15#define UNWIND_HISTORY_TABLE_NONE 0
16#define UNWIND_HISTORY_TABLE_GLOBAL 1
17#define UNWIND_HISTORY_TABLE_LOCAL 2
19#define UWOP_PUSH_NONVOL 0
20#define UWOP_ALLOC_LARGE 1
21#define UWOP_ALLOC_SMALL 2
22#define UWOP_SET_FPREG 3
23#define UWOP_SAVE_NONVOL 4
24#define UWOP_SAVE_NONVOL_FAR 5
26#define UWOP_SAVE_XMM 6
27#define UWOP_SAVE_XMM_FAR 7
30#define UWOP_SPARE_CODE 7
32#define UWOP_SAVE_XMM128 8
33#define UWOP_SAVE_XMM128_FAR 9
34#define UWOP_PUSH_MACHFRAME 10
115 _In_ PUNWIND_HISTORY_TABLE HistoryTable);
127 OUT PUNWIND_HISTORY_TABLE HistoryTable)
131 ULONG IndexLo, IndexHi, IndexMid;
143 ControlPc -= *ImageBase;
147 IndexHi = TableLength;
148 while (IndexHi > IndexLo)
150 IndexMid = (IndexLo + IndexHi) / 2;
153 if (ControlPc < FunctionEntry->BeginAddress)
158 else if (ControlPc >= FunctionEntry->EndAddress)
161 IndexLo = IndexMid + 1;
166 return FunctionEntry;
180 static const UCHAR UnwindOpExtraSlotTable[] =
197 (UnwindCode.OpInfo != 0))
203 return UnwindOpExtraSlotTable[UnwindCode.UnwindOp] + 1;
223 _Inout_opt_ PKNONVOLATILE_CONTEXT_POINTERS ContextPointers,
228 if (ContextPointers !=
NULL)
230 ContextPointers->IntegerContext[Reg] = ValuePointer;
249 _Inout_opt_ PKNONVOLATILE_CONTEXT_POINTERS ContextPointers,
272 _Inout_opt_ PKNONVOLATILE_CONTEXT_POINTERS ContextPointers,
277 if (ContextPointers !=
NULL)
279 ContextPointers->FloatingContext[Reg] = ValuePointer;
307 _Inout_opt_ PKNONVOLATILE_CONTEXT_POINTERS ContextPointers,
320 InstrPtr = (
BYTE*)ControlPc;
323 Instr = *(
DWORD*)InstrPtr;
324 if ( (Instr & 0x00fffdff) == 0x00c48148 )
326 if ( (Instr & 0x0000ff00) == 0x8300 )
329 LocalContext.Rsp += Instr >> 24;
335 LocalContext.Rsp += *(
DWORD*)(InstrPtr + 3);
340 else if ( (Instr & 0x38fffe) == 0x208d48 )
343 Reg = (Instr >> 16) & 0x7;
346 Reg += (Instr & 1) * 8;
348 LocalContext.Rsp =
GetReg(&LocalContext, Reg);
351 Mod = (Instr >> 22) & 0x3;
360 LocalContext.Rsp += (
LONG)(
CHAR)(Instr >> 24);
366 LocalContext.Rsp += *(
LONG*)(InstrPtr + 3);
372 EndAddress = FunctionEntry->EndAddress + ImageBase - 1;
373 while ((
DWORD64)InstrPtr < EndAddress)
375 Instr = *(
DWORD*)InstrPtr;
378 if ( (Instr & 0xf8) == 0x58 )
382 PopReg(&LocalContext, ContextPointers, Reg);
388 if ( (Instr & 0xf8fb) == 0x5841 )
391 Reg = ((Instr >> 8) & 0x7) + 8;
392 PopReg(&LocalContext, ContextPointers, Reg);
406 if ((
DWORD64)InstrPtr != EndAddress)
414 if (*InstrPtr != 0xc3)
420 LocalContext.Rip = *(
DWORD64*)LocalContext.Rsp;
421 LocalContext.Rsp +=
sizeof(
DWORD64);
441 if (UnwindInfo->FrameRegister == 0)
447 if ((CodeOffset >= UnwindInfo->SizeOfProlog) ||
451 UnwindInfo->FrameOffset * 16;
456 i < UnwindInfo->CountOfCodes;
460 if (UnwindInfo->UnwindCode[
i].CodeOffset > CodeOffset)
469 UnwindInfo->FrameOffset * 16;
486 _Inout_opt_ PKNONVOLATILE_CONTEXT_POINTERS ContextPointers)
496 ControlRva = ControlPc - ImageBase;
499 if ( (ControlRva < FunctionEntry->BeginAddress) ||
