investigate new Ki export on Win8.1 x64: KiUserInvertedFunctionTable

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on October 24, 2013 10:25:26_

winsysnums on ntdll.dll 6.3.9600.16408 x64 says;

KiUserInvertedFunctionTable

WARNING! UNKNOWN Ki ROUTINE!

disassembly:
0x0000000000000000 add %eax (%rax) -> (%rax)
0x0000000000000000 add %al (%rax) -> (%rax)
0x0000000000000000 add %al (%rdx) -> (%rdx)
...
0x0000000000000000 add %al (%eax) -> (%eax)
ERROR: hit max instr limit 256

Neither x86 nor wow64 ntdll has this Ki routine.

At runtime on calc it is filled in:

0:004> dp ntdll!KiUserInvertedFunctionTable
00007ff9`98e79c50 00000200`00000021 00000000`00000044
00007ff9`98e79c60 00007ff9`98e82000 00007ff9`98d50000
00007ff9`98e79c70 0000c1d4`001a9000 00007ff6`2e7ad000
00007ff9`98e79c80 00007ff6`2e730000 000050ac`000e6000
00007ff9`98e79c90 00007ff9`8ba94000 00007ff9`8ba70000
00007ff9`98e79ca0 00001c38`0002a000 00007ff9`8bad5000
00007ff9`98e79cb0 00007ff9`8bac0000 00000f0c`0001f000
00007ff9`98e79cc0 00007ff9`8e697000 00007ff9`8e620000

With pdb, it turns into:
0:004> ln 00007ff9`98e79c50
(00007ff9`98e79c50) ntdll!LdrpInvertedFunctionTable | (00007ff9`98e7cc60) ntdll!RtlpLockedSectionList

