[RTL][NDK] Improve RtlUnhandledExceptionFilter(2) (#8353)

- Reimplement `RtlUnhandledExceptionFilter()` by just calling
  `RtlUnhandledExceptionFilter2()`.

- Return an adequate exception filter value `EXCEPTION_CONTINUE_SEARCH`
  from `RtlUnhandledExceptionFilter2()`, instead of some random error.
  If `ExceptionCode` is `STATUS_POSSIBLE_DEADLOCK` however, return
  `EXCEPTION_CONTINUE_EXECUTION` instead, as shown by a test from Whindmar Saksit.

- The second parameter of `RtlUnhandledExceptionFilter2()` is not
  a flag, but a pointer to string `PCSTR` !
  See https://skanthak.hier-im-netz.de/download/NTDLL.H
  who is the only one online who has the correct definition,
  whose usage I've double-checked on Win7 ntdll.dll.

  This is used in the `<function_name>` slot in the displayed
  debugger message:
  ```
  *** An Access Violation occurred in <program_command_line>:<function_name>
  The instruction at <address> tried to write to a NULL pointer
  ```
  For example, see: https://community.osr.com/t/access-violation/33435
This commit is contained in:
Hermès Bélusca-Maïto
2025-08-27 23:00:59 +02:00
parent 92f680dddb
commit db69a9a7e1
2 changed files with 14 additions and 11 deletions

View File

@@ -676,7 +676,7 @@ NTSYSAPI
LONG LONG
NTAPI NTAPI
RtlUnhandledExceptionFilter( RtlUnhandledExceptionFilter(
_In_ struct _EXCEPTION_POINTERS* ExceptionInfo _In_ PEXCEPTION_POINTERS ExceptionInfo
); );
__analysis_noreturn __analysis_noreturn

View File

@@ -241,7 +241,7 @@ static VOID
PEXCEPTION_RECORD ExceptionRecord = ExceptionInfo->ExceptionRecord; PEXCEPTION_RECORD ExceptionRecord = ExceptionInfo->ExceptionRecord;
PCONTEXT ContextRecord = ExceptionInfo->ContextRecord; PCONTEXT ContextRecord = ExceptionInfo->ContextRecord;
/* Print a stack trace. */ /* Print a stack trace */
DbgPrint("Unhandled exception\n"); DbgPrint("Unhandled exception\n");
DbgPrint("ExceptionCode: %8x\n", ExceptionRecord->ExceptionCode); DbgPrint("ExceptionCode: %8x\n", ExceptionRecord->ExceptionCode);
@@ -310,12 +310,10 @@ static VOID
*/ */
LONG LONG
NTAPI NTAPI
RtlUnhandledExceptionFilter(IN struct _EXCEPTION_POINTERS* ExceptionInfo) RtlUnhandledExceptionFilter(
_In_ PEXCEPTION_POINTERS ExceptionInfo)
{ {
/* This is used by the security cookie checks, and also called externally */ return RtlUnhandledExceptionFilter2(ExceptionInfo, "");
UNIMPLEMENTED;
PrintStackTrace(ExceptionInfo);
return ERROR_CALL_NOT_IMPLEMENTED;
} }
/* /*
@@ -325,12 +323,17 @@ LONG
NTAPI NTAPI
RtlUnhandledExceptionFilter2( RtlUnhandledExceptionFilter2(
_In_ PEXCEPTION_POINTERS ExceptionInfo, _In_ PEXCEPTION_POINTERS ExceptionInfo,
_In_ ULONG Flags) _In_ PCSTR Function)
{ {
/* This is used by the security cookie checks, and also called externally */ /* This is used by the security cookie checks, and also called externally */
UNIMPLEMENTED; UNIMPLEMENTED;
ASSERT(ExceptionInfo && ExceptionInfo->ExceptionRecord);
PrintStackTrace(ExceptionInfo); PrintStackTrace(ExceptionInfo);
return ERROR_CALL_NOT_IMPLEMENTED;
if (ExceptionInfo->ExceptionRecord->ExceptionCode == STATUS_POSSIBLE_DEADLOCK)
return EXCEPTION_CONTINUE_EXECUTION;
return EXCEPTION_CONTINUE_SEARCH;
} }
/* /*