手逆RtlpWalkFrameChain

元始天尊

只是一部分，因此不分析了
ULONG
RtlpWalkFrameChain (
    OUT PVOID *Callers,
    IN ULONG Count,
    IN ULONG Flags,
    )
ULONG LowLimit;[ebp-20h]
ULONG HightLimit;[ebp-24h]
ULONG* ebp;[ebp-28h]
int i;[ebp-2Ch]
PETHREAD thread;[ebp-30h][ebp-3Ch]
PKTRAP_FRAME frame;[ebp-34h]
PTEB teb;[ebp-38h]

if(!Flags)
{
        ebp=EBP
        if(!RtlpCaptureStackLimits(&LowLimit,&HighLimit))
                return 0;
}
if(Flags == 1)
{
        thread=PsGetCurrentThread();
        frame=thread->TrapFrame
        teb=thread->Teb;
        if(!teb || frame < MmSystemRangeStart || frame <= thread.StackLimit || thread->ApcStateIndex == 1)
                return 0;
        if(KeGetCurrentIrql()?=2)
                return 0;
        LowLimit = teb->NtTib.StackLimit;
        HightLimit = teb->NtTib.StackBase;
        ebp=teb->ebp;
        if(LowLimit>=HightLimit)
                return 0;
        if(HightLimit<=MmUserProbeAddress (805599d4))
                ....
}
for(i=0;i<Count;i++)
{
        if(ebp>=HightLimit)
                break;
        ............
        ULONG nextebp=[ebp];
        Callers[i]=[ebp+4];
        ebp=nextebp;
}
       

7KY6

可以可以!!