0:004> dps ntdll!LdrpInvertedFunctionTable L100
00007ff9`98e79c50 00000200`00000021
00007ff9`98e79c58 00000000`00000044
00007ff9`98e79c60 00007ff9`98e82000 ntdll!__PchSym_ (ntdll+0x132000)
00007ff9`98e79c68 00007ff9`98d50000 ntdll!NtDllUserStubs (ntdll+0x0)
00007ff9`98e79c70 0000c1d4`001a9000
00007ff9`98e79c78 00007ff6`2e7ad000 calc!_dyn_tls_init_callback+0xe0
00007ff9`98e79c80 00007ff6`2e730000 calc!_guard_check_icall_fptr (calc+0x0)
00007ff9`98e79c88 000050ac`000e6000
00007ff9`98e79c90 00007ff9`8ba94000 WINMMBASE!gpEmuList (WINMMBASE+0x24000)
00007ff9`98e79c98 00007ff9`8ba70000 WINMMBASE!_guard_check_icall_fptr (WINMMBASE+0x0)
00007ff9`98e79ca0 00001c38`0002a000
00007ff9`98e79ca8 00007ff9`8bad5000 WINMM!wszNull (WINMM+0x15000)
00007ff9`98e79cb0 00007ff9`8bac0000 WINMM!_guard_check_icall_fptr (WINMM+0x0)
00007ff9`98e79cb8 00000f0c`0001f000
00007ff9`98e79cc0 00007ff9`8e697000 tiptsf!__PchSym_ (tiptsf+0x77000)
00007ff9`98e79cc8 00007ff9`8e620000 tiptsf!_guard_check_icall_fptr (tiptsf+0x0)
00007ff9`98e79cd0 00005bd4`00098000
00007ff9`98e79cd8 00007ff9`930e2000 oleacc!uWM_OLEACC_HOOK (oleacc+0x52000)
00007ff9`98e79ce0 00007ff9`93090000 oleacc!_guard_check_icall_fptr (oleacc+0x0)
00007ff9`98e79ce8 00005358`00063000
00007ff9`98e79cf0 00007ff9`93d6f000 COMCTL32!__PchSym_ (COMCTL32+0x1ef000)
00007ff9`98e79cf8 00007ff9`93b80000 COMCTL32!_guard_check_icall_fptr (COMCTL32+0x0)
00007ff9`98e79d00 0001d664`0025a000
00007ff9`98e79d08 00007ff9`93ec6000 dwmapi!__objectFactory__CShowInputPaneAnimationCoordinator_COM (dwmapi+0x16000)
00007ff9`98e79d10 00007ff9`93eb0000 dwmapi!_guard_check_icall_fptr (dwmapi+0x0)
00007ff9`98e79d18 00001350`00021000
00007ff9`98e79d20 00007ff9`9411b000 SHCORE!__PchSym_+0xd60
00007ff9`98e79d28 00007ff9`94090000 SHCORE!_guard_check_icall_fptr (SHCORE+0x0)
00007ff9`98e79d30 0000b244`000a1000
00007ff9`98e79d38 00007ff9`94a36000 WindowsCodecs!__PchSym_ (WindowsCodecs+0x176000)
00007ff9`98e79d40 00007ff9`948c0000 WindowsCodecs!_guard_check_icall_fptr (WindowsCodecs+0x0)
00007ff9`98e79d48 0001458c`00193000
00007ff9`98e79d50 00007ff9`94ea2000 UxTheme!__PchSym_ (UxTheme+0x102000)
00007ff9`98e79d58 00007ff9`94da0000 UxTheme!__ImageBase
00007ff9`98e79d60 0000ebd4`00122000
00007ff9`98e79d68 00007ff9`94f70000 DEVOBJ!InstallLogFilePath (DEVOBJ+0x20000)
00007ff9`98e79d70 00007ff9`94f50000 DEVOBJ!_guard_check_icall_fptr (DEVOBJ+0x0)
00007ff9`98e79d78 00001728`00026000
00007ff9`98e79d80 00007ff9`94fa5000 kernel_appcore!PsmpProcessActivationType (kernel_appcore+0x5000)
00007ff9`98e79d88 00007ff9`94fa0000 kernel_appcore!_guard_check_icall_fptr (kernel_appcore+0x0)
00007ff9`98e79d90 000000e4`0000a000
00007ff9`98e79d98 00007ff9`96007000 bcryptPrimitives!gcDSA_TestPrimality+0x428
00007ff9`98e79da0 00007ff9`95fb0000 bcryptPrimitives!_guard_check_icall_fptr (bcryptPrimitives+0x0)
00007ff9`98e79da8 00003e40`0005e000
00007ff9`98e79db0 00007ff9`96016000 CRYPTBASE!ErrorSessionKey+0x9f0
00007ff9`98e79db8 00007ff9`96010000 CRYPTBASE!_guard_check_icall_fptr (CRYPTBASE+0x0)
00007ff9`98e79dc0 0000036c`0000a000
00007ff9`98e79dc8 00007ff9`961e2000 cfgmgr32!__PchSym_ (cfgmgr32+0x42000)
00007ff9`98e79dd0 00007ff9`961a0000 cfgmgr32!_guard_check_icall_fptr (cfgmgr32+0x0)
00007ff9`98e79dd8 00003f3c`0004a000
00007ff9`98e79de0 00007ff9`96571000 KERNELBASE!`StateEnumerator::EnumerateNextItem'::`2'::tempNameBuffer (KERNELBASE+0xf1000)
00007ff9`98e79de8 00007ff9`96480000 KERNELBASE!_guard_check_icall_fptr (KERNELBASE+0x0)
00007ff9`98e79df0 00011598`0010e000
00007ff9`98e79df8 00007ff9`96685000 SHLWAPI!__PchSym_ (SHLWAPI+0x45000)
00007ff9`98e79e00 00007ff9`96640000 SHLWAPI!_guard_check_icall_fptr (SHLWAPI+0x0)
