Sebastian Lackner sebastian@fds-team.de wrote:
+@ cdecl -arch=x86_64 RtlInstallFunctionTableCallback(long long long ptr ptr ptr)
...
+BOOLEAN CDECL RtlInstallFunctionTableCallback( DWORD64 table, DWORD64 base, DWORD length,
PGET_RUNTIME_FUNCTION_CALLBACK callback, PVOID context, PCWSTR dll )
spec entry doesn't match the implementation. Probably it should be (int64 int64 long ptr ptr wstr)