ホーム › System.Diagnostics.Debug › RtlVirtualUnwind

RtlVirtualUnwind

関数

x64の関数テーブルを用いてスタックフレームを仮想的に巻き戻す。

DLLKERNEL32.dll呼出規約winapi

シグネチャ

// KERNEL32.dll
#include <windows.h>

EXCEPTION_ROUTINE RtlVirtualUnwind(
    RTL_VIRTUAL_UNWIND_HANDLER_TYPE HandlerType,
    ULONGLONG ImageBase,
    ULONGLONG ControlPc,
    IMAGE_RUNTIME_FUNCTION_ENTRY* FunctionEntry,
    CONTEXT* ContextRecord,
    void** HandlerData,
    ULONGLONG* EstablisherFrame,
    KNONVOLATILE_CONTEXT_POINTERS* ContextPointers   // optional
);

パラメーター

名前	型	方向
HandlerType	RTL_VIRTUAL_UNWIND_HANDLER_TYPE	in
ImageBase	ULONGLONG	in
ControlPc	ULONGLONG	in
FunctionEntry	IMAGE_RUNTIME_FUNCTION_ENTRY*	in
ContextRecord	CONTEXT*	inout
HandlerData	void**	out
EstablisherFrame	ULONGLONG*	out
ContextPointers	KNONVOLATILE_CONTEXT_POINTERS*	inoutoptional

戻り値の型: EXCEPTION_ROUTINE

各言語での呼び出し定義

// KERNEL32.dll
#include <windows.h>

EXCEPTION_ROUTINE RtlVirtualUnwind(
    RTL_VIRTUAL_UNWIND_HANDLER_TYPE HandlerType,
    ULONGLONG ImageBase,
    ULONGLONG ControlPc,
    IMAGE_RUNTIME_FUNCTION_ENTRY* FunctionEntry,
    CONTEXT* ContextRecord,
    void** HandlerData,
    ULONGLONG* EstablisherFrame,
    KNONVOLATILE_CONTEXT_POINTERS* ContextPointers   // optional
);

[DllImport("KERNEL32.dll", ExactSpelling = true)]
static extern IntPtr RtlVirtualUnwind(
    uint HandlerType,   // RTL_VIRTUAL_UNWIND_HANDLER_TYPE
    ulong ImageBase,   // ULONGLONG
    ulong ControlPc,   // ULONGLONG
    IntPtr FunctionEntry,   // IMAGE_RUNTIME_FUNCTION_ENTRY*
    IntPtr ContextRecord,   // CONTEXT* in/out
    IntPtr HandlerData,   // void** out
    out ulong EstablisherFrame,   // ULONGLONG* out
    IntPtr ContextPointers   // KNONVOLATILE_CONTEXT_POINTERS* optional, in/out
);

<DllImport("KERNEL32.dll", ExactSpelling:=True)>
Public Shared Function RtlVirtualUnwind(
    HandlerType As UInteger,   ' RTL_VIRTUAL_UNWIND_HANDLER_TYPE
    ImageBase As ULong,   ' ULONGLONG
    ControlPc As ULong,   ' ULONGLONG
    FunctionEntry As IntPtr,   ' IMAGE_RUNTIME_FUNCTION_ENTRY*
    ContextRecord As IntPtr,   ' CONTEXT* in/out
    HandlerData As IntPtr,   ' void** out
    <Out> ByRef EstablisherFrame As ULong,   ' ULONGLONG* out
    ContextPointers As IntPtr   ' KNONVOLATILE_CONTEXT_POINTERS* optional, in/out
) As IntPtr
End Function

' HandlerType : RTL_VIRTUAL_UNWIND_HANDLER_TYPE
' ImageBase : ULONGLONG
' ControlPc : ULONGLONG
' FunctionEntry : IMAGE_RUNTIME_FUNCTION_ENTRY*
' ContextRecord : CONTEXT* in/out
' HandlerData : void** out
' EstablisherFrame : ULONGLONG* out
' ContextPointers : KNONVOLATILE_CONTEXT_POINTERS* optional, in/out
Declare PtrSafe Function RtlVirtualUnwind Lib "kernel32" ( _
    ByVal HandlerType As Long, _
    ByVal ImageBase As LongLong, _
    ByVal ControlPc As LongLong, _
    ByVal FunctionEntry As LongPtr, _
    ByVal ContextRecord As LongPtr, _
    ByVal HandlerData As LongPtr, _
    ByRef EstablisherFrame As LongLong, _
    ByVal ContextPointers As LongPtr) As LongPtr
' VBA7前提(PtrSafe)。32bit Office では LongPtr→Long。Integer=16bit / Long=32bit / LongLong=64bit。

