Edit

Share via

DYNAMIC_FUNCTION_TABLE structure

  • Article

The DYNAMIC_FUNCTION_TABLE structure is an entry in a linked list which is used by a debugger to discover all of the dynamic function tables in a target process. The root node in this linked list is returned from RtlGetFunctionTableListHead

Syntax

typedef struct _DYNAMIC_FUNCTION_TABLE {
    LIST_ENTRY ListEntry;
    PRUNTIME_FUNCTION FunctionTable;
    LARGE_INTEGER Reserved1;
    ULONG64 MinimumAddress;
    ULONG64 MaximumAddress;
    ULONG64 BaseAddress;
    PVOID Reserved2[2];
    PWSTR OutOfProcessCallbackDll;
    FUNCTION_TABLE_TYPE Type;
    ULONG EntryCount;
} DYNAMIC_FUNCTION_TABLE, * PDYNAMIC_FUNCTION_TABLE;

Members

ListEntry

LIST_ENTRY structure used to point at next and previous entries in the list.

FunctionTable

For function tables which are not RF_CALLBACK, this points at an array of RUNTIME_FUNCTION structures.

Reserved1

Reserved.

MinimumAddress

Smallest instruction address described by this table.

MaximumAddress

Largest instruction address described by this table.

BaseAddress

The base address to use when computing full virtual addresses from relative virtual addresses of function table entries.

Reserved2

Reserved.

OutOfProcessCallbackDll

For function tables which are RF_CALLBACK, this contains an optional pointer to a string that specifies the path of a DLL that provides function table entries from outside of the target process.

When a debugger unwinds to a function in the range of addresses managed by the callback function, it loads this DLL and calls the OUT_OF_PROCESS_FUNCTION_TABLE_CALLBACK_EXPORT_NAME function, whose type is POUT_OF_PROCESS_FUNCTION_TABLE_CALLBACK.

Type

A member of the FUNCTION_TABLE_TYPE enumeration.

EntryCount

The number of entries in the FunctionTable array.

Remarks

This struct has no associated import library or header file. The structure may be changed or removed from Windows without further notice.