Windows SEH学习 x86

VOID   KiDispatchException (
      IN PEXCEPTION_RECORD ExceptionRecord,
      IN PKEXCEPTION_FRAME ExceptionFrame,
      IN PKTRAP_FRAME TrapFrame,
      IN KPROCESSOR_MODE PreviousMode,
      IN BOOLEAN FirstChance );

VOID
KiDispatchException (
    IN PEXCEPTION_RECORD ExceptionRecord,
    IN PKEXCEPTION_FRAME ExceptionFrame,
    IN PKTRAP_FRAME TrapFrame,
    IN KPROCESSOR_MODE PreviousMode,
    IN BOOLEAN FirstChance
    )

/*++

Routine Description:

    This function is called to dispatch an exception to the proper mode and
    to cause the exception dispatcher to be called. If the previous mode is
    kernel, then the exception dispatcher is called directly to process the
    exception. Otherwise the exception record, exception frame, and trap
    frame contents are copied to the user mode stack. The contents of the
    exception frame and trap are then modified such that when control is
    returned, execution will commense in user mode in a routine which will
    call the exception dispatcher.

Arguments:

    ExceptionRecord - Supplies a pointer to an exception record.

    ExceptionFrame - Supplies a pointer to an exception frame. For NT386,
        this should be NULL.

    TrapFrame - Supplies a pointer to a trap frame.

    PreviousMode - Supplies the previous processor mode.

    FirstChance - Supplies a boolean value that specifies whether this is
        the first (TRUE) or second (FALSE) chance for the exception.

Return Value:

    None.

--*/

{

    CONTEXT ContextRecord;
    BOOLEAN DebugService;
    EXCEPTION_RECORD ExceptionRecord1;
    BOOLEAN ExceptionWasForwarded = FALSE;
    ULONG64 FaultingRsp;
    PMACHINE_FRAME MachineFrame;
    ULONG64 UserStack1;
    ULONG64 UserStack2;

    //
    // Move machine state from trap and exception frames to a context frame
    // and increment the number of exceptions dispatched.
    //

    KeGetCurrentPrcb()->KeExceptionDispatchCount += 1;
    ContextRecord.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS | CONTEXT_SEGMENTS;
    //在当前栈中分配一个 CONTEXT，调用 KeContextFromKframes 初始化它
    KeContextFromKframes(TrapFrame, ExceptionFrame, &ContextRecord);

    //
    // If the exception is a break point, then convert the break point to a
    // fault.
    //

    if (ExceptionRecord->ExceptionCode == STATUS_BREAKPOINT) {
        ContextRecord.Rip -= 1;
    }

    //
    // If the exception is an internal general protect fault, invalid opcode,
    // or integer divide by zero, then attempt to resolve the problem without
    // actually raising an exception.
    // 

    if (KiPreprocessFault(ExceptionRecord,
                          TrapFrame,
                          &ContextRecord,
                          PreviousMode) != FALSE) {

        goto Handled1;
    }

    //
    // Select the method of handling the exception based on the previous mode.
    //

    if (PreviousMode == KernelMode) {

        //
        // Previous mode was kernel.
        //
        // If the kernel debugger is active, then give the kernel debugger
        // the first chance to handle the exception. If the kernel debugger
        // handles the exception, then continue execution. Otherwise, attempt
        // to dispatch the exception to a frame based handler. If a frame
        // based handler handles the exception, then continue execution.
        //
        // If a frame based handler does not handle the exception, give the
        // kernel debugger a second chance, if it‘s present.
        //
        // If the exception is still unhandled call bugcheck.
        //

        if (FirstChance != FALSE) {
            if ((KiDebugRoutine)(TrapFrame,  //内核调试器处理  KdpTrap   KdpStub
                                 ExceptionFrame,
                                 ExceptionRecord,
                                 &ContextRecord,
                                 PreviousMode,
                                 FALSE) != FALSE) {

                goto Handled1;
            }

            //
            // Kernel debugger didn‘t handle exception.
            //
            // If interrupts are disabled, then bugcheck.
            //

            if (RtlDispatchException(ExceptionRecord, &ContextRecord) != FALSE) {
                goto Handled1;
            }
        }

        //
        // This is the second chance to handle the exception.
        //

        if ((KiDebugRoutine)(TrapFrame,
                             ExceptionFrame,
                             ExceptionRecord,
                             &ContextRecord,
                             PreviousMode,
                             TRUE) != FALSE) {

            goto Handled1;
        }
        //蓝屏
        KeBugCheckEx(KMODE_EXCEPTION_NOT_HANDLED,
                     ExceptionRecord->ExceptionCode,
                     (ULONG64)ExceptionRecord->ExceptionAddress,
                     ExceptionRecord->ExceptionInformation[0],
                     ExceptionRecord->ExceptionInformation[1]);

    } else {  //UserMode

        //
        // Previous mode was user.
        //
        // If this is the first chance and the current process has a debugger
        // port, then send a message to the debugger port and wait for a reply.
        // If the debugger handles the exception, then continue execution. Else
        // transfer the exception information to the user stack, transition to
        // user mode, and attempt to dispatch the exception to a frame based
        // handler. If a frame based handler handles the exception, then continue
        // execution with the continue system service. Else execute the
        // NtRaiseException system service with FirstChance == FALSE, which
        // will call this routine a second time to process the exception.
        //
        // If this is the second chance and the current process has a debugger
        // port, then send a message to the debugger port and wait for a reply.
        // If the debugger handles the exception, then continue execution. Else
        // if the current process has a subsystem port, then send a message to
        // the subsystem port and wait for a reply. If the subsystem handles the
        // exception, then continue execution. Else terminate the process.
        //
        // If the current process is a wow64 process, an alignment fault has
        // occurred, and the AC bit is set in EFLAGS, then clear AC in EFLAGS
        // and continue execution. Otherwise, attempt to resolve the exception.
        //

        if ((PsGetCurrentProcess()->Wow64Process != NULL) &&
            (ExceptionRecord->ExceptionCode == STATUS_DATATYPE_MISALIGNMENT) &&
            ((TrapFrame->EFlags & EFLAGS_AC_MASK) != 0)) {

