x64下动态代码构建RUNTIME_FUNCTION

x64调用约定下，不再使用stack frame pointer(如ebp) ，并且unwind info，seh table都是编译期生成。

对于动态生成的代码，如执行shellcode等，异常表中没有RUMTIME_FUNCTION，编译器无法正常展开调用栈。

因此需要手动构造动态代码的RUNTIME_FUNCTION信息，并调用系统函数RtlAddFunctionTable，向系统注册动态代码的栈展开或异常处理机制。

网上讲解x64调用约定的文章很多，但是如何构造异常表的资料很少，自己找了一些别人的代码，做了改进。

参考资料：

RUNTIME_FUNCTION结构体详解 https://blog.csdn.net/tutucoo/article/details/83828700

UNWIND_CODE结构体详解 https://docs.microsoft.com/en-us/previous-versions/ck9asaa9(v=vs.140)

目前只有了最基础的unwind 和 单条 seh exceptionhandler。源代码如下：

#include <iostream>
#include <vector>

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

#include <windows.h>

typedef uint8_t UBYTE;
typedef uint16_t USHORT;

typedef void(__cdecl* CallTestFunc)(void);

typedef enum _UNWIND_OP_CODES {
    UWOP_PUSH_NONVOL = 0,
    UWOP_ALLOC_LARGE,       // 1
    UWOP_ALLOC_SMALL,       // 2
    UWOP_SET_FPREG,         // 3
    UWOP_SAVE_NONVOL,       // 4
    UWOP_SAVE_NONVOL_FAR,   // 5
    UWOP_SPARE_CODE1,       // 6
    UWOP_SPARE_CODE2,       // 7
    UWOP_SAVE_XMM128,       // 8
    UWOP_SAVE_XMM128_FAR,   // 9
    UWOP_PUSH_MACHFRAME     // 10
} UNWIND_OP_CODES, *PUNWIND_OP_CODES;

typedef union _UNWIND_CODE {
    struct {
        UBYTE CodeOffset;
        UBYTE UnwindOp : 4;
        UBYTE OpInfo : 4;
    };
    USHORT FrameOffset;
} UNWIND_CODE, *PUNWIND_CODE;

typedef struct _UNWIND_INFO {
    UBYTE Version : 3;
    UBYTE Flags : 5;
    UBYTE SizeOfProlog;
    UBYTE CountOfCodes;
    UBYTE FrameRegister : 4;
    UBYTE FrameOffset : 4;
    UNWIND_CODE UnwindCode[1];
    /*    UNWIND_CODE MoreUnwindCode[((CountOfCodes + 1) & ~1) - 1];
     *    OPTIONAL ULONG ExceptionHandler;
     *    OPTIONAL ULONG ExceptionData[]; */
} UNWIND_INFO, *PUNWIND_INFO;

typedef struct {
    uint8_t code[0x1000];
    RUNTIME_FUNCTION function_table[1];
    UNWIND_INFO unwind_info[1];
} DYNSECTION;


//    FILTER    HANDLER        FINALLY_HANDLER
#define UNW_FLAG_NHANDLER 0x0        //    NO      NO           
#define UNW_FLAG_EHANDLER 0x1        //    YES      YES
#define UNW_FLAG_UHANDLER 0x2        //                            YES
#define UNW_FLAG_CHAININFO 0x4        //    multi UNWIND_INFO

struct STACK_FRAME_INFO {
    PVOID returnAddress;
    PVOID functionAddress;
};

struct CALL_STACK_INFO {
    PVOID stackBottom;
    PVOID stackTop;
    DWORD dwFrameCount;
    STACK_FRAME_INFO* pFrameList;
};

typedef ULONG(WINAPI *RTLWALKFRAMECHAIN)(OUT PVOID *Callers, IN ULONG Count, IN ULONG Flags);

void GetCallStackInfo(CALL_STACK_INFO& callStack, DWORD dwMaxFrame)
{
    std::vector<STACK_FRAME_INFO> vecFrames;
#ifdef _M_IX86
    STACK_FRAME_INFO StackFrame;
    std::vector<PVOID> vecRetAddr;
    ULONG StackCount = 0;
    RTLWALKFRAMECHAIN pRtlWalkFrameChain =
        (RTLWALKFRAMECHAIN)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "RtlWalkFrameChain");

