Re: [PATCH v5 0/1] MR8466: ntdll: Also restore rbp before calling user mode callback.

[Paul Gofman (＠gofman)]

On Sat Jul  5 01:59:45 2025 +0000, Paul Gofman wrote:
> But your test shows (Win11):
> rip=00007ff750e81a12 rsp=00000010617ff900 rbp=00000010617ffa70 eflags=00000202
> rax=00007ffd89112a00 rbx=0000000000000000 rcx=00000010617ff0f0 rdx=0000000000000082
> rsi=0000000000000000 rdi=0000000000000000  r8=0000000000000000  r9=0000000000000000
> r10=cf18061710d6ea70 r11=0000000000000246 r12=0000000000000000 r13=0000000000000000
> r14=0000000000000000 r15=0000000000000000 mxcsr=00001f80
> rip=00007ff750e81a25 rsp=00000010617ff900 rbp=00000010617ffa70 eflags=00000246
> rax=00007ffd89112a00 rbx=00000000deadbeaf rcx=00007ff750e87040 rdx=0000000000000000
> rsi=00000000deadbeaf rdi=00000000deadbeaf  r8=00000010617ff8c8  r9=0000000000000000
> r10=0000000000000000 r11=0000000000000246 r12=00000000deadbeaf r13=00000000deadbeaf
> r14=00000000deadbeaf r15=0000000000000000 mxcsr=00001f80
>
> I see many non-volatile registers actually restored to 0xdeadbeef. For
> others, I am not immediately fully sure if they were actually
> deadbeef'ed ("i", "j", "k" thing is hard to follow), or werent' altered
> after before getting to the unwind target place.

Also, you'd need to "spoil" the current register values before doing unwind, or it may err on this side if those registers are just preseved as deadbeef throughout the call chain.