            TrapFrame->EFlags &= ~EFLAGS_AC_MASK;
            goto Handled2;
        }

        //
        // If the exception happened while executing 32-bit code, then convert
        // the exception to a wow64 exception. These codes are translated later
        // by wow64.
        //

        if ((ContextRecord.SegCs & 0xfff8) == KGDT64_R3_CMCODE) {
            
            switch (ExceptionRecord->ExceptionCode) {
            case STATUS_BREAKPOINT:
                ExceptionRecord->ExceptionCode = STATUS_WX86_BREAKPOINT;
                break;

            case STATUS_SINGLE_STEP:
                ExceptionRecord->ExceptionCode = STATUS_WX86_SINGLE_STEP;
                break;
            }

            //
            // Clear the upper 32-bits of the stack address and 16-byte
            // align the stack address.
            //

            FaultingRsp = (ContextRecord.Rsp & 0xfffffff0UI64);

        } else {
            FaultingRsp = ContextRecord.Rsp;
        }

        if (FirstChance == TRUE) {

            //
            // This is the first chance to handle the exception.
            //
            // If the current processor is not being debugged and user mode
            // exceptions are not being ignored, or this is a debug service,
            // then attempt to handle the exception via the kernel debugger.
            //


            DebugService = KdIsThisAKdTrap(ExceptionRecord,
                                           &ContextRecord,
                                           UserMode);

            if (((PsGetCurrentProcess()->DebugPort == NULL) &&
                 (KdIgnoreUmExceptions == FALSE)) ||
                (DebugService == TRUE)) {

                //
                // Attempt to handle the exception with the kernel debugger.
                //

                if ((KiDebugRoutine)(TrapFrame,
                                     ExceptionFrame,
                                     ExceptionRecord,
                                     &ContextRecord,
                                     PreviousMode,
                                     FALSE) != FALSE) {

                    goto Handled1;
                }
            }

            if ((ExceptionWasForwarded == FALSE) &&
                (DbgkForwardException(ExceptionRecord, TRUE, FALSE))) {

                goto Handled2;
            }

            //
            // Clear the trace flag in the trap frame so a spurious trace
            // trap is guaranteed not to occur in the trampoline code.
            //
    
            TrapFrame->EFlags &= ~EFLAGS_TF_MASK;

            //
            // Transfer exception information to the user stack, transition
            // to user mode, and attempt to dispatch the exception to a frame
            // based handler.
            //

            ExceptionRecord1.ExceptionCode = STATUS_ACCESS_VIOLATION;

        repeat:
            try {

                //
                // Compute address of aligned machine frame, compute address
                // of exception record, compute address of context record,
                // and probe user stack for writeability.
                //

                MachineFrame =
                    (PMACHINE_FRAME)((FaultingRsp - sizeof(MACHINE_FRAME)) & ~STACK_ROUND);

                UserStack1 = (ULONG64)MachineFrame - EXCEPTION_RECORD_LENGTH;
                UserStack2 = UserStack1 - CONTEXT_LENGTH;
                ProbeForWriteSmallStructure((PVOID)UserStack2,
                                            sizeof(MACHINE_FRAME) + EXCEPTION_RECORD_LENGTH + CONTEXT_LENGTH,
                                            STACK_ALIGN);

                //
                // Fill in machine frame information.
                //

                MachineFrame->Rsp = FaultingRsp;
                MachineFrame->Rip = ContextRecord.Rip;

                //
                // Copy exception record to the user stack.
                //

                *(PEXCEPTION_RECORD)UserStack1 = *ExceptionRecord;

                //
                // Copy context record to the user stack.
                //

                *(PCONTEXT)UserStack2 = ContextRecord;

                //
                // Set the address of the new stack pointer in the current
                // trap frame.
                //

                TrapFrame->Rsp = UserStack2;

                //
                // Set the user mode 64-bit code selector.
                //

                TrapFrame->SegCs = KGDT64_R3_CODE | RPL_MASK;

                //
                // Set the address of the exception routine that will call the
                // exception dispatcher and then return to the trap handler.
                // The trap handler will restore the exception and trap frame
                // context and continue execution in the routine that will
                // call the exception dispatcher.
                //

                TrapFrame->Rip = (ULONG64)KeUserExceptionDispatcher;
                return;

            } except (KiCopyInformation(&ExceptionRecord1,
                        (GetExceptionInformation())->ExceptionRecord)) {

                //
                // If the exception is a stack overflow, then attempt to
                // raise the stack overflow exception. Otherwise, the user‘s
                // stack is not accessible, or is misaligned, and second
                // chance processing is performed.
                //

                if (ExceptionRecord1.ExceptionCode == STATUS_STACK_OVERFLOW) {
                    ExceptionRecord1.ExceptionAddress = ExceptionRecord->ExceptionAddress;
                    *ExceptionRecord = ExceptionRecord1;

                    goto repeat;
                }
            }
        }

        //
        // This is the second chance to handle the exception.
        //

        if (DbgkForwardException(ExceptionRecord, TRUE, TRUE)) {
            goto Handled2;

        } else if (DbgkForwardException(ExceptionRecord, FALSE, TRUE)) {
            goto Handled2;

        } else {
            ZwTerminateProcess(NtCurrentProcess(), ExceptionRecord->ExceptionCode);
            KeBugCheckEx(KMODE_EXCEPTION_NOT_HANDLED,
                         ExceptionRecord->ExceptionCode,
                         (ULONG64)ExceptionRecord->ExceptionAddress,
                         ExceptionRecord->ExceptionInformation[0],
                         ExceptionRecord->ExceptionInformation[1]);
        }
    }

    //
    // Move machine state from context frame to trap and exception frames and
    // then return to continue execution with the restored state.
    //

Handled1:
    KeContextToKframes(TrapFrame,
                       ExceptionFrame,
                       &ContextRecord,
                       ContextRecord.ContextFlags,
                       PreviousMode);

    //
    // Exception was handled by the debugger or the associated subsystem
    // and state was modified, if necessary, using the get state and set
    // state capabilities. Therefore the context frame does not need to
    // be transferred to the trap and exception frames.
    //

Handled2:
    return;
}

BOOLEAN
RtlDispatchException (
    IN PEXCEPTION_RECORD ExceptionRecord,
    IN PCONTEXT ContextRecord
    )

/*++

Routine Description:

    This function attempts to dispatch an exception to a call frame based
    handler by searching backwards through the stack based call frames. The
    search begins with the frame specified in the context record and continues
    backward until either a handler is found that handles the exception, the
    stack is found to be invalid (i.e., out of limits or unaligned), or the end
    of the call hierarchy is reached.

