RtlPcToFileHeader
VOID *__stdcall RtlPcToFileHeader(VOID *PcValue, VOID **BaseOfImage){
VOID *result;
_INVERTED_FUNCTION_TABLE_ENTRY FunctionTableInfo;
memset(&FunctionTableInfo, 0, sizeof(FunctionTableInfo));
if( PcValue >= *(&byte_140E00020 + 1)
&& PcValue < (char *)*(&byte_140E00020 + 1) + *((unsigned int *)&byte_140E00020 + 4) )
{
*(_OWORD *)&FunctionTableInfo.FunctionTable = *(_OWORD *)&byte_140E00020;
}
else
{
RtlpxLookupFunctionTable(PcValue, &FunctionTableInfo);
}
result = FunctionTableInfo.ImageBase;
*BaseOfImage = FunctionTableInfo.ImageBase;
return result;
}Referenced by:
EtwpLocateDbgIdForRegEntry
KeSetTracepoint
KiLockExtendedServiceTable
RtlGuardCheckExceptionHandler
RtlGuardCheckLongJumpTarget