG64 StackPointer, _In_ ULONG64 LowLimit, _In_ ULONG64 HighLimit)
#define EXCEPTION_NONCONTINUABLE_EXCEPTION
#define EXCEPTION_STACK_INVALID
#define EXCEPTION_TARGET_UNWIND
#define EXCEPTION_COLLIDED_UNWIND