[Missing support] Add support for unwind info added by RtlAddFunctionTable, etc

[mistymntncop]

Windows provides some apis (namely RtlAddFunctionTable, RtlAddGrowableFunctionTable, RtlInstallFunctionTableCallback) for the user application to add unwind info for dynamically generated code. This is how JIT compilers such as V8 (Turbofan) allows for stack unwinding of JIT code on Windows.

Below is a test program that uses RtlAddFunctionTable to add some unwind info to some JIT code.

#include <stdio.h>
#include <stdint.h>
#include <windows.h>
 
uint8_t *code = 0;

void c(void) {
    ((void ( *)()) code)();
}

void b(void) {
    c();
}
 
void a(void) {
    b();
}

typedef struct TestArena TestArena;
struct TestArena {
    uint8_t *base;
    uint64_t used;
    uint64_t capacity;
};

void init_arena(TestArena *arena, uint8_t *base, uint64_t capacity) {
    memset(arena, 0, sizeof(*arena));
    arena->base = base;
    arena->capacity = capacity;
}

void *push_arena(TestArena *arena, uint64_t size) {
    void *result = 0;
    uint64_t remaining = arena->capacity - arena->used;
    if(size <= remaining) {
        result = &arena->base[arena->used];
        memset(result, 0, size);
        arena->used += size;
    } 
    return result;
}

typedef union UNWIND_CODE UNWIND_CODE;
union UNWIND_CODE {
	struct {
		uint8_t CodeOffset;
		uint8_t UnwindOp : 4;
		uint8_t OpInfo   : 4;
	};
	uint16_t FrameOffset;
};

typedef struct UNWIND_INFO UNWIND_INFO;
struct UNWIND_INFO {
	uint8_t Version       : 3;
	uint8_t Flags         : 5;
	uint8_t SizeOfProlog;
	uint8_t CountOfCodes;
	uint8_t FrameRegister : 4;
	uint8_t FrameOffset   : 4;
	//UNWIND_CODE UnwindCode[0];
};


#define kPushRbpInstructionLength 1
#define kMovRbpRspInstructionLength 3
#define kRbpPrefixCodes 2
#define kRbpPrefixLength (kPushRbpInstructionLength + kMovRbpRspInstructionLength)
#define kOpPushNonvol 0
#define kOpSetFPReg 3

//#define UNW_FLAG_EHANDLER   0x1
 
//based on https://pmeerw.net/blog/programming/RtlAddFunctionTable.html
 
 //unwind codes copied from https://source.chromium.org/chromium/chromium/src/+/main:v8/src/diagnostics/unwinding-info-win64.cc
 
int main(void) {
    printf("1\n");
 
    uint64_t mem_size = 0x2000;
    uint8_t *mem = VirtualAlloc(NULL, mem_size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    
    TestArena arena = {0};
    init_arena(&arena, mem, mem_size);
    
    uint8_t code_vals[] = {
        0x55,                        //push   rbp
        0x48, 0x89, 0xE5,            //mov    rbp,rsp
        0xCC,                        //int3
        0x48, 0x89, 0xEC,            //mov    rsp,rbp
        0x5D,                        //pop    rbp
        0xC3                         //ret 
    };
    code = push_arena(&arena, 0x1000);
    memcpy(code, code_vals, sizeof(code_vals));
    
    UNWIND_INFO *unwind_info = push_arena(&arena, sizeof(UNWIND_INFO));
    
    UNWIND_CODE *unwind_codes = push_arena(&arena, sizeof(UNWIND_CODE)*2);

    #define RBP_CODE 5

    unwind_info->Version = 1;
    unwind_info->Flags = UNW_FLAG_EHANDLER;
    unwind_info->SizeOfProlog = kRbpPrefixLength;
    unwind_info->CountOfCodes = kRbpPrefixCodes;
    unwind_info->FrameRegister = RBP_CODE;
    unwind_info->FrameOffset = 0;

    unwind_codes[0].CodeOffset = kRbpPrefixLength;  // movq rbp, rsp
    unwind_codes[0].UnwindOp = kOpSetFPReg;
    unwind_codes[0].OpInfo = 0;

    unwind_codes[1].CodeOffset = kPushRbpInstructionLength;  // push rbp
    unwind_codes[1].UnwindOp = kOpPushNonvol;
    unwind_codes[1].OpInfo = RBP_CODE;

    RUNTIME_FUNCTION *runtime_func = push_arena(&arena, sizeof(RUNTIME_FUNCTION));
    runtime_func->BeginAddress = code - mem;
    runtime_func->EndAddress = (code + sizeof(code_vals)) - mem;
    runtime_func->UnwindInfoAddress = (uint8_t*)unwind_info - mem;
 
    RtlAddFunctionTable(runtime_func, 1, (DWORD64)mem);
        
    a();

    printf("2\n");
    return 0;
}

In Visual Studio the callstack looks like this:

Currently in RADDBG the callstack looks like this:

I don't know the most efficient way of being notified when this unwind information has been added. Perhaps hooking the aforementioned functions would be an approach ?

I think this is where ReactOS uses the information (https://github.com/reactos/reactos/blob/master/sdk/lib/rtl/amd64/unwind.c#L139C16-L139C46).

Thanks.