    vecRetAddr.resize(50);
    StackCount = pRtlWalkFrameChain(&vecRetAddr[0], vecRetAddr.size(), 0);

    for (ULONG i = 0;i < StackCount;i++)
    {
        ZeroMemory(&StackFrame, sizeof(StackFrame));

        if (vecRetAddr[i] == nullptr)
        {
            break;
        }

        StackFrame.returnAddress = vecRetAddr[i];

        vecFrames.push_back(StackFrame);
    }

#elif (_M_X64)
    CONTEXT                       Context;
    KNONVOLATILE_CONTEXT_POINTERS NvContext;
    UNWIND_HISTORY_TABLE          UnwindHistoryTable;
    PRUNTIME_FUNCTION             RuntimeFunction;
    PVOID                         HandlerData;
    ULONG64                       EstablisherFrame;
    ULONG64                       ImageBase;
    STACK_FRAME_INFO              StackFrame;

    RtlCaptureContext(&Context);

    ZeroMemory(&UnwindHistoryTable, sizeof(UNWIND_HISTORY_TABLE));

    for (ULONG Frame = 0; Frame <= dwMaxFrame; Frame++)
    {
        RuntimeFunction = RtlLookupFunctionEntry(
            Context.Rip,
            &ImageBase,
            &UnwindHistoryTable
        );

        ZeroMemory(&NvContext, sizeof(KNONVOLATILE_CONTEXT_POINTERS));

        if (!RuntimeFunction)
        {
            Context.Rip = (ULONG64)(*(PULONG64)Context.Rsp);
            Context.Rsp += 8;
        }
        else
        {
            RtlVirtualUnwind(
                UNW_FLAG_NHANDLER,
                ImageBase,
                Context.Rip,
                RuntimeFunction,
                &Context,
                &HandlerData,
                &EstablisherFrame,
                &NvContext);
        }

        if (!Context.Rip)
        {
            break;
        }
        
        ZeroMemory(&StackFrame, sizeof(StackFrame));

        StackFrame.returnAddress = (PVOID)Context.Rip;
        StackFrame.functionAddress = (PVOID)(ImageBase + RuntimeFunction->BeginAddress);

        vecFrames.push_back(StackFrame);
    }
#endif
    
    callStack.pFrameList = (STACK_FRAME_INFO*)malloc(vecFrames.size() * sizeof(STACK_FRAME_INFO));
    if (!callStack.pFrameList)
    {
        callStack.dwFrameCount = 0;
        return;
    }

    callStack.dwFrameCount = vecFrames.size();
    for (DWORD dwFrame = 0; dwFrame < vecFrames.size(); dwFrame++)
    {
        CopyMemory(&callStack.pFrameList[dwFrame], &vecFrames[dwFrame], sizeof(STACK_FRAME_INFO));
    }
}

void Func1()
{
    CALL_STACK_INFO callStack;
    ZeroMemory(&callStack, sizeof(callStack));
    GetCallStackInfo(callStack, 100);

    for (DWORD dwFrame = 0; dwFrame < callStack.dwFrameCount; dwFrame++)
    {
        printf(
            "FRAME %02x: FuncAddrss=%p ReturnAddress=%p 
",
            dwFrame,
            callStack.pFrameList[dwFrame].functionAddress,
            callStack.pFrameList[dwFrame].returnAddress);
    }

}

void DumpCallStack()
{
    Func1();
}

DWORD TestForSehAddFunctionTable();
DWORD TestForUnwindFunctionTable();

int main()
{
    TestForUnwindFunctionTable();

