$BaseAddress = NtQueryInformationThread -ThreadHandle $hThread

$buf = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([IntPtr]::Size)

    $Success = $Ntdll::NtQueryInformationThread($ThreadHandle, 9, $buf, [IntPtr]::Size, [IntPtr]::Zero); $LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()

    if(-not $Success) 
    {
        Write-Debug "NtQueryInformationThread Error: $(([ComponentModel.Win32Exception] $LastError).Message)"
    }

    Write-Output ([System.Runtime.InteropServices.Marshal]::ReadIntPtr($buf))

typedef struct _MEMORY_BASIC_INFORMATION {
    PVOID BaseAddress;  //指向查询的内存区域的基地址
    PVOID AllocationBase; //指向分配的内存块的基地址
    DWORD AllocationProtect; //分配时使用的内存保护属性
    SIZE_T RegionSize; //内存区域的大小
    DWORD State; //内存区域的状态MEM_COMMIT: 表示内存已提交。MEM_FREE: 表示内存是空闲的。MEM_RESERVE: 表示内存已保留。
    DWORD Protect; //内存区域的当前保护属性
    DWORD Type; //内存区域的类型MEM_IMAGE: 表示内存是映像文件的一部分。MEM_MAPPED: 表示内存是映射文件的一部分。MEM_PRIVATE: 表示内存是私有的。
} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;

$memory_basic_info = VirtualQueryEx -ProcessHandle $hProcess -BaseAddress $BaseAddress
$AllocatedMemoryProtection = $memory_basic_info.AllocationProtect -as $MemProtection
$MemoryProtection = $memory_basic_info.Protect -as $MemProtection
$MemoryState = $memory_basic_info.State -as $MemState
$MemoryType = $memory_basic_info.Type -as $MemType

if($MemoryState -eq $MemState::MEM_COMMIT -and $MemoryType -ne $MemType::MEM_IMAGE){
    ……
}

PSAPI_WORKING_SET_EX_INFORMATION pwsei{};
pwsei.VirtualAddress = thread.Win32StartAddress;
if (K32QueryWorkingSetEx(hProcess, &pwsei, sizeof(pwsei)) && !pwsei.VirtualAttributes.Shared) 
{
    static bool s_edrFalsePositive = symbol.starts_with("ntdll.dll!") && K32QueryWorkingSetEx(GetCurrentProcess(), &pwsei, sizeof(pwsei)) && !pwsei.VirtualAttributes.Shared;
    if(!s_edrFalsePositive)
        detections.push_back("private_image");
}

00：该地址范围没有有效的跳转地址
01：地址范围包含导出抑制表目标
10：只有16位对齐的地址有效（该范围的第一个地址）
11：地址范围的所有地址均有效

#include <stdio.h>

// 定义两个简单的函数
void function1() {
    printf("This is function 1.\n");
}

void function2() {
    printf("This is function 2.\n");
}

int main() {
    // 定义一个函数指针
    void (*func_ptr)();

    // 将函数指针指向function1
    func_ptr = function1;
    // 通过函数指针调用function1
    func_ptr();

    // 将函数指针指向function2
    func_ptr = function2;
    // 通过函数指针调用function2
    func_ptr();

    return 0;
}

mov r11,qword ptr[xxxxxxx] 首先获取一个基地址值ntdll!LdrSystemDllInitBlock.CfgBitMap
然后将函数地址进行右移9位作为一个偏移，也即是shr r10,9
然后计算加上偏移的值 mov r11,qword ptr[r11+r10*8]，这时候获取到的r11的地址存储的值就是我们需要的值了
然后再将函数地址右移3位 shr r10,3
然后判断是不是16字节对齐
bt r11,r10 这里将r10 mod 64的值作为偏移位去r11取，然后赋给cf
后面的几次验证就是相当于进行校验其他的几种情况，那四种状态，00，01，10，11

if (InSystemImageRange(thread.Win32StartAddress) && 0 == ((ULONG_PTR)thread.Win32StartAddress & 0xF) && GetCfgBitsForAddress(thread.Win32StartAddress, &cfgBits) && 0 == cfgBits)
{
    detections.push_back("cfg_invalid");
}

BOOL GetCfgBitsForAddress(PVOID address, PULONG pCfgBits) {
    static auto pCfgBitMap = FindCfgBitMap();
    const PULONG_PTR pLocalEntry = pCfgBitMap + ((ULONG_PTR)address >> 9);
    const ULONG cfgOffset = (((ULONG_PTR)(address)) >> 3) & 0x3E;
    ULONG_PTR localEntry;
    // We use ReadProcessMemory to safely read the volatile CfgBitMap.
    if (ReadProcessMemory(GetCurrentProcess(), pLocalEntry, &localEntry, sizeof(localEntry), NULL)) {
        *pCfgBits = (localEntry >> cfgOffset) & 0b11;
        return TRUE;
    }
    return FALSE;
}

typedef struct _NT_TIB64 {
    DWORD64 ExceptionList;
    DWORD64 StackBase;
    DWORD64 StackLimit;
    DWORD64 SubSystemTib;
#if defined(_MSC_EXTENSIONS)
    union {
        DWORD64 FiberData;
        DWORD Version;
    };
#else
    DWORD64 FiberData;
#endif
    DWORD64 ArbitraryUserPointer;
    DWORD64 Self;
} NT_TIB64, *PNT_TIB64;

