Search code examples
windows64-bitx86-64jitstack-unwinding

How to uninstall RtlInstallFunctionTableCallback?


What is the reverse of the RtlInstallFunctionTableCallback function ?

I have been looking at it to avoid the rather slow RtlAddFunctionTable/RtlDeleteFunctionTable for transient JIT'ed math expressions, but I could not find a way to uninstall a callback...

I suspect the (otherwise unused and apparently redundant) TableIdentifier parameter may have something to do with it, but it does not seem documented.

Also it is not entirely clear if the table returned by the callback si actually added on the fly (fed to RtlAddFunctionTable, and thus should be cleaned up later with RtlDeleteFunctionTable) or if it's just transiently used.


Solution

  • As remarked by Hans Passant in a comment, the answer is in RtlDeleteFunctionTable documentation

    NTSYSAPI BOOLEAN RtlDeleteFunctionTable( PRUNTIME_FUNCTION FunctionTable );

    FunctionTable

    A pointer to an array of function entries that were previously passed to RtlAddFunctionTable or an identifier previously passed to RtlInstallFunctionTableCallback. For a definition of the PRUNTIME_FUNCTION type, see WinNT.h.