500 (ControlRva >= FunctionEntry->EndAddress) )
506 UnwindInfo =
RVA(ImageBase, FunctionEntry->UnwindData);
512 CodeOffset = ControlRva - FunctionEntry->BeginAddress;
528 while ((i < UnwindInfo->CountOfCodes) &&
537 while (i < UnwindInfo->CountOfCodes)
628 UnwindInfo =
RVA(ImageBase, FunctionEntry->UnwindData);
630 goto RepeatChainedInfo;
645 *HandlerData = (LanguageHandler + 1);
646 return RVA(ImageBase, *LanguageHandler);
671 _In_opt_ struct _UNWIND_HISTORY_TABLE *HistoryTable,
686 if (TargetFrame !=
NULL)
688 StackHigh = (
ULONG64)TargetFrame + 1;
704 if (FunctionEntry ==
NULL)
708 UnwindContext.Rip = *(
DWORD64*)UnwindContext.Rsp;
709 UnwindContext.Rsp +=
sizeof(
DWORD64);
751 if (ExceptionRoutine !=
NULL)
881 _In_opt_ struct _UNWIND_HISTORY_TABLE *HistoryTable)
889 if (ExceptionRecord ==
NULL)
896 ExceptionRecord = &LocalExceptionRecord;
901 if (TargetFrame ==
NULL)
947 DPRINT(
"Enter RtlWalkFrameChain\n");
950 FramesToSkip =
Flags >> 8;
967 for (
i = 0;
i < FramesToSkip +
Count;
i++)
996 if (!(
Flags & 1) && (
Context.Rip < 0xFFFF800000000000ULL))
1004 if ((
Context.Rip < 0x10000) ||
1005 (
Context.Rip > 0x000007FFFFFEFFFFULL))
1021 if (
i >= FramesToSkip)
1023 Callers[
i - FramesToSkip] = (
PVOID)ControlPc;
1029 DPRINT1(
"Exception while getting callers!\n");
1034 DPRINT(
"RtlWalkFrameChain returns %ld\n",
i);
1041#undef RtlGetCallersAddress
1055 *CallersAddress = (
Number >= 3) ? Callers[2] :
NULL;
1056 *CallersCaller = (
Number == 4) ? Callers[3] :
NULL;
1064 _Out_ PKNONVOLATILE_CONTEXT_POINTERS NonvolatileContextPointers,
1074 RtlZeroMemory(NonvolatileContextPointers,
sizeof(*NonvolatileContextPointers));
1087 if (FunctionEntry !=
NULL)
1097 NonvolatileContextPointers);
1119 KNONVOLATILE_CONTEXT_POINTERS ContextPointers;
1125 *ContextPointers.R12 =
Context->R12;
1126 *ContextPointers.R13 =
Context->R13;
1127 *ContextPointers.R14 =
Context->R14;
1128 *ContextPointers.R15 =
Context->R15;
1129 *ContextPointers.Xmm6 =
Context->Xmm6;
1130 *ContextPointers.Xmm7 =
Context->Xmm7;
1131 *ContextPointers.Xmm8 =
Context->Xmm8;
1132 *ContextPointers.Xmm9 =
Context->Xmm9;
1133 *ContextPointers.Xmm10 =
Context->Xmm10;
1134 *ContextPointers.Xmm11 =
Context->Xmm11;
1135 *ContextPointers.Xmm12 =
Context->Xmm12;
1136 *ContextPointers.Xmm13 =
Context->Xmm13;
1137 *ContextPointers.Xmm14 =
Context->Xmm14;
1138 *ContextPointers.Xmm15 =
Context->Xmm15;
1150 if (ExceptionRecord !=
NULL)
1153 (ExceptionRecord->NumberParameters >= 1))
UINT32 void void ** ReturnValue
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn UINT32 *TableIdx UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 ACPI_BUFFER *RetPathPtr ACPI_OBJECT_HANDLER void *Data ACPI_OBJECT_HANDLER void **Data ACPI_STRING ACPI_OBJECT_LIST ACPI_BUFFER *ReturnObjectBuffer ACPI_DEVICE_INFO **ReturnBuffer ACPI_HANDLE ACPI_HANDLE ACPI_HANDLE *OutHandle ACPI_HANDLE *OutHandle void *Context void *Context ACPI_EVENT_HANDLER Handler UINT32 UINT32 ACPI_GPE_HANDLER void *Context UINT32 HandlerType