Arguments:

    ExceptionRecord - Supplies a pointer to an exception record.

    ContextRecord - Supplies a pointer to a context record.

Return Value:

    If the exception is handled by one of the frame based handlers, then
    a value of TRUE is returned. Otherwise a value of FALSE is returned.

--*/

{

    BOOLEAN Completion = FALSE;
    DISPATCHER_CONTEXT DispatcherContext;
    EXCEPTION_DISPOSITION Disposition;
    PEXCEPTION_REGISTRATION_RECORD RegistrationPointer;
    PEXCEPTION_REGISTRATION_RECORD NestedRegistration;
    ULONG HighAddress;
    ULONG HighLimit;
    ULONG LowLimit;
    EXCEPTION_RECORD ExceptionRecord1;
    ULONG Index;

    //
    // Get current stack limits.
    //

    RtlpGetStackLimits(&LowLimit, &HighLimit);

    //
    // Start with the frame specified by the context record and search
    // backwards through the call frame hierarchy attempting to find an
    // exception handler that will handler the exception.
    //

    RegistrationPointer = RtlpGetRegistrationHead();
    NestedRegistration = 0;

    while (RegistrationPointer != EXCEPTION_CHAIN_END) {

        //
        // If the call frame is not within the specified stack limits or the
        // call frame is unaligned, then set the stack invalid flag in the
        // exception record and return FALSE. Else check to determine if the
        // frame has an exception handler.
        //

        HighAddress = (ULONG)RegistrationPointer +
            sizeof(EXCEPTION_REGISTRATION_RECORD);

        if ( ((ULONG)RegistrationPointer < LowLimit) ||
             (HighAddress > HighLimit) ||
             (((ULONG)RegistrationPointer & 0x3) != 0) 
           ) {

            //
            // Allow for the possibility that the problem occured on the
            // DPC stack.
            //

            ULONG TestAddress = (ULONG)RegistrationPointer;

            if (((TestAddress & 0x3) == 0) &&
                KeGetCurrentIrql() >= DISPATCH_LEVEL) {

                PKPRCB Prcb = KeGetCurrentPrcb();
                ULONG DpcStack = (ULONG)Prcb->DpcStack;

                if ((Prcb->DpcRoutineActive) &&
                    (HighAddress <= DpcStack) &&
                    (TestAddress >= DpcStack - KERNEL_STACK_SIZE)) {

                    //
                    // This error occured on the DPC stack, switch
                    // stack limits to the DPC stack and restart
                    // the loop.
                    //

                    HighLimit = DpcStack;
                    LowLimit = DpcStack - KERNEL_STACK_SIZE;
                    continue;
                }
            }

            ExceptionRecord->ExceptionFlags |= EXCEPTION_STACK_INVALID;
            goto DispatchExit;
        }

        // See if the handler is reasonable

        if (!RtlIsValidHandler(RegistrationPointer->Handler)) {
            ExceptionRecord->ExceptionFlags |= EXCEPTION_STACK_INVALID;
            goto DispatchExit;
        }

        //
        // The handler must be executed by calling another routine
        // that is written in assembler. This is required because
        // up level addressing of the handler information is required
        // when a nested exception is encountered.
        //

        if (NtGlobalFlag & FLG_ENABLE_EXCEPTION_LOGGING) {
            Index = RtlpLogExceptionHandler(
                            ExceptionRecord,
                            ContextRecord,
                            0,
                            (PULONG)RegistrationPointer,
                            4 * sizeof(ULONG));
                    // can‘t use sizeof(EXCEPTION_REGISTRATION_RECORD
                    // because we need the 2 dwords above it.
        }

        Disposition = RtlpExecuteHandlerForException(
            ExceptionRecord,
            (PVOID)RegistrationPointer,
            ContextRecord,
            (PVOID)&DispatcherContext,
            (PEXCEPTION_ROUTINE)RegistrationPointer->Handler);

        if (NtGlobalFlag & FLG_ENABLE_EXCEPTION_LOGGING) {
            RtlpLogLastExceptionDisposition(Index, Disposition);
        }

        //
        // If the current scan is within a nested context and the frame
        // just examined is the end of the context region, then clear
        // the nested context frame and the nested exception in the
        // exception flags.
        //

        if (NestedRegistration == RegistrationPointer) {
            ExceptionRecord->ExceptionFlags &= (~EXCEPTION_NESTED_CALL);
            NestedRegistration = 0;
        }

        //
        // Case on the handler disposition.
        //

        switch (Disposition) {

            //
            // The disposition is to continue execution. If the
            // exception is not continuable, then raise the exception
            // STATUS_NONCONTINUABLE_EXCEPTION. Otherwise return
            // TRUE.
            //

        case ExceptionContinueExecution :
            if ((ExceptionRecord->ExceptionFlags &
               EXCEPTION_NONCONTINUABLE) != 0) {
                ExceptionRecord1.ExceptionCode =
                                        STATUS_NONCONTINUABLE_EXCEPTION;
                ExceptionRecord1.ExceptionFlags = EXCEPTION_NONCONTINUABLE;
                ExceptionRecord1.ExceptionRecord = ExceptionRecord;
                ExceptionRecord1.NumberParameters = 0;
                RtlRaiseException(&ExceptionRecord1);

            } else {
                Completion = TRUE;
                goto DispatchExit;
            }

            //
            // The disposition is to continue the search. If the frame isn‘t
            // suspect/corrupt, get next frame address and continue the search 
            //

        case ExceptionContinueSearch :
            if (ExceptionRecord->ExceptionFlags & EXCEPTION_STACK_INVALID)
                goto DispatchExit;

            break;

            //
            // The disposition is nested exception. Set the nested
            // context frame to the establisher frame address and set
            // nested exception in the exception flags.
            //

        case ExceptionNestedException :
            ExceptionRecord->ExceptionFlags |= EXCEPTION_NESTED_CALL;
            if (DispatcherContext.RegistrationPointer > NestedRegistration) {
                NestedRegistration = DispatcherContext.RegistrationPointer;
            }

            break;

