How to uninstall RtlInstallFunctionTableCallback?

  64-bit, jit, stack-unwinding, windows, x86-64

What is the reverse of the RtlInstallFunctionTableCallback function ?

I have been looking at it to avoid the rather slow RtlAddFunctionTable/RtlDeleteFunctionTable for transient JIT’ed math expressions, but I could not find a way to uninstall a callback…

I suspect the (otherwise unused and apparently redundant) TableIdentifier parameter may have something to do with it, but it does not seem documented.

Also it is not entirely clear if the table returned by the callback si actually added on the fly (fed to RtlAddFunctionTable, and thus should be cleaned up later with RtlDeleteFunctionTable) or if it’s just transiently used.

Source: Windows Questions

LEAVE A COMMENT