VOID NTAPI RtlpCheckLogException(IN PEXCEPTION_RECORD ExceptionRecord, IN PCONTEXT ContextRecord, IN PVOID ContextData, IN ULONG Size)
KPROCESSOR_MODE NTAPI RtlpGetMode(VOID)
PVOID NTAPI RtlPcToFileHeader(IN PVOID PcValue, PVOID *BaseOfImage)
VOID NTAPI RtlpGetStackLimits(OUT PULONG_PTR LowLimit, OUT PULONG_PTR HighLimit)
@ ExceptionContinueSearch
@ ExceptionCollidedUnwind
@ ExceptionNestedException
@ ExceptionContinueExecution
EXCEPTION_ROUTINE * PEXCEPTION_ROUTINE
#define RtlImageDirectoryEntryToData
enum _EXCEPTION_DISPOSITION EXCEPTION_DISPOSITION
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
#define UNW_FLAG_NHANDLER
#define EXCEPTION_EXECUTE_HANDLER
void __cdecl __debugbreak(void)
unsigned __int64 * PULONG64
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Reserved_ ULONG _In_opt_ PUNICODE_STRING _In_ ULONG _Out_opt_ PULONG Disposition
NTSYSAPI NTSTATUS NTAPI ZwRaiseException(_In_ PEXCEPTION_RECORD ExceptionRecord, _In_ PCONTEXT Context, _In_ BOOLEAN SearchFrames)
DECLSPEC_NORETURN NTSYSAPI VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status)
NTSYSAPI VOID NTAPI RtlCaptureContext(_Out_ PCONTEXT ContextRecord)
_IRQL_requires_same_ _In_ PVOID EstablisherFrame
_IRQL_requires_same_ _In_ PVOID _Inout_ struct _CONTEXT * ContextRecord
_IRQL_requires_same_ _In_ PVOID _Inout_ struct _CONTEXT _In_ PVOID DispatcherContext
_In_ ULONG _In_ ULONG Offset
_In_ ULONG _In_ ULONG _In_ ULONG Length
_In_opt_ PENTER_STATE_SYSTEM_HANDLER _In_opt_ PVOID _In_ LONG _In_opt_ LONG volatile * Number
#define STATUS_INVALID_DISPOSITION
#define STATUS_UNWIND_CONSOLIDATE
#define STATUS_BAD_FUNCTION_TABLE
#define IMAGE_DIRECTORY_ENTRY_EXCEPTION
#define _SEH2_EXCEPT(...)
struct _RUNTIME_FUNCTION * PRUNTIME_FUNCTION
struct _RUNTIME_FUNCTION RUNTIME_FUNCTION
struct _EXCEPTION_RECORD * ExceptionRecord
UNWIND_CODE UnwindCode[1]
#define EXCEPTION_NONCONTINUABLE
#define RtlZeroMemory(Destination, Length)
#define ALIGN_UP_POINTER_BY(ptr, align)
PEXCEPTION_ROUTINE NTAPI RtlVirtualUnwind(_In_ ULONG HandlerType, _In_ ULONG64 ImageBase, _In_ ULONG64 ControlPc, _In_ PRUNTIME_FUNCTION FunctionEntry, _Inout_ PCONTEXT Context, _Outptr_ PVOID *HandlerData, _Out_ PULONG64 EstablisherFrame, _Inout_opt_ PKNONVOLATILE_CONTEXT_POINTERS ContextPointers)
static __inline M128A GetXmmReg(PCONTEXT Context, BYTE Reg)
VOID NTAPI RtlGetCallersAddress(OUT PVOID *CallersAddress, OUT PVOID *CallersCaller)
BOOLEAN NTAPI RtlpUnwindInternal(_In_opt_ PVOID TargetFrame, _In_opt_ PVOID TargetIp, _In_ PEXCEPTION_RECORD ExceptionRecord, _In_ PVOID ReturnValue, _In_ PCONTEXT ContextRecord, _In_opt_ struct _UNWIND_HISTORY_TABLE *HistoryTable, _In_ ULONG HandlerType)
static __inline void PopReg(_Inout_ PCONTEXT Context, _Inout_opt_ PKNONVOLATILE_CONTEXT_POINTERS ContextPointers, _In_ BYTE Reg)
VOID NTAPI RtlUnwind(_In_opt_ PVOID TargetFrame, _In_opt_ PVOID TargetIp, _In_opt_ PEXCEPTION_RECORD ExceptionRecord, _In_ PVOID ReturnValue)