            //
            // All other disposition values are invalid. Raise
            // invalid disposition exception.
            //

        default :
            ExceptionRecord1.ExceptionCode = STATUS_INVALID_DISPOSITION;
            ExceptionRecord1.ExceptionFlags = EXCEPTION_NONCONTINUABLE;
            ExceptionRecord1.ExceptionRecord = ExceptionRecord;
            ExceptionRecord1.NumberParameters = 0;
            RtlRaiseException(&ExceptionRecord1);
            break;
        }

        //
        // If chain goes in wrong direction or loops, report an
        // invalid exception stack, otherwise go on to the next one.
        //

        RegistrationPointer = RegistrationPointer->Next;
    }

    //
    // Call vectored continue handlers.
    //

DispatchExit:

    return Completion;
}

EXCEPTION_DISPOSITION
RtlpExecuteHandlerForException (
    IN PEXCEPTION_RECORD ExceptionRecord,
    IN PVOID EstablisherFrame,
    IN OUT PCONTEXT ContextRecord,
    IN OUT PVOID DispatcherContext,
    IN PEXCEPTION_ROUTINE ExceptionRoutine
    );

DECLSPEC_NOINLINE
VOID
RtlRaiseException (
    IN PEXCEPTION_RECORD ExceptionRecord
    )

/*++

Routine Description:

    This function raises a software exception by building a context record
    and calling the raise exception system service.

Arguments:

    ExceptionRecord - Supplies a pointer to an exception record.

Return Value:

    None.

--*/

{

    CONTEXT ContextRecord;
    ULONG64 ControlPc;
    ULONG64 EstablisherFrame;
    PRUNTIME_FUNCTION FunctionEntry;
    PVOID HandlerData;
    ULONG64 ImageBase;
    NTSTATUS Status = STATUS_INVALID_DISPOSITION;

    //
    // Capture the current context, unwind to the caller of this routine, set
    // the exception address, and call the appropriate exception dispatcher.
    //

    RtlCaptureContext(&ContextRecord);
    ControlPc = ContextRecord.Rip;
    FunctionEntry = RtlLookupFunctionEntry(ControlPc, &ImageBase, NULL);
    if (FunctionEntry != NULL) {
        RtlVirtualUnwind(UNW_FLAG_NHANDLER,
                         ImageBase,
                         ControlPc,
                         FunctionEntry,
                         &ContextRecord,
                         &HandlerData,
                         &EstablisherFrame,
                         NULL);

        ExceptionRecord->ExceptionAddress = (PVOID)ContextRecord.Rip;

        if (RtlDispatchException(ExceptionRecord, &ContextRecord) != FALSE) {
            return;
    
        }

        Status = ZwRaiseException(ExceptionRecord, &ContextRecord, FALSE);
    }

    //
    // There should never be a return from either exception dispatch or the
    // system service unless there is a problem with the argument list itself.
    // Raise another exception specifying the status value returned.
    //

    RtlRaiseStatus(Status);
    return;
}

kd> uf SEHx86!TestSeh
SEHx86!TestSeh [d:\sehx86\sehx86.c @ 18]:
   18 91de8030 8bff            mov     edi,edi
   18 91de8032 55              push    ebp
   18 91de8033 8bec            mov     ebp,esp
   18 91de8035 6afe            push    0FFFFFFFEh
   18 91de8037 68c890de91      push    offset SEHx86!__safe_se_handler_table+0x8 (91de90c8)
   18 91de803c 683081de91      push    offset SEHx86!_except_handler4 (91de8130)
   18 91de8041 64a100000000    mov     eax,dword ptr fs:[00000000h]
   18 91de8047 50              push    eax
   18 91de8048 83c4f4          add     esp,0FFFFFFF4h
   18 91de804b 53              push    ebx
   18 91de804c 56              push    esi
   18 91de804d 57              push    edi
   18 91de804e a100a0de91      mov     eax,dword ptr [SEHx86!__security_cookie (91dea000)]
   18 91de8053 3145f8          xor     dword ptr [ebp-8],eax
   18 91de8056 33c5            xor     eax,ebp
   18 91de8058 50              push    eax
   18 91de8059 8d45f0          lea     eax,[ebp-10h]
   18 91de805c 64a300000000    mov     dword ptr fs:[00000000h],eax
   18 91de8062 8965e8          mov     dword ptr [ebp-18h],esp
   20 91de8065 c745e400000000  mov     dword ptr [ebp-1Ch],0
   22 91de806c c745fc00000000  mov     dword ptr [ebp-4],0
   24 91de8073 c745e411111111  mov     dword ptr [ebp-1Ch],11111111h
   25 91de807a c745fcfeffffff  mov     dword ptr [ebp-4],0FFFFFFFEh
   25 91de8081 eb17            jmp     SEHx86!TestSeh+0x6a (91de809a)

SEHx86!TestSeh+0x6a [d:\sehx86\sehx86.c @ 31]:
   31 91de809a c745fc01000000  mov     dword ptr [ebp-4],1
   33 91de80a1 c745e422222222  mov     dword ptr [ebp-1Ch],22222222h
   35 91de80a8 c745fc02000000  mov     dword ptr [ebp-4],2
   37 91de80af c745e433333333  mov     dword ptr [ebp-1Ch],33333333h
   39 91de80b6 8b45e4          mov     eax,dword ptr [ebp-1Ch]
   39 91de80b9 a300000000      mov     dword ptr ds:[00000000h],eax
   41 91de80be c745fc01000000  mov     dword ptr [ebp-4],1
   41 91de80c5 e802000000      call    SEHx86!TestSeh+0x9c (91de80cc)
   41 91de80ca eb08            jmp     SEHx86!TestSeh+0xa4 (91de80d4)

SEHx86!TestSeh+0xa4 [d:\sehx86\sehx86.c @ 45]:
   45 91de80d4 c745fcfeffffff  mov     dword ptr [ebp-4],0FFFFFFFEh
   45 91de80db eb17            jmp     SEHx86!TestSeh+0xc4 (91de80f4)

SEHx86!TestSeh+0xc4 [d:\sehx86\sehx86.c @ 53]:
   53 91de80f4 8b4df0          mov     ecx,dword ptr [ebp-10h]
   53 91de80f7 64890d00000000  mov     dword ptr fs:[0],ecx
   53 91de80fe 59              pop     ecx
   53 91de80ff 5f              pop     edi
   53 91de8100 5e              pop     esi
   53 91de8101 5b              pop     ebx
   53 91de8102 8be5            mov     esp,ebp
   53 91de8104 5d              pop     ebp
   53 91de8105 c3              ret

VOID
RtlUnwind (
    IN PVOID TargetFrame OPTIONAL,
    IN PVOID TargetIp OPTIONAL,
    IN PEXCEPTION_RECORD ExceptionRecord OPTIONAL,
    IN PVOID ReturnValue
    )

/*++

Routine Description:

    This function initiates an unwind of procedure call frames. The machine
    state at the time of the call to unwind is captured in a context record
    and the unwinding flag is set in the exception flags of the exception
    record. If the TargetFrame parameter is not specified, then the exit unwind
    flag is also set in the exception flags of the exception record. A backward
    walk through the procedure call frames is then performed to find the target
    of the unwind operation.

