RtlLookupFunctionEntry
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *__fastcall RtlLookupFunctionEntry(
UINT64 ControlPc,
UINT64 *ImageBase,
_UNWIND_HISTORY_TABLE *HistoryTable){
unsigned int GlobalHint;
unsigned int v7;
unsigned int *v8;
UINT64 v9;
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *result;
unsigned int LocalHint;
unsigned int v12;
unsigned __int64 v13;
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *FunctionEntry;
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v15;
__int64 Count;
UINT64 v17;
UINT64 v18;
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v19;
void *v20;
unsigned __int128 v21;
__int64 v22;
unsigned __int64 v23;
unsigned __int64 v24;
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v25;
int v26;
int i;
int v28;
UINT64 v29;
_INVERTED_FUNCTION_TABLE_ENTRY FunctionTableInfo;
if( !HistoryTable )
goto LABEL_29;
if( HistoryTable->Once )
{
HistoryTable->Once = 0;
result = *(_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY **)&RtlpUnwindHistoryTable[4 * (unsigned __int8)byte_140E01945 + 8];
if( result )
{
v29 = *(_QWORD *)&RtlpUnwindHistoryTable[4 * (unsigned __int8)byte_140E01945 + 6];
if( ControlPc >= v29 + result->BeginAddress && ControlPc < v29 + result->UnwindData )
{
*ImageBase = v29;
return result;
}
}
}
if( !HistoryTable->Search )
goto LABEL_29;
if( ControlPc >= qword_140E01950
|| ControlPc < qword_140E01948
|| (GlobalHint = HistoryTable->GlobalHint, v7 = GlobalHint, GlobalHint >= RtlpUnwindHistoryTable[0]) )
{
LABEL_11:
if( ControlPc >= HistoryTable->LowAddress && ControlPc < HistoryTable->HighAddress )
{
LocalHint = HistoryTable->LocalHint;
v12 = LocalHint;
if( LocalHint < HistoryTable->Count )
{
while( 1 )
{
v13 = HistoryTable->Entry[v12].ImageBase;
FunctionEntry = HistoryTable->Entry[v12].FunctionEntry;
if( ControlPc >= v13 + FunctionEntry->BeginAddress && ControlPc < v13 + FunctionEntry->UnwindData )
break;
if( ++v12 >= HistoryTable->Count )
goto LABEL_29;
}
HistoryTable->LocalHint = LocalHint + 1;
*ImageBase = v13;
LODWORD(result) = RtlpConvertFunctionEntry((INT64)FunctionEntry, v13);
return result;
}
}
LABEL_29:
memset(&FunctionTableInfo, 0, sizeof(FunctionTableInfo));
if( ControlPc < (unsigned __int64)*(&byte_140E00020 + 1)
|| ControlPc >= (unsigned __int64)*(&byte_140E00020 + 1) + *((unsigned int *)&byte_140E00020 + 4) )
{
v19 = RtlpxLookupFunctionTable((VOID *)ControlPc, &FunctionTableInfo);
}
else
{
v19 = (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)byte_140E00020;
FunctionTableInfo = *(_INVERTED_FUNCTION_TABLE_ENTRY *)&byte_140E00020;
}
v15 = 0i64;
if( v19 )
{
v20 = FunctionTableInfo.ImageBase;
v21 = FunctionTableInfo.SizeOfTable * (unsigned __int128)0xAAAAAAAAAAAAAAABui64;
*ImageBase = (UINT64)FunctionTableInfo.ImageBase;
v22 = *((_QWORD *)&v21 + 1) >> 3;
if( (_DWORD)v22 )
{
v23 = ControlPc - (_QWORD)v20;
v24 = *(&v19->BeginAddress + 3 * (unsigned int)(v22 - 1));
v25 = (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)((char *)v19 + 12 * (unsigned int)(v22 - 1));
if( v23 < v24 )
{
v26 = v22 - 2;
for( i = 0; v26 >= i; LODWORD(v24) = v25->BeginAddress )
{
v28 = (i + v26) >> 1;
v25 = (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)((char *)v19 + 12 * v28);
if( v23 < v25->BeginAddress )
{
v26 = v28 - 1;
}
else
{
LODWORD(v24) = v25->BeginAddress;
if( v23 < v25[1].UnwindData )
break;
i = v28 + 1;
}
}
}
if( v23 >= (unsigned int)v24 && v23 < v25->UnwindData )
v15 = v25;
}
if( v15 )
{
if( HistoryTable )
{
if( !HistoryTable->Search )
{
Count = HistoryTable->Count;
if( (unsigned int)Count < 0xC )
{
HistoryTable->Count = Count + 1;
HistoryTable->Entry[Count].ImageBase = *ImageBase;
HistoryTable->Entry[(unsigned int)Count].FunctionEntry = v15;
v17 = *ImageBase + v15->BeginAddress;
v18 = *ImageBase + v15->UnwindData;
if( v17 < HistoryTable->LowAddress )
HistoryTable->LowAddress = v17;
if( v18 > HistoryTable->HighAddress )
HistoryTable->HighAddress = v18;
}
}
}
}
}
LODWORD(result) = RtlpConvertFunctionEntry((INT64)v15, *ImageBase);
return result;
}
while( 1 )
{
v8 = *(unsigned int **)&RtlpUnwindHistoryTable[4 * v7 + 8];
v9 = *(_QWORD *)&RtlpUnwindHistoryTable[4 * v7 + 6];
if( ControlPc >= v9 + *v8 && ControlPc < v9 + v8[1] )
break;
if( ++v7 >= RtlpUnwindHistoryTable[0] )
goto LABEL_11;
}
result = *(_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY **)&RtlpUnwindHistoryTable[4 * v7 + 8];
HistoryTable->GlobalHint = GlobalHint + 1;
*ImageBase = v9;
return result;
}Referenced by:
KiInitDynamicTraceSupport
KiTpBuildExcludedKernelTracepointRangeList
MmWriteSystemImageTracepoint
RtlDispatchException
RtlInitializeHistoryTable
RtlRaiseException
RtlUnwindEx
RtlpSameFunction