RtlDispatchException
UINT8 __stdcall RtlDispatchException(_EXCEPTION_RECORD *ExceptionRecord, _CONTEXT *ContextRecord){
UINT8 v4;
unsigned int v5;
unsigned __int64 Rsp;
int Flink_high;
unsigned __int64 v8;
void *v9;
_LIST_ENTRY *Rip;
_UNWIND_HISTORY_TABLE *p_HistoryTable;
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v12;
UINT64 v13;
_LIST_ENTRY *v14;
UINT64 v15;
_LIST_ENTRY *v16;
UINT64 v17;
int v18;
int Blink_high;
bool v20;
_LIST_ENTRY *v21;
UINT64 v22;
INT64 v23;
INT64 v24;
NTSTATUS v25;
int v26;
int v27;
INT64 v28;
__int64 v29;
__int64 v30;
unsigned __int64 v31;
char v32;
int Flink;
_LIST_ENTRY *v34;
char IsFrameInBounds;
_LIST_ENTRY v37;
UINT64 StackFrame;
UINT64 HighLimit;
UINT64 LowLimit;
__int64 v41;
UINT64 ImageBase;
UINT64 v43;
unsigned __int64 v44;
INT64 v45;
UINT64 ControlPc[10];
INT64 v47;
_UNWIND_HISTORY_TABLE HistoryTable;
v47 = (INT64)ContextRecord;
v45 = (INT64)ExceptionRecord;
HIDWORD(v37.Blink) = 0;
v4 = 0;
memset(ControlPc, 0i64, sizeof(ControlPc));
LOBYTE(v37.Blink) = 0;
StackFrame = 0i64;
v43 = 0i64;
HighLimit = 0i64;
ImageBase = 0i64;
LowLimit = 0i64;
HIDWORD(v37.Flink) = 0;
memset(HistoryTable.Entry, 0i64, sizeof(HistoryTable.Entry));
if( (NtGlobalFlag & 0x800000) != 0 )
{
LOBYTE(v37.Blink) = 1;
RtlpLogExceptionDispatch(ExceptionRecord, ContextRecord);
}
v5 = ExceptionRecord->ExceptionFlags & 1;
LODWORD(v37.Flink) = v5;
KeQueryCurrentStackInformation((_KERNEL_STACK_LIMITS *)&v37.Flink + 1, &LowLimit, &HighLimit);
Rsp = ContextRecord->_Rsp;
Flink_high = HIDWORD(v37.Flink) == 10;
HIDWORD(v37.Flink) = Flink_high;
if( !RtlpGetStackLimitsEx(Rsp, (CHAR **)&LowLimit, &HighLimit) )
{
ExceptionRecord->ExceptionFlags = v5 | 8;
return v4;
}
RtlGetExtendedContextLength2(0x10000Bui64, (_DWORD *)&v37.Blink + 1, 0i64);
v8 = HIDWORD(v37.Blink) + 15i64;
if( v8 <= HIDWORD(v37.Blink) )
v8 = 0xFFFFFFFFFFFFFF0i64;
v9 = alloca(v8 & 0xFFFFFFFFFFFFFFF0ui64);
RtlInitializeExtendedContext2((__int64)&v37, 1048587, &v41, 0i64);
RtlpCopyContext((_CONTEXT *)&v37, ContextRecord);
Rip = (_LIST_ENTRY *)ContextRecord->_Rip;
v44 = 0i64;
p_HistoryTable = &HistoryTable;
HistoryTable.Count = 0;
HistoryTable.HighAddress = 0i64;
*(_DWORD *)&HistoryTable.LocalHint = 0x1000000;
HistoryTable.LowAddress = -1i64;
while( 1 )
{
v12 = RtlLookupFunctionEntry((UINT64)Rip, &ImageBase, p_HistoryTable);
if( !v12 )
{
if( Rip == *(_LIST_ENTRY **)ControlPc[9] )
goto LABEL_52;
HistoryTable.Entry[3].ImageBase = *(_QWORD *)ControlPc[9];
ControlPc[9] += 8i64;
RtlpPopUserShadowStack((INT64)&v37);
goto LABEL_11;
}
v13 = ImageBase;
LODWORD(v14) = RtlVirtualUnwind(1i64, ImageBase, (UINT64)Rip);
v15 = StackFrame;
v16 = v14;
if( !(unsigned __int8)RtlpIsFrameInBounds(&LowLimit, StackFrame, &HighLimit) )
{
if( BYTE4(v37.Flink) == 1 )
{
BYTE4(v37.Flink) = 2;
RtlpGetStackLimitsEx(v15, (CHAR **)&LowLimit, &HighLimit);
v15 = StackFrame;
}
else if( !BYTE4(v37.Flink) )
{
Flink = LODWORD(v37.Flink) | 8;
LABEL_53:
v4 = 0;
*(_DWORD *)(v45 + 4) = Flink;