    N.B.    The captured context passed to unwinding handlers will not be
            a  completely accurate context set for the 386.  This is because
            there isn‘t a standard stack frame in which registers are stored.

            Only the integer registers are affected.  The segment and
            control registers (ebp, esp) will have correct values for
            the flat 32 bit environment.

    N.B.    If you change the number of arguments, make sure you change the
            adjustment of ESP after the call to RtlpCaptureContext (for
            STDCALL calling convention)

Arguments:

    TargetFrame - Supplies an optional pointer to the call frame that is the
        target of the unwind. If this parameter is not specified, then an exit
        unwind is performed.

    TargetIp - Supplies an optional instruction address that specifies the
        continuation address of the unwind. This address is ignored if the
        target frame parameter is not specified.

    ExceptionRecord - Supplies an optional pointer to an exception record.

    ReturnValue - Supplies a value that is to be placed in the integer
        function return register just before continuing execution.

Return Value:

    None.

--*/

{
    PCONTEXT ContextRecord;
    CONTEXT ContextRecord1;
    DISPATCHER_CONTEXT DispatcherContext;
    EXCEPTION_DISPOSITION Disposition;
    PEXCEPTION_REGISTRATION_RECORD RegistrationPointer;
    PEXCEPTION_REGISTRATION_RECORD PriorPointer;
    ULONG HighAddress;
    ULONG HighLimit;
    ULONG LowLimit;
    EXCEPTION_RECORD ExceptionRecord1;
    EXCEPTION_RECORD ExceptionRecord2;

    //
    // Get current stack limits.
    //

    RtlpGetStackLimits(&LowLimit, &HighLimit);

    //
    // If an exception record is not specified, then build a local exception
    // record for use in calling exception handlers during the unwind operation.
    //

    if (ARGUMENT_PRESENT(ExceptionRecord) == FALSE) {
        ExceptionRecord = &ExceptionRecord1;
        ExceptionRecord1.ExceptionCode = STATUS_UNWIND;
        ExceptionRecord1.ExceptionFlags = 0;
        ExceptionRecord1.ExceptionRecord = NULL;
        ExceptionRecord1.ExceptionAddress = _ReturnAddress();  //返回地址
        ExceptionRecord1.NumberParameters = 0;
    }

    //
    // If the target frame of the unwind is specified, then set EXCEPTION_UNWINDING
    // flag in the exception flags. Otherwise set both EXCEPTION_EXIT_UNWIND and
    // EXCEPTION_UNWINDING flags in the exception flags.
    //

    if (ARGUMENT_PRESENT(TargetFrame) == TRUE) {
        ExceptionRecord->ExceptionFlags |= EXCEPTION_UNWINDING;
    } else {
        ExceptionRecord->ExceptionFlags |= (EXCEPTION_UNWINDING |
                                                        EXCEPTION_EXIT_UNWIND);
    }

    //
    // Capture the context.
    //

    ContextRecord = &ContextRecord1;
    ContextRecord1.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL | CONTEXT_SEGMENTS;
    RtlpCaptureContext(ContextRecord);

    //
    // Adjust captured context to pop our arguments off the stack
    //
    ContextRecord->Esp += sizeof(TargetFrame) +
                          sizeof(TargetIp)    +
                          sizeof(ExceptionRecord) +
                          sizeof(ReturnValue);
    ContextRecord->Eax = (ULONG)ReturnValue;

    //
    // Scan backward through the call frame hierarchy, calling exception
    // handlers as they are encountered, until the target frame of the unwind
    // is reached.
    //

    RegistrationPointer = RtlpGetRegistrationHead();//异常链表头
    while (RegistrationPointer != EXCEPTION_CHAIN_END) {

        //
        // If this is the target of the unwind, then continue execution
        // by calling the continue system service.
        //
        //说明展开完毕
        if ((ULONG)RegistrationPointer == (ULONG)TargetFrame) {
            ZwContinue(ContextRecord, FALSE);

        //
        // If the target frame is lower in the stack than the current frame,
        // then raise STATUS_INVALID_UNWIND exception.
        //

        } else if ( (ARGUMENT_PRESENT(TargetFrame) == TRUE) &&
                    ((ULONG)TargetFrame < (ULONG)RegistrationPointer) ) {
            //超出了异常链表的查找范围
            ExceptionRecord2.ExceptionCode = STATUS_INVALID_UNWIND_TARGET;
            ExceptionRecord2.ExceptionFlags = EXCEPTION_NONCONTINUABLE;
            ExceptionRecord2.ExceptionRecord = ExceptionRecord;
            ExceptionRecord2.NumberParameters = 0;
            RtlRaiseException(&ExceptionRecord2);
        }

        //
        // If the call frame is not within the specified stack limits or the
        // call frame is unaligned, then raise the exception STATUS_BAD_STACK.
        // Else restore the state from the specified frame to the context
        // record.
        //

        HighAddress = (ULONG)RegistrationPointer +
            sizeof(EXCEPTION_REGISTRATION_RECORD);
        //低于线程栈底或者高于线程栈顶，进行错误处理
        if ( ((ULONG)RegistrationPointer < LowLimit) ||
             (HighAddress > HighLimit) ||
             (((ULONG)RegistrationPointer & 0x3) != 0) 
           ) {

            //
            // Allow for the possibility that the problem occured on the
            // DPC stack.
            //