VOID RtlRestoreContext(_In_ PCONTEXT ContextRecord, _In_ PEXCEPTION_RECORD ExceptionRecord)
static VOID RtlpCaptureNonVolatileContextPointers(_Out_ PKNONVOLATILE_CONTEXT_POINTERS NonvolatileContextPointers, _In_ ULONG64 TargetFrame)
VOID NTAPI RtlUnwindEx(_In_opt_ PVOID TargetFrame, _In_opt_ PVOID TargetIp, _In_opt_ PEXCEPTION_RECORD ExceptionRecord, _In_ PVOID ReturnValue, _In_ PCONTEXT ContextRecord, _In_opt_ struct _UNWIND_HISTORY_TABLE *HistoryTable)
union _UNWIND_CODE UNWIND_CODE
static ULONG64 GetEstablisherFrame(_In_ PCONTEXT Context, _In_ PUNWIND_INFO UnwindInfo, _In_ ULONG_PTR CodeOffset)
struct _UNWIND_INFO * PUNWIND_INFO
#define UWOP_SAVE_NONVOL_FAR
ULONG NTAPI RtlWalkFrameChain(OUT PVOID *Callers, IN ULONG Count, IN ULONG Flags)
PRUNTIME_FUNCTION NTAPI RtlpLookupDynamicFunctionEntry(_In_ DWORD64 ControlPc, _Out_ PDWORD64 ImageBase, _In_ PUNWIND_HISTORY_TABLE HistoryTable)
static __inline void SetXmmReg(_Inout_ PCONTEXT Context, _In_ BYTE Reg, _In_ M128A Value)
static __inline void SetReg(_Inout_ PCONTEXT Context, _In_ BYTE Reg, _In_ DWORD64 Value)
static __inline void SetRegFromStackValue(_Inout_ PCONTEXT Context, _Inout_opt_ PKNONVOLATILE_CONTEXT_POINTERS ContextPointers, _In_ BYTE Reg, _In_ PDWORD64 ValuePointer)
PRUNTIME_FUNCTION NTAPI RtlLookupFunctionEntry(IN DWORD64 ControlPc, OUT PDWORD64 ImageBase, OUT PUNWIND_HISTORY_TABLE HistoryTable)
Locates the RUNTIME_FUNCTION entry corresponding to a code address. http://msdn.microsoft....
static __inline ULONG UnwindOpSlots(_In_ UNWIND_CODE UnwindCode)
#define UWOP_PUSH_MACHFRAME
struct _UNWIND_INFO UNWIND_INFO
static __inline DWORD64 GetReg(_In_ PCONTEXT Context, _In_ BYTE Reg)
union _UNWIND_CODE * PUNWIND_CODE
static __inline BOOLEAN RtlpTryToUnwindEpilog(_Inout_ PCONTEXT Context, _In_ ULONG64 ControlPc, _Inout_opt_ PKNONVOLATILE_CONTEXT_POINTERS ContextPointers, _In_ ULONG64 ImageBase, _In_ PRUNTIME_FUNCTION FunctionEntry)
Helper function that tries to unwind epilog instructions.
VOID RtlpRestoreContextInternal(_In_ PCONTEXT ContextRecord)
static __inline void SetXmmRegFromStackValue(_Out_ PCONTEXT Context, _Inout_opt_ PKNONVOLATILE_CONTEXT_POINTERS ContextPointers, _In_ BYTE Reg, _In_ M128A *ValuePointer)
#define UWOP_SAVE_XMM128_FAR
VOID RtlSetUnwindContext(_In_ PCONTEXT Context, _In_ DWORD64 TargetFrame)
PRUNTIME_FUNCTION NTAPI RtlLookupFunctionTable(IN DWORD64 ControlPc, OUT PDWORD64 ImageBase, OUT PULONG Length)
Locates the table of RUNTIME_FUNCTION entries for a code address.
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _Out_opt_ PUSHORT _Inout_opt_ PUNICODE_STRING Value
#define EXCEPTION_NONCONTINUABLE_EXCEPTION
static WLX_DISPATCH_VERSION_1_4 FunctionTable
_Must_inspect_result_ _In_ ULONG Flags
#define EXCEPTION_EXIT_UNWIND
#define EXCEPTION_STACK_INVALID
#define EXCEPTION_UNWINDING
#define EXCEPTION_TARGET_UNWIND
#define EXCEPTION_COLLIDED_UNWIND