import ctypes
from ctypes import wintypes

RtlVirtualUnwind = ctypes.windll.kernel32.RtlVirtualUnwind
RtlVirtualUnwind.restype = ctypes.c_void_p
RtlVirtualUnwind.argtypes = [
    wintypes.DWORD,  # HandlerType : RTL_VIRTUAL_UNWIND_HANDLER_TYPE
    ctypes.c_ulonglong,  # ImageBase : ULONGLONG
    ctypes.c_ulonglong,  # ControlPc : ULONGLONG
    ctypes.c_void_p,  # FunctionEntry : IMAGE_RUNTIME_FUNCTION_ENTRY*
    ctypes.c_void_p,  # ContextRecord : CONTEXT* in/out
    ctypes.c_void_p,  # HandlerData : void** out
    ctypes.POINTER(ctypes.c_ulonglong),  # EstablisherFrame : ULONGLONG* out
    ctypes.c_void_p,  # ContextPointers : KNONVOLATILE_CONTEXT_POINTERS* optional, in/out
]

require 'fiddle'
require 'fiddle/import'

lib = Fiddle.dlopen('KERNEL32.dll')
RtlVirtualUnwind = Fiddle::Function.new(
  lib['RtlVirtualUnwind'],
  [
    -Fiddle::TYPE_INT,  # HandlerType : RTL_VIRTUAL_UNWIND_HANDLER_TYPE
    -Fiddle::TYPE_LONG_LONG,  # ImageBase : ULONGLONG
    -Fiddle::TYPE_LONG_LONG,  # ControlPc : ULONGLONG
    Fiddle::TYPE_VOIDP,  # FunctionEntry : IMAGE_RUNTIME_FUNCTION_ENTRY*
    Fiddle::TYPE_VOIDP,  # ContextRecord : CONTEXT* in/out
    Fiddle::TYPE_VOIDP,  # HandlerData : void** out
    Fiddle::TYPE_VOIDP,  # EstablisherFrame : ULONGLONG* out
    Fiddle::TYPE_VOIDP,  # ContextPointers : KNONVOLATILE_CONTEXT_POINTERS* optional, in/out
  ],
  Fiddle::TYPE_VOIDP)

#[link(name = "kernel32")]
extern "system" {
    fn RtlVirtualUnwind(
        HandlerType: u32,  // RTL_VIRTUAL_UNWIND_HANDLER_TYPE
        ImageBase: u64,  // ULONGLONG
        ControlPc: u64,  // ULONGLONG
        FunctionEntry: *mut IMAGE_RUNTIME_FUNCTION_ENTRY,  // IMAGE_RUNTIME_FUNCTION_ENTRY*
        ContextRecord: *mut CONTEXT,  // CONTEXT* in/out
        HandlerData: *mut *mut (),  // void** out
        EstablisherFrame: *mut u64,  // ULONGLONG* out
        ContextPointers: *mut KNONVOLATILE_CONTEXT_POINTERS  // KNONVOLATILE_CONTEXT_POINTERS* optional, in/out
    ) -> *const core::ffi::c_void;
}
// crates: windows-sys provides ready-made bindings for this API.

$sig = @"
[DllImport("KERNEL32.dll")]
public static extern IntPtr RtlVirtualUnwind(uint HandlerType, ulong ImageBase, ulong ControlPc, IntPtr FunctionEntry, IntPtr ContextRecord, IntPtr HandlerData, out ulong EstablisherFrame, IntPtr ContextPointers);
"@
$api = Add-Type -MemberDefinition $sig -Name 'KERNEL32_RtlVirtualUnwind' -Namespace Win32 -PassThru
# $api::RtlVirtualUnwind(HandlerType, ImageBase, ControlPc, FunctionEntry, ContextRecord, HandlerData, EstablisherFrame, ContextPointers)

#uselib "KERNEL32.dll"
#func global RtlVirtualUnwind "RtlVirtualUnwind" sptr, sptr, sptr, sptr, sptr, sptr, sptr, sptr
; RtlVirtualUnwind HandlerType, ImageBase, ControlPc, varptr(FunctionEntry), varptr(ContextRecord), HandlerData, varptr(EstablisherFrame), varptr(ContextPointers)   ; 戻り値は stat
; HandlerType : RTL_VIRTUAL_UNWIND_HANDLER_TYPE -> "sptr"
; ImageBase : ULONGLONG -> "sptr"
; ControlPc : ULONGLONG -> "sptr"
; FunctionEntry : IMAGE_RUNTIME_FUNCTION_ENTRY* -> "sptr"
; ContextRecord : CONTEXT* in/out -> "sptr"
; HandlerData : void** out -> "sptr"
; EstablisherFrame : ULONGLONG* out -> "sptr"
; ContextPointers : KNONVOLATILE_CONTEXT_POINTERS* optional, in/out -> "sptr"
; ※HSP3.7は int64 引数(64bit値渡し)に非対応です。
; ※HSP3.7は #func のため戻り値はシステム変数 stat に格納されます。