            ULONG TestAddress = (ULONG)RegistrationPointer;
            //& 0x3 检查是否4字节对齐 ，IRQL级别，如果当前正在执行dpc操作，restart
            if (((TestAddress & 0x3) == 0) &&
                KeGetCurrentIrql() >= DISPATCH_LEVEL) {

                PKPRCB Prcb = KeGetCurrentPrcb();
                ULONG DpcStack = (ULONG)Prcb->DpcStack;

                if ((Prcb->DpcRoutineActive) &&
                    (HighAddress <= DpcStack) &&
                    (TestAddress >= DpcStack - KERNEL_STACK_SIZE)) {

                    //
                    // This error occured on the DPC stack, switch
                    // stack limits to the DPC stack and restart
                    // the loop.
                    //

                    HighLimit = DpcStack;
                    LowLimit = DpcStack - KERNEL_STACK_SIZE;
                    continue;
                }
            }

            ExceptionRecord2.ExceptionCode = STATUS_BAD_STACK;
            ExceptionRecord2.ExceptionFlags = EXCEPTION_NONCONTINUABLE;
            ExceptionRecord2.ExceptionRecord = ExceptionRecord;
            ExceptionRecord2.NumberParameters = 0;
            RtlRaiseException(&ExceptionRecord2);
        } else { //一般情况的展开

            //
            // The handler must be executed by calling another routine
            // that is written in assembler. This is required because
            // up level addressing of the handler information is required
            // when a collided unwind is encountered.
            //
            //在内部调用Handler处理函数
            Disposition = RtlpExecuteHandlerForUnwind(
                ExceptionRecord,
                (PVOID)RegistrationPointer,
                ContextRecord,
                (PVOID)&DispatcherContext,
                RegistrationPointer->Handler);

            //
            // Case on the handler disposition.
            //
            //检查Handler的返回值
            switch (Disposition) {

                //
                // The disposition is to continue the search. Get next
                // frame address and continue the search.
                //

            case ExceptionContinueSearch :
                break;

                //
                // The disposition is colided unwind. Maximize the target
                // of the unwind and change the context record pointer.
                //

            case ExceptionCollidedUnwind :

                //
                // Pick up the registration pointer that was active at
                // the time of the unwind, and simply continue.
                //

                RegistrationPointer = DispatcherContext.RegistrationPointer;
                break;


                //
                // All other disposition values are invalid. Raise
                // invalid disposition exception.
                //

            default :
                ExceptionRecord2.ExceptionCode = STATUS_INVALID_DISPOSITION;
                ExceptionRecord2.ExceptionFlags = EXCEPTION_NONCONTINUABLE;
                ExceptionRecord2.ExceptionRecord = ExceptionRecord;
                ExceptionRecord2.NumberParameters = 0;
                RtlRaiseException(&ExceptionRecord2);
                break;
            }

            //
            // Step to next registration record
            //

            PriorPointer = RegistrationPointer;
            RegistrationPointer = RegistrationPointer->Next;

            //
            // Unlink the unwind handler, since it‘s been called.
            //

            RtlpUnlinkHandler(PriorPointer);

            //
            // If chain goes in wrong direction or loops, raise an
            // exception.
            //

        }
    }

    if (TargetFrame == EXCEPTION_CHAIN_END) {

        //
        //  Caller simply wants to unwind all exception records.
        //  This differs from an exit_unwind in that no "exit" is desired.
        //  Do a normal continue, since we‘ve effectively found the
        //  "target" the caller wanted.
        //

        ZwContinue(ContextRecord, FALSE);

    } else {

        //
        //  Either (1) a real exit unwind was performed, or (2) the
        //  specified TargetFrame is not present in the exception handler
        //  list.  In either case, give debugger and subsystem a chance
        //  to see the unwind.
        //

        ZwRaiseException(ExceptionRecord, ContextRecord, FALSE);

