Function RtlpInsertInvertedFunctionTableEntry

loader/mappedmodule.cpp:266–318

http://uninformed.org/index.cgi?v=8&a=2&p=20 Currently this only works for Windows 8+. The RTL_INVERTED_FUNCTION_TABLE memory layout is different for x86 on older platforms

// Currently this only works for Windows 8+.  
// The RTL_INVERTED_FUNCTION_TABLE memory layout is different for x86 on older platforms
void RtlpInsertInvertedFunctionTableEntry(PVOID ImageBase, ULONG ImageSize, PVOID ExceptionDirectory, ULONG ExceptionDirectorySize) {

    uintptr_t mrData = 0;
    DWORD mrDataSize = 0;
    auto table = FindLdrpInvertedFunctionTable(mrData, mrDataSize);
    DWORD oldProtect = 0;

    if (table == nullptr) {
        throw std::runtime_error("[!] Failed to find LdrpInvertedFunctionTable\n");
    }
    
    VirtualProtect(PVOID(mrData), mrDataSize, PAGE_READWRITE, &oldProtect);

    auto entryIndex = 1;

    if (table->Count == table->MaxCount) {
        table->Overflow = 1;
    }
    else {

        InterlockedIncrement(&table->Epoch);
        entryIndex = 1;

        if (table->Count != 1) {
            while (entryIndex < table->Count) {
                if (ImageBase < table->Entries[entryIndex].ImageBase) {
                    break;
                }
                entryIndex++;
            }
        }

        if (entryIndex != table->Count) {
            memmove(&table->Entries[entryIndex + 1],
                &table->Entries[entryIndex],
                (table->Count - entryIndex) * sizeof(INVERTED_FUNCTION_TABLE_ENTRY));
        }
    }

    table->Entries[entryIndex].ImageBase = ImageBase;
    table->Entries[entryIndex].SizeOfImage = ImageSize;
#if defined(__x86_64__) || defined(_M_X64)
    table->Entries[entryIndex].FunctionTable = (IMAGE_RUNTIME_FUNCTION_ENTRY*)ExceptionDirectory;
#else
    //x86 function table addresses are masked for additional protection
    table->Entries[entryIndex].FunctionTable = (IMAGE_RUNTIME_FUNCTION_ENTRY*)RtlEncodeSystemPointer(ExceptionDirectory);
#endif
    table->Entries[entryIndex].SizeOfTable = ExceptionDirectorySize;
    table->Count++;
    InterlockedIncrement(&table->Epoch);

    VirtualProtect(PVOID(mrData), mrDataSize, oldProtect, &oldProtect);
}

void RtlpDeleteInvertedFunctionTableEntry(PVOID ImageBase) {