Function RtlpDeleteInvertedFunctionTableEntry

loader/mappedmodule.cpp:320–357

}

void RtlpDeleteInvertedFunctionTableEntry(PVOID ImageBase) {

    uintptr_t mrData = 0;
    DWORD mrDataSize = 0;
    auto table = FindLdrpInvertedFunctionTable(mrData, mrDataSize);
    DWORD oldProtect = 0;

    if (table == nullptr) {
        throw std::runtime_error("[!] Failed to find LdrpInvertedFunctionTable\n");
    }

    VirtualProtect(PVOID(mrData), mrDataSize, PAGE_READWRITE, &oldProtect);

    auto entryIndex = 1;

    while (entryIndex < table->Count) {
        if (ImageBase == table->Entries[entryIndex].ImageBase) {
            break;
        }
        entryIndex++;
    }

    if (entryIndex <= table->Count) {
        if (entryIndex != table->Count) {

            InterlockedDecrement(&table->Epoch);
            auto moved_entries = table->Count - entryIndex;

            memmove(&table->Entries[entryIndex],
                &table->Entries[entryIndex + 1],
                moved_entries * sizeof(INVERTED_FUNCTION_TABLE_ENTRY));
        }
    }

    InterlockedDecrement(&table->Epoch);
    table->Overflow = 0;
    table->Count--;
}

static void AddExceptionSupport(const Pe::PeNative& mappedPe){