    }
    return;
}

.text:00475C9B                   ; int __stdcall RtlUnwind(int, int, PEXCEPTION_RECORD ExceptionRecord, int)
.text:00475C9B                   public _RtlUnwind@16
.text:00475C9B                   _RtlUnwind@16 proc near       ; CODE XREF: __global_unwind2+13p
.text:00475C9B                                                 ; _EH4_GlobalUnwind(x)+10p
.text:00475C9B
.text:00475C9B                   var_384= dword ptr -384h
.text:00475C9B                   var_380= dword ptr -380h
.text:00475C9B                   var_37C= dword ptr -37Ch
.text:00475C9B                   var_378= EXCEPTION_RECORD ptr -378h
.text:00475C9B                   var_328= dword ptr -328h
.text:00475C9B                   var_324= dword ptr -324h
.text:00475C9B                   var_320= dword ptr -320h
.text:00475C9B                   var_31C= dword ptr -31Ch
.text:00475C9B                   var_318= dword ptr -318h
.text:00475C9B                   Context= CONTEXT ptr -2D8h
.text:00475C9B                   var_4= dword ptr -4
.text:00475C9B                   arg_0= dword ptr  8
.text:00475C9B                   ExceptionRecord= dword ptr  10h
.text:00475C9B                   arg_C= dword ptr  14h
.text:00475C9B
.text:00475C9B 8B FF             mov     edi, edi
.text:00475C9D 55                push    ebp
.text:00475C9E 8B EC             mov     ebp, esp
.text:00475CA0 83 E4 F8          and     esp, 0FFFFFFF8h
.text:00475CA3 81 EC 84 03 00 00 sub     esp, 384h
.text:00475CA9 A1 44 2A 52 00    mov     eax, ___security_cookie
.text:00475CAE 33 C4             xor     eax, esp
.text:00475CB0 89 84 24 80 03 00+mov     [esp+384h+var_4], eax
.text:00475CB7 53                push    ebx
.text:00475CB8 56                push    esi
.text:00475CB9 57                push    edi
.text:00475CBA 8B 7D 10          mov     edi, [ebp+ExceptionRecord]
.text:00475CBD 8D 44 24 10       lea     eax, [esp+390h+var_380]
.text:00475CC1 50                push    eax
.text:00475CC2 8D 74 24 18       lea     esi, [esp+394h+var_37C]
.text:00475CC6 E8 80 3D 01 00    call    _RtlpGetStackLimits@8 ; RtlpGetStackLimits(x,x)
.text:00475CCB 84 C0             test    al, al
.text:00475CCD 75 0A             jnz     short loc_475CD9
.text:00475CCF 68 28 00 00 C0    push    0C0000028h            ; Status
.text:00475CD4 E8 9B D0 FB FF    call    _RtlRaiseStatus@4     ; RtlRaiseStatus(x)
.text:00475CD9                   ; ---------------------------------------------------------------------------
.text:00475CD9
.text:00475CD9                   loc_475CD9:                   ; CODE XREF: RtlUnwind(x,x,x,x)+32j
.text:00475CD9 33 F6             xor     esi, esi
.text:00475CDB 3B FE             cmp     edi, esi
.text:00475CDD 75 1F             jnz     short loc_475CFE
.text:00475CDF 8B 45 04          mov     eax, [ebp+4]
.text:00475CE2 8D 7C 24 68       lea     edi, [esp+390h+var_328]
.text:00475CE6 C7 44 24 68 27 00+mov     [esp+390h+var_328], 0C0000027h
.text:00475CEE 89 74 24 6C       mov     [esp+390h+var_324], esi
.text:00475CF2 89 74 24 70       mov     [esp+390h+var_320], esi
.text:00475CF6 89 44 24 74       mov     [esp+390h+var_31C], eax
.text:00475CFA 89 74 24 78       mov     [esp+390h+var_318], esi
.text:00475CFE
.text:00475CFE                   loc_475CFE:                   ; CODE XREF: RtlUnwind(x,x,x,x)+42j
.text:00475CFE 39 75 08          cmp     [ebp+arg_0], esi
.text:00475D01 74 06             jz      short loc_475D09
.text:00475D03 83 4F 04 02       or      dword ptr [edi+4], 2
.text:00475D07 EB 04             jmp     short loc_475D0D
.text:00475D09                   ; ---------------------------------------------------------------------------
.text:00475D09
.text:00475D09                   loc_475D09:                   ; CODE XREF: RtlUnwind(x,x,x,x)+66j
.text:00475D09 83 4F 04 06       or      dword ptr [edi+4], 6
.text:00475D0D
.text:00475D0D                   loc_475D0D:                   ; CODE XREF: RtlUnwind(x,x,x,x)+6Cj
.text:00475D0D 8D 84 24 B8 00 00+lea     eax, [esp+390h+Context]
.text:00475D14 50                push    eax
.text:00475D15 C7 84 24 BC 00 00+mov     [esp+394h+Context.ContextFlags], 10007h
.text:00475D20 E8 3F 01 FE FF    call    _RtlpCaptureContext@4 ; RtlpCaptureContext(x)
.text:00475D25 8B 45 14          mov     eax, [ebp+arg_C]
.text:00475D28 83 84 24 7C 01 00+add     [esp+390h+Context._Esp], 10h
.text:00475D30 89 84 24 68 01 00+mov     [esp+390h+Context._Eax], eax
.text:00475D37 E8 BC 01 FE FF    call    _RtlpGetRegistrationHead@0 ; RtlpGetRegistrationHead()
.text:00475D3C 8B D8             mov     ebx, eax
.text:00475D3E 83 FB FF          cmp     ebx, 0FFFFFFFFh
.text:00475D41 0F 84 DC 00 00 00 jz      loc_475E23
.text:00475D47 33 F6             xor     esi, esi
.text:00475D49 46                inc     esi
.text:00475D4A
.text:00475D4A                   loc_475D4A:                   ; CODE XREF: RtlUnwind(x,x,x,x)+180j
.text:00475D4A 3B 5D 08          cmp     ebx, [ebp+arg_0]
.text:00475D4D 75 11             jnz     short loc_475D60
.text:00475D4F 6A 00             push    0                     ; TestAlert
.text:00475D51 8D 84 24 BC 00 00+lea     eax, [esp+394h+Context]
.text:00475D58 50                push    eax                   ; Context
.text:00475D59 E8 2A D5 FB FF    call    _ZwContinue@8         ; ZwContinue(x,x)
.text:00475D5E EB 2A             jmp     short loc_475D8A
.text:00475D60                   ; ---------------------------------------------------------------------------
.text:00475D60
.text:00475D60                   loc_475D60:                   ; CODE XREF: RtlUnwind(x,x,x,x)+B2j
.text:00475D60 83 7D 08 00       cmp     [ebp+arg_0], 0
.text:00475D64 74 24             jz      short loc_475D8A
.text:00475D66 39 5D 08          cmp     [ebp+arg_0], ebx
.text:00475D69 73 1F             jnb     short loc_475D8A
.text:00475D6B 83 64 24 28 00    and     [esp+390h+var_378.NumberParameters], 0
.text:00475D70 8D 44 24 18       lea     eax, [esp+390h+var_378]
.text:00475D74 50                push    eax                   ; ExceptionRecord
.text:00475D75 C7 44 24 1C 29 00+mov     [esp+394h+var_378.ExceptionCode], 0C0000029h
.text:00475D7D 89 74 24 20       mov     [esp+394h+var_378.ExceptionFlags], esi
.text:00475D81 89 7C 24 24       mov     [esp+394h+var_378.ExceptionRecord], edi
.text:00475D85 E8 96 CF FB FF    call    _RtlRaiseException@4  ; RtlRaiseException(x)
