c++ - x64 堆栈展开并检查 RIP 是否在 epilog 中

Question

我想展开一个 x64 调用堆栈，所以我尝试按照我在此处找到的“UNWIND 过程”进行操作:
http://msdn.microsoft.com/en-us/library/8ydc79k6.aspx

我知道如果 RIP 在 epilog 中，考虑到仍然需要完成的操作，我们需要计算 RSP 的偏移量，但我不清楚如何确定 RIP 是否在 epilog 中(在第 3.a 部分)？
有人可以向我解释一下吗？ (链接或代码示例也将不胜感激)

Answer 1

来自 The Unwind Procedure

To determine if the RIP is within an epilog, the code stream from RIP on is examined. If that code stream can be matched to the trailing portion of a legitimate epilog, as described in section CNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABfAFIAZQBmADQAOQA2ADAAOQAyADQAMgA1AAAA REF _Ref496092425 \r \h 0, then it is in an epilog, and the remaining portion of the epilog is simulated, with the context record updated as each instruction is processed

，并来自 Prolog and Epilog (我推荐整篇文章以便更好地理解)

These are the only legal forms for an epilog. It must consist of either an add RSP,constant or lea RSP,constant[FPReg], followed by a series of zero or more 8-byte register pops and a return or a jmp. (Only a subset of jmp statements are allowable in the epilog. [...]). No other code can appear. In particular, nothing can be scheduled within an epilog, including loading of a return value.

Note that, when a frame pointer is not used, the epilog must use add RSP,constant to deallocate the fixed part of the stack. It may not use lea RSP,constant[RSP] instead. This restriction exists so the unwind code has fewer patterns to recognize when searching for epilogs.

似乎如果代码发现自己处于这种情况下，它只会检查当前执行的代码以查找那些特定指令，如果匹配，则认为自己在 epilog 中。