    ::system("pause");
}

#ifdef _M_X64

DWORD TestForUnwindFunctionTable()
{
    DYNSECTION *pDynData = (DYNSECTION*)VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    uint8_t *code = pDynData->code;
    ULONG_PTR p = 0;
    code[p++] = 0x56; //push rsi
    code[p++] = 0x57; //push rdi
    code[p++] = 0x48;
    code[p++] = 0x81;
    code[p++] = 0xec;
    code[p++] = 0x88;
    code[p++] = 0x07;
    code[p++] = 0x00;
    code[p++] = 0x00; //sub rsp,788h
    ULONG_PTR prologSize = p;
    code[p++] = 0x48;
    code[p++] = 0xb8; //mov rax, xxxxxxxh
    ULONG_PTR returnAddress = p;
    for (int i = 0; i < sizeof(ULONG_PTR); i++)
    {
        code[p++] = 0x00;
    }
    code[p++] = 0x50; //push rax
    code[p++] = 0x48;
    code[p++] = 0xb8; //mov rax, xxxxxxxh
    ULONG_PTR targetAddress = p;
    for (int i = 0; i < sizeof(ULONG_PTR); i++)
    {
        code[p++] = 0x00;
    }
    code[p++] = 0x50; //push rax
    code[p++] = 0xc3; //ret
    ULONG_PTR offsetRip = p;
    code[p++] = 0x48;
    code[p++] = 0x81;
    code[p++] = 0xc4;
    code[p++] = 0x88;
    code[p++] = 0x07;
    code[p++] = 0x00;
    code[p++] = 0x00; //add rsp,788h
    code[p++] = 0x5f; //pop rdi
    code[p++] = 0x5e; //pop rsi
    code[p++] = 0xc3; //ret
    ULONG_PTR trampoline = p;

    UNWIND_INFO *pUnwindInfo = pDynData->unwind_info;
    pUnwindInfo[0].Version = 1;
    pUnwindInfo[0].Flags = UNW_FLAG_NHANDLER;
    pUnwindInfo[0].SizeOfProlog = (UBYTE)prologSize;
    pUnwindInfo[0].CountOfCodes = 3;
    pUnwindInfo[0].FrameRegister = 0;
    pUnwindInfo[0].FrameOffset = 0;

    DWORD64 dyn_base = (DWORD64)pDynData;    

    UNWIND_CODE *pUnwindCode = pUnwindInfo->UnwindCode;

    //pUnwindCode[2].CodeOffset = 10;
    //pUnwindCode[2].UnwindOp = UWOP_ALLOC_LARGE;
    //pUnwindCode[2].OpInfo = 0;
    //
    //pUnwindCode[1].CodeOffset = 2;
    //pUnwindCode[1].UnwindOp = UWOP_PUSH_NONVOL;
    //pUnwindCode[1].OpInfo = 7;
    //
    //pUnwindCode[0].CodeOffset = 1;
    //pUnwindCode[0].UnwindOp = UWOP_PUSH_NONVOL;
    //pUnwindCode[0].OpInfo = 6;
        // push xxx must before sub rsp, xxx
        pUnwindCode[0].FrameOffset = 0x6001;
        pUnwindCode[1].FrameOffset = 0x7002;
    pUnwindCode[2].FrameOffset = 0x010a;
    
    

    RUNTIME_FUNCTION *function_table = pDynData->function_table;
    function_table[0].BeginAddress = (DWORD64)&code[0] - dyn_base; // set RVA of dynamic code start
    function_table[0].EndAddress = (DWORD64)&code[trampoline] - dyn_base; // RVA of dynamic code end
    function_table[0].UnwindInfoAddress = (DWORD64)pUnwindCode - dyn_base; // RVA of unwind info

    *(DWORD64*)&code[returnAddress] = (DWORD64)code + offsetRip;
    *(DWORD64*)&code[targetAddress] = (DWORD64)DumpCallStack; // VA of target

    if (!RtlAddFunctionTable(function_table, 1, dyn_base)) {
        printf("RtlAddFunctionTable() failed, exit.
");
        exit(EXIT_FAILURE);
    }

    void(*call)() = (void(*)())code;
    (*call)();

    return 0;
}

static EXCEPTION_DISPOSITION handler(
    PEXCEPTION_RECORD ExceptionRecord, 
    ULONG64 EstablisherFrame, 
    PCONTEXT ContextRecord, 
    PDISPATCHER_CONTEXT DispatcherContext
) 
{
    printf("handler!
");
    ContextRecord->Rip += 3;
    return ExceptionContinueExecution;
}