.text:00475D8A                   ; ---------------------------------------------------------------------------
.text:00475D8A
.text:00475D8A                   loc_475D8A:                   ; CODE XREF: RtlUnwind(x,x,x,x)+C3j
.text:00475D8A                                                 ; RtlUnwind(x,x,x,x)+C9j
.text:00475D8A                                                 ; RtlUnwind(x,x,x,x)+CEj
.text:00475D8A 3B 5C 24 14       cmp     ebx, [esp+390h+var_37C]
.text:00475D8E 72 69             jb      short loc_475DF9
.text:00475D90 8D 43 08          lea     eax, [ebx+8]
.text:00475D93 3B 44 24 10       cmp     eax, [esp+390h+var_380]
.text:00475D97 77 60             ja      short loc_475DF9
.text:00475D99 F6 C3 03          test    bl, 3
.text:00475D9C 75 5B             jnz     short loc_475DF9
.text:00475D9E 8B 43 04          mov     eax, [ebx+4]
.text:00475DA1 E8 ED A4 FF FF    call    _RtlIsValidHandler@8  ; RtlIsValidHandler(x,x)
.text:00475DA6 84 C0             test    al, al
.text:00475DA8 74 4F             jz      short loc_475DF9
.text:00475DAA FF 73 04          push    dword ptr [ebx+4]
.text:00475DAD 8D 44 24 10       lea     eax, [esp+394h+var_384]
.text:00475DB1 50                push    eax
.text:00475DB2 8D 84 24 C0 00 00+lea     eax, [esp+398h+Context]
.text:00475DB9 50                push    eax
.text:00475DBA 53                push    ebx
.text:00475DBB 57                push    edi
.text:00475DBC E8 A7 FF FD FF    call    _RtlpExecuteHandlerForUnwind@20 ; RtlpExecuteHandlerForUnwind(x,x,x,x,x)
.text:00475DC1 48                dec     eax
.text:00475DC2 74 29             jz      short loc_475DED
.text:00475DC4 48                dec     eax
.text:00475DC5 48                dec     eax
.text:00475DC6 74 21             jz      short loc_475DE9
.text:00475DC8 83 64 24 28 00    and     [esp+390h+var_378.NumberParameters], 0
.text:00475DCD 8D 44 24 18       lea     eax, [esp+390h+var_378]
.text:00475DD1 50                push    eax                   ; ExceptionRecord
.text:00475DD2 C7 44 24 1C 26 00+mov     [esp+394h+var_378.ExceptionCode], 0C0000026h
.text:00475DDA 89 74 24 20       mov     [esp+394h+var_378.ExceptionFlags], esi
.text:00475DDE 89 7C 24 24       mov     [esp+394h+var_378.ExceptionRecord], edi
.text:00475DE2 E8 39 CF FB FF    call    _RtlRaiseException@4  ; RtlRaiseException(x)
.text:00475DE2                   ; ---------------------------------------------------------------------------
.text:00475DE7 EB                db 0EBh ; 
.text:00475DE8 04                db    4
.text:00475DE9                   ; ---------------------------------------------------------------------------
.text:00475DE9
.text:00475DE9                   loc_475DE9:                   ; CODE XREF: RtlUnwind(x,x,x,x)+12Bj
.text:00475DE9 8B 5C 24 0C       mov     ebx, [esp+390h+var_384]
.text:00475DED
.text:00475DED                   loc_475DED:                   ; CODE XREF: RtlUnwind(x,x,x,x)+127j
.text:00475DED 8B C3             mov     eax, ebx
.text:00475DEF 8B 1B             mov     ebx, [ebx]
.text:00475DF1 50                push    eax
.text:00475DF2 E8 2D 00 FE FF    call    _RtlpUnlinkHandler@4  ; RtlpUnlinkHandler(x)
.text:00475DF7 EB 1F             jmp     short loc_475E18
.text:00475DF9                   ; ---------------------------------------------------------------------------
.text:00475DF9
.text:00475DF9                   loc_475DF9:                   ; CODE XREF: RtlUnwind(x,x,x,x)+F3j
.text:00475DF9                                                 ; RtlUnwind(x,x,x,x)+FCj
.text:00475DF9                                                 ; RtlUnwind(x,x,x,x)+101j
.text:00475DF9                                                 ; RtlUnwind(x,x,x,x)+10Dj
.text:00475DF9 83 64 24 28 00    and     [esp+390h+var_378.NumberParameters], 0
.text:00475DFE 8D 44 24 18       lea     eax, [esp+390h+var_378]
.text:00475E02 50                push    eax                   ; ExceptionRecord
.text:00475E03 C7 44 24 1C 28 00+mov     [esp+394h+var_378.ExceptionCode], 0C0000028h
.text:00475E0B 89 74 24 20       mov     [esp+394h+var_378.ExceptionFlags], esi
.text:00475E0F 89 7C 24 24       mov     [esp+394h+var_378.ExceptionRecord], edi
.text:00475E13 E8 08 CF FB FF    call    _RtlRaiseException@4  ; RtlRaiseException(x)
.text:00475E18                   ; ---------------------------------------------------------------------------
.text:00475E18
.text:00475E18                   loc_475E18:                   ; CODE XREF: RtlUnwind(x,x,x,x)+15Cj
.text:00475E18 83 FB FF          cmp     ebx, 0FFFFFFFFh
.text:00475E1B 0F 85 29 FF FF FF jnz     loc_475D4A
.text:00475E21 33 F6             xor     esi, esi
.text:00475E23
.text:00475E23                   loc_475E23:                   ; CODE XREF: RtlUnwind(x,x,x,x)+A6j
.text:00475E23 83 7D 08 FF       cmp     [ebp+arg_0], 0FFFFFFFFh
.text:00475E27 56                push    esi                   ; SearchFrames
.text:00475E28 8D 84 24 BC 00 00+lea     eax, [esp+394h+Context]
.text:00475E2F 50                push    eax                   ; Context
.text:00475E30 75 07             jnz     short loc_475E39
.text:00475E32 E8 51 D4 FB FF    call    _ZwContinue@8         ; ZwContinue(x,x)
.text:00475E37 EB 06             jmp     short loc_475E3F
.text:00475E39                   ; ---------------------------------------------------------------------------
.text:00475E39
.text:00475E39                   loc_475E39:                   ; CODE XREF: RtlUnwind(x,x,x,x)+195j
.text:00475E39 57                push    edi                   ; ExceptionRecord
.text:00475E3A E8 C5 E4 FB FF    call    _ZwRaiseException@12  ; ZwRaiseException(x,x,x)
.text:00475E3F
.text:00475E3F                   loc_475E3F:                   ; CODE XREF: RtlUnwind(x,x,x,x)+19Cj
.text:00475E3F 8B 8C 24 8C 03 00+mov     ecx, [esp+390h+var_4]
.text:00475E46 5F                pop     edi
.text:00475E47 5E                pop     esi
.text:00475E48 5B                pop     ebx
.text:00475E49 33 CC             xor     ecx, esp
.text:00475E4B E8 88 22 FE FF    call    @__security_check_cookie@4 ; __security_check_cookie(x)
.text:00475E50 8B E5             mov     esp, ebp
.text:00475E52 5D                pop     ebp
.text:00475E53 C2 10 00          retn    10h
.text:00475E53                   _RtlUnwind@16 endp