Function FindLdrpInvertedFunctionTable

loader/mappedmodule.cpp:201–260

}

static RTL_INVERTED_FUNCTION_TABLE* FindLdrpInvertedFunctionTable(uintptr_t& mrDataPtr, DWORD& mrDataSize) {

    auto ntPe = Pe::PeNative::fromModule(GetModuleHandle("ntdll.dll"));
    auto mrData = FindSection(".mrdata", ntPe);
    RTL_INVERTED_FUNCTION_TABLE* table = nullptr;

    if (mrData == nullptr) {
        return nullptr;
    }

    mrDataPtr = uintptr_t(ntPe.base()) + mrData->VirtualAddress;
    uintptr_t mrDataPtrEnd = mrDataPtr + mrData->SizeOfRawData;
    mrDataSize = mrData->SizeOfRawData;

    //Iterate through the .mrdata section of ntdll a byte at a time searching for the LdrpInvertedFunctionTable
    while (mrDataPtr++ < mrDataPtrEnd) {

        table = reinterpret_cast<RTL_INVERTED_FUNCTION_TABLE*>(mrDataPtr);

        // Basic checks for a candidate table, if these are out of range, 
        // it's not the table we are looking for
        if (table->MaxCount > 512 || table->MaxCount == 0 || table->Count == 0 || table->Count > table->MaxCount)
            continue;

        MEMORY_BASIC_INFORMATION mbi = {};

        // We only need to check the first entry in the table which is always ntdll.dll.  
        // If the entry has the following attributes, we have a candidate for further checks
        //  * Exception table is within the range of the image memory address space
        //  * The ImageBase is indeed allocated, valid and commited to memory  
        //  * The initial allocation of the memory range was allocated with WRX, which is typical of loaded modules
        if (table->Entries[0].FunctionTable < table->Entries[0].ImageBase ||
                uintptr_t(table->Entries[0].FunctionTable) >= uintptr_t(table->Entries[0].ImageBase) + table->Entries[0].SizeOfImage ||
                NtQueryVirtualMemory(GetCurrentProcess(), table->Entries[0].ImageBase, MemoryBasicInformation, &mbi, sizeof(mbi), nullptr) != 0 ||
                (mbi.State & MEM_COMMIT) == 0 ||
                (mbi.AllocationProtect != PAGE_EXECUTE_WRITECOPY))
            continue;

        //Now that we are fairy certain the ImageBase is ntdll, lets double check
        //by parsing the PE from memory and checking that it looks like a PE
        auto tablePe = Pe::PeNative::fromModule(table->Entries[0].ImageBase);
        auto exceptionTableSize = 0ul;
        auto exceptionTable = GetExceptionTables(tablePe, exceptionTableSize);

        // The final checks for the inverted function table:
        //  * Does the ImageBase memory contents looks like a PE
        //  * Does the imageSize of the parse PE match the entry within the table
        //  * Does the size of the execption information in the PE match that of the table
        //  * Does the address of the exception table from the PE match the entry in the table   
        if (!tablePe.valid() || 
                tablePe.imageSize() != table->Entries[0].SizeOfImage ||
                exceptionTableSize != table->Entries[0].SizeOfTable ||
                exceptionTable != table->Entries[0].FunctionTable)
            continue;

        break;
    }