16 Jun
2025
16 Jun
'25
2:01 p.m.
On Mon Jun 16 11:14:03 2025 +0000, Nikolay Sivov wrote:
That was fine before, when Rtl* functions were only for internal use. But now this can't be too wrong.
It's very close. There are some articles online showing its prototype. I added the FIXME to note that it's not 100% correct. For example, on Win7, `RtlActivateActivationContextUnsafeFast` returns an NTSTATUS. I also see some blogs showing `RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED` might not contain Extra1~4 fields.
For `RtlDeactivateActivationContextUnsafeFast`, some say it returns an `RTL_ACTIVATION_CONTEXT_STACK_FRAME`, but I didn't figure out what it really means. Some say it returns a `void`. On Win7, it returns an NTSTATUS. I chose to return void here.