出力引数:

#uselib "KERNEL32.dll"
#cfunc global RtlVirtualUnwind "RtlVirtualUnwind" int, int64, int64, var, var, sptr, var, var
; res = RtlVirtualUnwind(HandlerType, ImageBase, ControlPc, FunctionEntry, ContextRecord, HandlerData, EstablisherFrame, ContextPointers)
; HandlerType : RTL_VIRTUAL_UNWIND_HANDLER_TYPE -> "int"
; ImageBase : ULONGLONG -> "int64"
; ControlPc : ULONGLONG -> "int64"
; FunctionEntry : IMAGE_RUNTIME_FUNCTION_ENTRY* -> "var"
; ContextRecord : CONTEXT* in/out -> "var"
; HandlerData : void** out -> "sptr"
; EstablisherFrame : ULONGLONG* out -> "var"
; ContextPointers : KNONVOLATILE_CONTEXT_POINTERS* optional, in/out -> "var"
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。
; ※int64 引数の DLL 値渡しは x64 ランタイム(hsp3_64)のみ対応(x86 は未対応)。#uselib "KERNEL32.dll"
#cfunc global RtlVirtualUnwind "RtlVirtualUnwind" int, int64, int64, sptr, sptr, sptr, sptr, sptr
; res = RtlVirtualUnwind(HandlerType, ImageBase, ControlPc, varptr(FunctionEntry), varptr(ContextRecord), HandlerData, varptr(EstablisherFrame), varptr(ContextPointers))
; HandlerType : RTL_VIRTUAL_UNWIND_HANDLER_TYPE -> "int"
; ImageBase : ULONGLONG -> "int64"
; ControlPc : ULONGLONG -> "int64"
; FunctionEntry : IMAGE_RUNTIME_FUNCTION_ENTRY* -> "sptr"
; ContextRecord : CONTEXT* in/out -> "sptr"
; HandlerData : void** out -> "sptr"
; EstablisherFrame : ULONGLONG* out -> "sptr"
; ContextPointers : KNONVOLATILE_CONTEXT_POINTERS* optional, in/out -> "sptr"
; ※出力/バッファ引数はポインタ方式(token=sptr / 呼び出しは varptr(変数))。
; ※int64 引数の DLL 値渡しは x64 ランタイム(hsp3_64)のみ対応(x86 は未対応)。

出力引数:

; EXCEPTION_ROUTINE RtlVirtualUnwind(RTL_VIRTUAL_UNWIND_HANDLER_TYPE HandlerType, ULONGLONG ImageBase, ULONGLONG ControlPc, IMAGE_RUNTIME_FUNCTION_ENTRY* FunctionEntry, CONTEXT* ContextRecord, void** HandlerData, ULONGLONG* EstablisherFrame, KNONVOLATILE_CONTEXT_POINTERS* ContextPointers)
#uselib "KERNEL32.dll"
#cfunc global RtlVirtualUnwind "RtlVirtualUnwind" int, int64, int64, var, var, intptr, var, var
; res = RtlVirtualUnwind(HandlerType, ImageBase, ControlPc, FunctionEntry, ContextRecord, HandlerData, EstablisherFrame, ContextPointers)
; HandlerType : RTL_VIRTUAL_UNWIND_HANDLER_TYPE -> "int"
; ImageBase : ULONGLONG -> "int64"
; ControlPc : ULONGLONG -> "int64"
; FunctionEntry : IMAGE_RUNTIME_FUNCTION_ENTRY* -> "var"
; ContextRecord : CONTEXT* in/out -> "var"
; HandlerData : void** out -> "intptr"
; EstablisherFrame : ULONGLONG* out -> "var"
; ContextPointers : KNONVOLATILE_CONTEXT_POINTERS* optional, in/out -> "var"
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。; EXCEPTION_ROUTINE RtlVirtualUnwind(RTL_VIRTUAL_UNWIND_HANDLER_TYPE HandlerType, ULONGLONG ImageBase, ULONGLONG ControlPc, IMAGE_RUNTIME_FUNCTION_ENTRY* FunctionEntry, CONTEXT* ContextRecord, void** HandlerData, ULONGLONG* EstablisherFrame, KNONVOLATILE_CONTEXT_POINTERS* ContextPointers)
#uselib "KERNEL32.dll"
#cfunc global RtlVirtualUnwind "RtlVirtualUnwind" int, int64, int64, intptr, intptr, intptr, intptr, intptr
; res = RtlVirtualUnwind(HandlerType, ImageBase, ControlPc, varptr(FunctionEntry), varptr(ContextRecord), HandlerData, varptr(EstablisherFrame), varptr(ContextPointers))
; HandlerType : RTL_VIRTUAL_UNWIND_HANDLER_TYPE -> "int"
; ImageBase : ULONGLONG -> "int64"
; ControlPc : ULONGLONG -> "int64"
; FunctionEntry : IMAGE_RUNTIME_FUNCTION_ENTRY* -> "intptr"
; ContextRecord : CONTEXT* in/out -> "intptr"
; HandlerData : void** out -> "intptr"
; EstablisherFrame : ULONGLONG* out -> "intptr"
; ContextPointers : KNONVOLATILE_CONTEXT_POINTERS* optional, in/out -> "intptr"
; ※出力/バッファ引数はポインタ方式(token=intptr / 呼び出しは varptr(変数))。

