Edit

Share via

RtlLookupFunctionEntry function (winnt.h)

  • Article
  • 02/22/2024

Searches the active function tables for an entry that corresponds to the specified PC value.

Syntax

NTSYSAPI PRUNTIME_FUNCTION RtlLookupFunctionEntry(
  [in]  DWORD64               ControlPc,
  [out] PDWORD64              ImageBase,
  [out] PUNWIND_HISTORY_TABLE HistoryTable
);

Parameters

[in] ControlPc

The virtual address of an instruction bundle within the function.

[out] ImageBase

The base address of module to which the function belongs.

[out] HistoryTable

The global pointer value of the module.

This parameter has a different declaration on x64 and ARM systems. For more information, see x64 Definition and ARM Definition.

Return value

If there is no entry in the function table for the specified PC, the function returns NULL. Otherwise, the function returns the address of the function table entry that corresponds to the specified PC.

Requirements

Requirement Value
Target Platform Windows
Header winnt.h (include Windows.h)
Library Kernel32.lib
DLL Kernel32.dll

See also

RtlUnwindEx

RtlVirtualUnwind

Vertdll APIs available in VBS enclaves

Additional resources