void __stdcall SwitchToFiber(_FIBER *lpFiber)
{
DWORD64 vRbx; // rbx
DWORD64 vRbp; // rbp
DWORD64 vRdi; // rdi
DWORD64 vRsi; // rsi
DWORD64 vR12; // r12
DWORD64 vR13; // r13
DWORD64 vR14; // r14
DWORD64 vR15; // r15
M128A vXmm6; // xmm6
M128A vXmm7; // xmm7
M128A vXmm8; // xmm8
M128A vXmm9; // xmm9
M128A vXmm10; // xmm10
M128A vXmm11; // xmm11
M128A vXmm12; // xmm12
M128A vXmm13; // xmm13
M128A vXmm14; // xmm14
M128A vXmm15; // xmm15
struct _TEB *teb; // rdx
_FIBER *fiber_data; // rax
CONTEXT *ctx; // r8
DWORD64 vRip; // [rsp+0h] [rbp+0h]
if ( *(__int64 *)((char *)&lpFiber->TebFlags + 4) != ((unsigned __int64)lpFiber ^ qword_180217E28 ^ (_QWORD)lpFiber->StackBase) )
__fastfail(ERROR_INVALID_ACCESS);
teb = NtCurrentTeb();
fiber_data = teb->NtTib.FiberData;
teb->DeallocationStack = lpFiber->DeallocationStack;
teb->NtTib.FiberData = lpFiber;
fiber_data->StackLimit = teb->NtTib.StackLimit;
fiber_data->GuaranteedStackBytes = teb->GuaranteedStackBytes;
fiber_data->FlsData = teb->FlsData;
fiber_data->ActivationContextStackPointer = teb->ActivationContextStackPointer;
ctx = &fiber_data->FiberContext;
ctx->Rbx = vRbx;
ctx->Rbp = vRbp;
ctx->Rsi = vRsi;
ctx->Rdi = vRdi;
ctx->R12 = vR12;
ctx->R13 = vR13;
ctx->R14 = vR14;
ctx->R15 = vR15;
ctx->FltSave.XmmRegisters[6] = vXmm6;
ctx->FltSave.XmmRegisters[7] = vXmm7;
ctx->FltSave.XmmRegisters[offsetof(CONTEXT, P2Home)] = vXmm8;
ctx->FltSave.XmmRegisters[9] = vXmm9;
ctx->FltSave.XmmRegisters[0xA] = vXmm10;
ctx->FltSave.XmmRegisters[0xB] = vXmm11;
ctx->FltSave.XmmRegisters[0xC] = vXmm12;
ctx->FltSave.XmmRegisters[0xD] = vXmm13;
ctx->FltSave.XmmRegisters[0xE] = vXmm14;
ctx->FltSave.XmmRegisters[0xF] = vXmm15;
ctx->MxCsr = _mm_getcsr();
__asm { fnclex }
ctx->Rip = vRip;
ctx->Rsp = (DWORD64)&vRip;
teb->NtTib.StackBase = lpFiber->StackBase;
teb->NtTib.StackLimit = lpFiber->StackLimit;
teb->GuaranteedStackBytes = lpFiber->GuaranteedStackBytes;
teb->FlsData = lpFiber->FlsData;
teb->ActivationContextStackPointer = lpFiber->ActivationContextStackPointer;
_mm_setcsr(lpFiber->FiberContext.MxCsr);
}
Comments