Function GetCallStack

HijackMethod_arm64/dllmain.cpp:29–115

}

void GetCallStack(std::string& callStack) {
    CONTEXT context;
    RtlCaptureContext(&context);

    DWORD64 imageBase;
    DWORD64 controlPc = context.Pc;
    DWORD64 frameBase = context.Fp;

    HMODULE hKernel32 = GetModuleHandleA("kernel32.dll");
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    MODULEINFO kernel32Info = { 0 };
    MODULEINFO ntdllInfo = { 0 };
    GetModuleInformation(GetCurrentProcess(), hKernel32, &kernel32Info, sizeof(kernel32Info));
    GetModuleInformation(GetCurrentProcess(), hNtdll, &ntdllInfo, sizeof(ntdllInfo));


    std::ostringstream oss;

    oss << "已触发QQ文件校验退出函数, 一般情况下有可能是LLQQNT框架/插件导致的问题\n有任何问题请到Repo开issue, 带上你的截图\nCallStack:\n";

    /*Skip self*/
    UNWIND_HISTORY_TABLE historyTable;
    ZeroMemory(&historyTable, sizeof(UNWIND_HISTORY_TABLE));
    PRUNTIME_FUNCTION pFunction = RtlLookupFunctionEntry(controlPc, &imageBase, &historyTable);
    if (pFunction != NULL) {
        PVOID handlerData;
        ULONG64 establisherFrame;
        RtlVirtualUnwind(UNW_FLAG_NHANDLER, imageBase, controlPc, pFunction, &context, &handlerData, &establisherFrame, NULL);
        controlPc = context.Pc;
        frameBase = context.Fp;
    }
    /*---------*/

    for (int i = 0; i < 16; ++i) {
        if (controlPc == 0) {
            break;
        }

        if ((controlPc >= (DWORD64)hKernel32 && controlPc < (DWORD64)hKernel32 + kernel32Info.SizeOfImage))
        {
            oss << "in module kernel32.dll | Maybe BaseThreadInitThunk\n";
        }
        else if ((controlPc >= (DWORD64)hNtdll && controlPc < (DWORD64)hNtdll + ntdllInfo.SizeOfImage))
        {
            oss << "in module ntdll.dll | Maybe RtlUserThreadStart\n";
        }

        oss << "Address: 0x" << std::hex << controlPc << std::endl;

        BYTE buffer[32];
        SIZE_T bytesRead;
        if (ReadProcessMemory(GetCurrentProcess(), (LPCVOID)controlPc, buffer, sizeof(buffer), &bytesRead))
        {
            oss << "Data: ";
            for (SIZE_T j = 0; j < bytesRead; ++j) {
                oss << std::setw(2) << std::setfill('0') << std::hex << (int)buffer[j] << " ";
            }
            oss << std::endl;