RtlLookupFunctionEntry - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
// winnt.h

NTSYSAPI PRUNTIME_FUNCTION RtlLookupFunctionEntry(
  [in]  DWORD64               ControlPc,
  [out] PDWORD64              ImageBase,
  [out] PUNWIND_HISTORY_TABLE HistoryTable
);
View the official Win32 API reference

NtDoc

No description available.

Edit description on GitHub

Win32 API reference (nf-winnt-rtllookupfunctionentry)

RtlLookupFunctionEntry function

Description

Searches the active function tables for an entry that corresponds to the specified PC value.

Parameters

ControlPc [in]

The virtual address of an instruction bundle within the function.

ImageBase [out]

The base address of module to which the function belongs.

HistoryTable [out]

The global pointer value of the module.

This parameter has a different declaration on x64 and ARM systems. For more information, see x64 Definition and ARM Definition.

Return value

If there is no entry in the function table for the specified PC, the function returns NULL. Otherwise, the function returns the address of the function table entry that corresponds to the specified PC.

See also

RtlUnwindEx

RtlVirtualUnwind

Vertdll APIs available in VBS enclaves

View the official Win32 API reference

Edit description on GitHub