import (
	"golang.org/x/sys/windows"
	"unsafe"
)

var (
	kernel32 = windows.NewLazySystemDLL("KERNEL32.dll")
	procRtlVirtualUnwind = kernel32.NewProc("RtlVirtualUnwind")
)

// HandlerType (RTL_VIRTUAL_UNWIND_HANDLER_TYPE), ImageBase (ULONGLONG), ControlPc (ULONGLONG), FunctionEntry (IMAGE_RUNTIME_FUNCTION_ENTRY*), ContextRecord (CONTEXT* in/out), HandlerData (void** out), EstablisherFrame (ULONGLONG* out), ContextPointers (KNONVOLATILE_CONTEXT_POINTERS* optional, in/out)
r1, _, err := procRtlVirtualUnwind.Call(
	uintptr(HandlerType),
	uintptr(ImageBase),
	uintptr(ControlPc),
	uintptr(FunctionEntry),
	uintptr(ContextRecord),
	uintptr(HandlerData),
	uintptr(EstablisherFrame),
	uintptr(ContextPointers),
)
_ = err  // syscall.Errno (valid when the call sets last-error)
_ = r1   // EXCEPTION_ROUTINE

function RtlVirtualUnwind(
  HandlerType: DWORD;   // RTL_VIRTUAL_UNWIND_HANDLER_TYPE
  ImageBase: UInt64;   // ULONGLONG
  ControlPc: UInt64;   // ULONGLONG
  FunctionEntry: Pointer;   // IMAGE_RUNTIME_FUNCTION_ENTRY*
  ContextRecord: Pointer;   // CONTEXT* in/out
  HandlerData: Pointer;   // void** out
  EstablisherFrame: Pointer;   // ULONGLONG* out
  ContextPointers: Pointer   // KNONVOLATILE_CONTEXT_POINTERS* optional, in/out
): Pointer; stdcall;
  external 'KERNEL32.dll' name 'RtlVirtualUnwind';

result := DllCall("KERNEL32\RtlVirtualUnwind"
    , "UInt", HandlerType   ; RTL_VIRTUAL_UNWIND_HANDLER_TYPE
    , "Int64", ImageBase   ; ULONGLONG
    , "Int64", ControlPc   ; ULONGLONG
    , "Ptr", FunctionEntry   ; IMAGE_RUNTIME_FUNCTION_ENTRY*
    , "Ptr", ContextRecord   ; CONTEXT* in/out
    , "Ptr", HandlerData   ; void** out
    , "Ptr", EstablisherFrame   ; ULONGLONG* out
    , "Ptr", ContextPointers   ; KNONVOLATILE_CONTEXT_POINTERS* optional, in/out
    , "Ptr")   ; return: EXCEPTION_ROUTINE

●RtlVirtualUnwind(HandlerType, ImageBase, ControlPc, FunctionEntry, ContextRecord, HandlerData, EstablisherFrame, ContextPointers) = DLL("KERNEL32.dll", "void* RtlVirtualUnwind(dword, qword, qword, void*, void*, void*, void*, void*)")
# 呼び出し: RtlVirtualUnwind(HandlerType, ImageBase, ControlPc, FunctionEntry, ContextRecord, HandlerData, EstablisherFrame, ContextPointers)
# HandlerType : RTL_VIRTUAL_UNWIND_HANDLER_TYPE -> "dword"
# ImageBase : ULONGLONG -> "qword"
# ControlPc : ULONGLONG -> "qword"
# FunctionEntry : IMAGE_RUNTIME_FUNCTION_ENTRY* -> "void*"
# ContextRecord : CONTEXT* in/out -> "void*"
# HandlerData : void** out -> "void*"
# EstablisherFrame : ULONGLONG* out -> "void*"
# ContextPointers : KNONVOLATILE_CONTEXT_POINTERS* optional, in/out -> "void*"
# なでしこ1は32bit・ANSI(Shift_JIS)。文字列=char*(ANSI)、ポインタ/ハンドル=void*(4byte)。