00007ff9`98e79e08 000033d8`00051000
00007ff9`98e79e10 00007ff9`96734000 msvcrt!bufin+0x5a0
00007ff9`98e79e18 00007ff9`966a0000 msvcrt!_guard_check_icall_fptr (msvcrt+0x0)
00007ff9`98e79e20 00008004`000a7000
00007ff9`98e79e28 00007ff9`96776000 IMM32!CleanDate+0x38
00007ff9`98e79e30 00007ff9`96750000 IMM32!_guard_check_icall_fptr (IMM32+0x0)
00007ff9`98e79e38 0000486c`00034000
00007ff9`98e79e40 00007ff9`9682b000 USER32!gpfnGetIMEMenuItemData+0x658
00007ff9`98e79e48 00007ff9`96790000 USER32!_guard_check_icall_fptr (USER32+0x0)
00007ff9`98e79e50 0000c7a4`00171000
00007ff9`98e79e58 00007ff9`96a30000 GDI32!__PchSym_ (GDI32+0x120000)
00007ff9`98e79e60 00007ff9`96910000 GDI32!_guard_check_icall_fptr (GDI32+0x0)
00007ff9`98e79e68 0000f000`00145000
00007ff9`98e79e70 00007ff9`96e45000 KERNEL32!FSPErrorMessages::g_pwszWMREscalatedMessageBuffer (KERNEL32+0x115000)
00007ff9`98e79e78 00007ff9`96d30000 KERNEL32!_guard_check_icall_fptr (KERNEL32+0x0)
00007ff9`98e79e80 00007ed8`00139000
00007ff9`98e79e88 00007ff9`96f85000 RPCRT4!__PchSym_ (RPCRT4+0x115000)
00007ff9`98e79e90 00007ff9`96e70000 RPCRT4!_guard_check_icall_fptr (RPCRT4+0x0)
00007ff9`98e79e98 0001593c`00136000
00007ff9`98e79ea0 00007ff9`97054000 ADVAPI32!g_Win64Registry (ADVAPI32+0x94000)
00007ff9`98e79ea8 00007ff9`96fc0000 ADVAPI32!_guard_check_icall_fptr (ADVAPI32+0x0)
00007ff9`98e79eb0 000060d8`000a5000
00007ff9`98e79eb8 00007ff9`97108000 clbcatq!g_pfnGetProcessLogger (clbcatq+0x98000)
00007ff9`98e79ec0 00007ff9`97070000 clbcatq!_guard_check_icall_fptr (clbcatq+0x0)
00007ff9`98e79ec8 00004854`000a4000
00007ff9`98e79ed0 00007ff9`971c5000 OLEAUT32!__PchSym_ (OLEAUT32+0xa5000)
00007ff9`98e79ed8 00007ff9`97120000 OLEAUT32!_guard_check_icall_fptr (OLEAUT32+0x0)
00007ff9`98e79ee0 0000a56c`000b7000
00007ff9`98e79ee8 00007ff9`972c0000 MSCTF!__PchSym_ (MSCTF+0xe0000)
00007ff9`98e79ef0 00007ff9`971e0000 MSCTF!_guard_check_icall_fptr (MSCTF+0x0)
00007ff9`98e79ef8 0000fe58`00138000
00007ff9`98e79f00 00007ff9`974b1000 combase!bAllocateIfNeccessary (combase+0x191000)
00007ff9`98e79f08 00007ff9`97320000 combase!__ImageBase
00007ff9`98e79f10 00026b98`001d7000
00007ff9`98e79f18 00007ff9`9766e000 gdiplus!IntMap::EmptyPlane (gdiplus+0x16e000)
00007ff9`98e79f20 00007ff9`97500000 gdiplus!_guard_check_icall_fptr (gdiplus+0x0)
00007ff9`98e79f28 00011928`00198000
00007ff9`98e79f30 00007ff9`977ad000 sechost!_puiHead (sechost+0x4d000)
00007ff9`98e79f38 00007ff9`97760000 sechost!_guard_check_icall_fptr (sechost+0x0)
00007ff9`98e79f40 000043f8`00057000
00007ff9`98e79f48 00007ff9`980d2000 SHELL32!`CExecuteAppIDAndActivationContext::_AdjustPropStoreForImmersiveExecute'::`17'::`local static guard' \ (SHELL32+0x912000)
00007ff9`98e79f50 00007ff9`977c0000 SHELL32!_guard_check_icall_fptr \ (SHELL32+0x0)
00007ff9`98e79f58 00086988`0140f000
00007ff9`98e79f60 00007ff9`98d12000 ole32!__PchSym_ (ole32+0x142000)
00007ff9`98e79f68 00007ff9`98bd0000 ole32!__ImageBase
00007ff9`98e79f70 00014b20`00176000
00007ff9`98e79f78 00000000`00000000
00007ff9`98e79f80 00000000`00000000
00007ff9`98e79f88 00000000`00000000
00007ff9`98e79f90 00000000`00000000

It seems to hold records of the following format showing each library's
size and .pdata section base and size:

struct {
PVOID lib_pdata_section_base;
PVOID lib_loaded_base;
DWORD lib_pdata_section_size;
DWORD lib_image_size;
};

Recall that the .pdata section holds function table entries for SEH64.

!dh ntdll
=>
1A9000 size of image
SECTION HEADER `#4`
.pdata name
C1D4 virtual size
132000 virtual address

!dh winmm
=...

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=1300_