return v4;
}
}
if( v16 )
break;
LABEL_10:
Flink_high = HIDWORD(v37.Flink);
LABEL_11:
v17 = ControlPc[9];
Rip = (_LIST_ENTRY *)HistoryTable.Entry[3].ImageBase;
if( !(unsigned __int8)RtlpIsFrameInBounds(&LowLimit, ControlPc[9], &HighLimit) )
{
if( (_BYTE)Flink_high != 1
|| (LOBYTE(Flink_high) = 0,
HIDWORD(v37.Flink) = Flink_high,
!RtlpGetStackLimitsEx(v17, (CHAR **)&LowLimit, &HighLimit)) )
{
LABEL_52:
Flink = (int)v37.Flink;
goto LABEL_53;
}
}
}
v18 = (int)v37.Flink;
Blink_high = 0;
HIDWORD(v37.Blink) = 0;
while( 1 )
{
v20 = LOBYTE(v37.Blink) == 0;
v21 = (_LIST_ENTRY *)v45;
v22 = v43;
BYTE1(v37.Blink) = 0;
ControlPc[0] = (UINT64)Rip;
*(_DWORD *)(v45 + 4) = v18;
ControlPc[1] = v13;
ControlPc[2] = (UINT64)v12;
ControlPc[3] = v15;
ControlPc[5] = (UINT64)&v37;
ControlPc[6] = (UINT64)v16;
ControlPc[7] = v22;
ControlPc[8] = (UINT64)p_HistoryTable;
LODWORD(ControlPc[9]) = Blink_high;
v41 = 0i64;
if( !v20 )
{
v34 = RtlpLogExceptionHandler(v21, &v37, Rip, v16);
v15 = StackFrame;
v41 = (__int64)v34;
}
v23 = v15;
v24 = v45;
v25 = RtlpExecuteHandlerForException(v45, v23, v47, (INT64)ControlPc);
if( v41 )
*(_DWORD *)(v41 + 1396) = v25;
v26 = *(_DWORD *)(v24 + 4) & 1;
v15 = StackFrame;
v18 = v26 | LODWORD(v37.Flink);
LODWORD(v37.Flink) |= v26;
if( v44 == StackFrame )
{
v18 &= ~0x10u;
v44 = 0i64;
LODWORD(v37.Flink) = v18;
}
if( v25 == 1 )
goto LABEL_21;
if( !v25 )
break;
v27 = v25 - 2;
if( v27 )
{
if( v27 != 1 )
RtlRaiseStatus(-1073741786);
Rip = (_LIST_ENTRY *)ControlPc[0];
ImageBase = ControlPc[1];
RtlpCopyContext((_CONTEXT *)&v37, (_CONTEXT *)ControlPc[5]);
LODWORD(v29) = RtlVirtualUnwind(1i64, v28, (UINT64)Rip);
v41 = v29;
StackFrame = ControlPc[3];
v12 = RtlLookupFunctionEntry((UINT64)Rip, &ImageBase, p_HistoryTable);
if( v12 != (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)ControlPc[2]
|| (v13 = ImageBase, (int)RtlLookupExceptionHandler((__int64)v12, ImageBase, 2u, v30, &v41, &v43) < 0)
|| (v16 = (_LIST_ENTRY *)v41, v41 != ControlPc[6])
|| v43 != ControlPc[7] )
{
__fastfail(0x27u);
}
v15 = StackFrame;
p_HistoryTable = (_UNWIND_HISTORY_TABLE *)ControlPc[8];
HIDWORD(v37.Blink) = ControlPc[9];
BYTE1(v37.Blink) = 1;
if( !(unsigned __int8)RtlpIsFrameInBounds(&LowLimit, StackFrame, &HighLimit) && BYTE4(v37.Flink) == 1 )
{
RtlpGetStackLimitsEx(v15, (CHAR **)&LowLimit, &HighLimit);
v18 = (int)v37.Flink;
v15 = StackFrame;
LABEL_45:
BYTE4(v37.Flink) = 0;
goto LABEL_22;
}
v18 = (int)v37.Flink;
}
else
{
v31 = ControlPc[3];
v18 |= 0x10u;
v32 = 1;
LODWORD(v37.Flink) = v18;
if( BYTE4(v37.Flink) )
{
IsFrameInBounds = RtlpIsFrameInBounds(&LowLimit, ControlPc[3], &HighLimit);
v18 = (int)v37.Flink;
v32 = IsFrameInBounds;
v31 = ControlPc[3];
}
if( v31 > v44 || !v32 )
v44 = v31;
}
LABEL_21:
if( BYTE4(v37.Flink) == 2 )
goto LABEL_45;
LABEL_22:
Blink_high = HIDWORD(v37.Blink);
if( !BYTE1(v37.Blink) )
goto LABEL_10;
}
if( (v18 & 1) != 0 )
RtlRaiseStatus(-1073741787);
return 1;
}Referenced by:
KiDispatchException
RtlRaiseException