首页
社区
课程
招聘
[求助]RtlLookupFunctionEntry是做什么用的?
发表于: 2012-3-13 10:22 8502

[求助]RtlLookupFunctionEntry是做什么用的?

2012-3-13 10:22
8502
RtlLookupFunctionEntry是做什么用的?函数原型是什么?参数各是什么意思?
特别是返回值
RUNTIME_FUNCTION 这个结构体的原型是什么

这些都没有搜索到。还有一个unwind exception 或是unwind data 怎么翻译?不理解。谢谢!

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!

收藏
免费 0
支持
分享
最新回复 (2)
雪    币: 121
活跃值: (121)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
VS2008带的MSDN,有这个函数的说明

RtlLookupFunctionEntry Function

Searches the active function tables for an entry that corresponds to the specified PC value.

PVOID WINAPI RtlLookupFunctionEntry(
  __in          ULONGLONG ControlPC,
  __out         PULONGLONG ImageBase,
  __out         PULONGLONG TargetGp
);

Parameters
ControlPC
The virtual address of an instruction bundle within the function.

ImageBase
The base address of module to which the function belongs.

TargetGp
The global pointer value of the module.

This parameter has a different declaration on x64 systems. For more information, see x64 Definition.

Return Value
If there is no entry in the function table for the specified PC, the function returns NULL. Otherwise, the function returns the address of the function table entry that corresponds to the specified PC.

x64 Definition
This function is declared as follows:

PRUNTIME_FUNCTION WINAPI RtlLookupFunctionEntry (
    IN ULONG64 ControlPc,
    OUT PULONG64 ImageBase,
    IN OUT PUNWIND_HISTORY_TABLE HistoryTable OPTIONAL
    );

#define UNWIND_HISTORY_TABLE_SIZE 12

typedef struct _UNWIND_HISTORY_TABLE_ENTRY {
        ULONG64 ImageBase;
        PRUNTIME_FUNCTION FunctionEntry;
} UNWIND_HISTORY_TABLE_ENTRY, *PUNWIND_HISTORY_TABLE_ENTRY;

#define UNWIND_HISTORY_TABLE_NONE 0
#define UNWIND_HISTORY_TABLE_GLOBAL 1
#define UNWIND_HISTORY_TABLE_LOCAL 2

typedef struct _UNWIND_HISTORY_TABLE {
        ULONG Count;
        UCHAR Search;
        ULONG64 LowAddress;
        ULONG64 HighAddress;
        UNWIND_HISTORY_TABLE_ENTRY Entry[UNWIND_HISTORY_TABLE_SIZE];
} UNWIND_HISTORY_TABLE, *PUNWIND_HISTORY_TABLE;

Requirements
Client
Requires Windows XP 64-Bit Edition Version 2003.

Server
Requires 64-bit edition of Windows Server 2003.

Library
Use Kernel32.lib.

DLL
Requires Kernel32.dll.
2012-3-13 17:30
0
雪    币: 622
活跃值: (294)
能力值: ( LV13,RANK:410 )
在线值:
发帖
回帖
粉丝
3
查找某个指令位置对应在哪一个模块的哪一个函数里面
2012-3-13 19:42
0
游客
登录 | 注册 方可回帖
返回
//