DWORD TestForSehAddFunctionTable()
{
    int ret;
    RUNTIME_FUNCTION *q;
    DYNSECTION *dynsection = (DYNSECTION*)VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

    uint8_t *code = dynsection->code;
    size_t p = 0;
    code[p++] = 0xb8; // mov rax, 42
    code[p++] = 0x2a;
    code[p++] = 0x00;
    code[p++] = 0x00;
    code[p++] = 0x00;
    code[p++] = 0xc6; // mov byte [rax], 0  -- raises exception!
    code[p++] = 0x00;
    code[p++] = 0x00;
    code[p++] = 0xc3; // ret

    size_t trampoline = p;
    code[p++] = 0x48; // mov rax, 
    code[p++] = 0xb8;
    size_t patch_handler_address = p;
    code[p++] = 0x00; // address to handler patched here
    code[p++] = 0x00;
    code[p++] = 0x00;
    code[p++] = 0x00;
    code[p++] = 0x00;
    code[p++] = 0x00;
    code[p++] = 0x00;
    code[p++] = 0x00;
    code[p++] = 0xff; // jmp rax
    code[p++] = 0xe0;

    DWORD64 dyn_base = 0;
    q = RtlLookupFunctionEntry((DWORD64)code, &dyn_base, NULL);
    printf("lookup 'code' %p %llx
", q, dyn_base); // no function table entry

    DWORD64 image_base = 0;
    q = RtlLookupFunctionEntry((DWORD64)main, &image_base, NULL);
    printf("lookup 'main' %p %llx
", q, image_base); // there is a function table entry

    dyn_base = (DWORD64)dynsection;
    UNWIND_INFO *unwind_info = dynsection->unwind_info;
    unwind_info[0].Version = 1;
    unwind_info[0].Flags = UNW_FLAG_EHANDLER;
    unwind_info[0].SizeOfProlog = 0;
    unwind_info[0].CountOfCodes = 0;
    unwind_info[0].FrameRegister = 0;
    unwind_info[0].FrameOffset = 0;
    *(DWORD *)&unwind_info[0].UnwindCode = (DWORD64)&code[trampoline] - dyn_base;

    RUNTIME_FUNCTION *function_table = dynsection->function_table;
    function_table[0].BeginAddress = (DWORD64)&code[0] - dyn_base; // set RVA of dynamic code start
    function_table[0].EndAddress = (DWORD64)&code[trampoline] - dyn_base; // RVA of dynamic code end
    function_table[0].UnwindInfoAddress = (DWORD64)unwind_info - dyn_base; // RVA of unwind info

    *(DWORD64 *)&code[patch_handler_address] = (DWORD64)handler; // VA of handler

    printf("main VA %016llx
", (DWORD64)main);
    printf("code VA %016llx
", (DWORD64)code);
    printf("function table VA %016llx
", (DWORD64)function_table);
    printf("unwind info VA %016llx
", (DWORD64)unwind_info);
    printf("handler VA %016llx
", (DWORD64)handler);
    printf("RUNTIME_FUNCTION begin RVA %08x, end RVA %08x, unwind RVA %08x
",
        function_table[0].BeginAddress, function_table[0].EndAddress,
        function_table[0].UnwindInfoAddress);
    printf("UNWIND_INFO handler RVA %08x
", *(DWORD *)&unwind_info[0].UnwindCode);

    if (!RtlAddFunctionTable(function_table, 1, dyn_base)) {
        printf("RtlAddFunctionTable() failed, exit.
");
        exit(EXIT_FAILURE);
    }

    q = RtlLookupFunctionEntry((DWORD64)code, &dyn_base, NULL);
    printf("lookup 'code' %p %llx
", q, dyn_base); // should return address of function table entry

    uint64_t(*call)() = (uint64_t(*)()) code;
    uint64_t result = (*call)();
    printf("result = %llx
", result);

    if (!RtlDeleteFunctionTable(function_table)) {
        printf("RtlDeleteFunctionTable() failed, exit.
");
        exit(EXIT_FAILURE);
    }

    return EXIT_SUCCESS;
}
#endif