memmod: register exception handler tables

Otherwise recent WDK binaries fail on ARM64, where an exception handler
is used for trapping an illegal instruction when ARMv8.1 atomics are
being tested for functionality.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

2 files changed, 19 insertions, 0 deletions

diff --git a/driver/memmod/memmod_windows.go b/driver/memmod/memmod_windows.go
index 59450e78..075c03a0 100644
--- a/driver/memmod/memmod_windows.go
+++ b/driver/memmod/memmod_windows.go
@@ -159,6 +159,16 @@ func (module *Module) finalizeSection(sectionData *sectionFinalizeData) error {
 	return nil
 }
 
+var rtlAddFunctionTable = windows.NewLazySystemDLL("ntdll.dll").NewProc("RtlAddFunctionTable")
+
+func (module *Module) registerExceptionHandlers() {
+	directory := module.headerDirectory(IMAGE_DIRECTORY_ENTRY_EXCEPTION)
+	if directory.Size == 0 || directory.VirtualAddress == 0 {
+		return
+	}
+	rtlAddFunctionTable.Call(module.codeBase+uintptr(directory.VirtualAddress), uintptr(directory.Size)/unsafe.Sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY{}), module.codeBase)
+}
+
 func (module *Module) finalizeSections() error {
 	sections := module.headers.Sections()
 	imageOffset := module.headers.OptionalHeader.imageOffset()
@@ -500,6 +510,9 @@ func LoadLibrary(data []byte) (module *Module, err error) {
 		return
 	}
 
+	// Register exception tables, if they exist.
+	module.registerExceptionHandlers()
+
 	// TLS callbacks are executed BEFORE the main loading.
 	module.executeTLS()
 
diff --git a/driver/memmod/syscall_windows.go b/driver/memmod/syscall_windows.go
index b79be69e..a111f92e 100644
--- a/driver/memmod/syscall_windows.go
+++ b/driver/memmod/syscall_windows.go
@@ -370,6 +370,12 @@ const (
 	IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT       = 28
 )
 
+type IMAGE_RUNTIME_FUNCTION_ENTRY struct {
+	BeginAddress      uint32
+	EndAddress        uint32
+	UnwindInfoAddress uint32
+}
+
 const (
 	DLL_PROCESS_ATTACH = 1
 	DLL_THREAD_ATTACH  = 2