NT_TIB64 tib;
if (!ReadProcessMemory(hProcess, thread.TebBaseAddress, &tib, sizeof(tib), NULL))
    return FALSE;
const auto stackPointer = thread.ContextRecord ? thread.ContextRecord->Rsp : tib.StackLimit;
if (stackPointer > tib.StackBase || stackPointer < tib.StackLimit) {
    detections.push_back("stack_pivot");
    return TRUE;
}
PVOID stackBuffer[0x1800 / sizeof(PVOID)];
const auto stackReadLength = std::min(sizeof(stackBuffer), (tib.StackBase - stackPointer) & ~0xF);
if (!ReadProcessMemory(hProcess, (PVOID)(tib.StackBase - stackReadLength), stackBuffer, stackReadLength, NULL))
    return FALSE;

for (auto i = offset; !*pbDetection && (i < stackBufferCount) && (returnAddresses.size() < MIN_FRAMES); i += 2) {
    const PVOID candidateRip = StackBufferLast[-i]

if (candidateRip < s_si.lpMinimumApplicationAddress || candidateRip >= s_si.lpMaximumApplicationAddress)
    continue;
if (!IsExecutable(mbi))
    continue;

typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY {
    DWORD BeginAddress;
    DWORD EndAddress;
    union {
        DWORD UnwindInfoAddress;
        DWORD UnwindData;
    } DUMMYUNIONNAME;
} _IMAGE_RUNTIME_FUNCTION_ENTRY, *_PIMAGE_RUNTIME_FUNCTION_ENTRY;

indexHi = indexHi / sizeof(RUNTIME_FUNCTION);
while (indexHi > indexLo) {
    const ULONG indexMid = (indexLo + indexHi) / 2;
    pRuntimeFunction = &pTable[indexMid];
    if (rva < pRuntimeFunction->BeginAddress) {
        indexHi = indexMid;  // search lower
        pRuntimeFunction = NULL;
        continue;
    }
    if (rva >= pRuntimeFunction->EndAddress) {
        indexLo = indexMid + 1;  // search higher
        pRuntimeFunction = NULL;
        continue;
    }
    break;  // found
}

RUNTIME_FUNCTION    // 这个上面提到过

typedef struct _UNWIND_INFO {
    unsigned char Version : 3;
    unsigned char Flags : 5;
    unsigned char SizeOfProlog;
    unsigned char CountOfCodes;
    unsigned char FrameRegister : 4;
    unsigned char FrameOffset : 4;
    UNWIND_CODE UnwindCode[1];
} UNWIND_INFO, * PUNWIND_INFO;

FLAGS：定义了三个标志
UNW_FLAG_EHANDLER (0x01): 表示函数有异常处理程序。
UNW_FLAG_UHANDLER (0x02): 表示函数有终结处理程序。
UNW_FLAG_CHAININFO (0x04): 表示当前的UNWIND_INFO结构是链式信息。

typedef union _UNWIND_CODE {
    struct {
        unsigned char CodeOffset;
        unsigned char UnwindOp : 4;
        unsigned char OpInfo : 4;
    };
    unsigned short FrameOffset;
} UNWIND_CODE, * PUNWIND_CODE;

switch (unwindOperation) {
    case UWOP_PUSH_NONVOL:
        if (bApplyOperation)
            (*pFrameSize)++;
        break;
    case UWOP_ALLOC_LARGE:
        switch (operationInfo) {
            case 0:
                if (bApplyOperation)
                    *pFrameSize += pUnwindInfo->UnwindCode[i].FrameOffset;
                i++;
                break;
            case 1:
                if (bApplyOperation)
                    *pFrameSize += *(DWORD*)(&pUnwindInfo->UnwindCode[i]) / sizeof(PVOID);
                i += 3;
                break;
            default:
                LogError("UWOP_ALLOC_LARGE operationInfo is invalid: (%d)", operationInfo);
                return E_INVALIDARG;
        }
        break;
    case UWOP_ALLOC_SMALL:
        if (bApplyOperation)
            *pFrameSize += operationInfo + 1;
        break;
    case UWOP_SET_FPREG:
        if (bApplyOperation) {
            *pFrameSize = pUnwindInfo->FrameOffset * 2;
            status = W_FPREG;
        }
        break;
    case UWOP_SAVE_NONVOL:
    case UWOP_SAVE_XMM128:
    case UWOP_EPILOG:
        i++;
        break;
    case UWOP_SAVE_NONVOL_FAR:
    case UWOP_SAVE_XMM128_FAR:
        i += 2;
        break;
    case UWOP_PUSH_MACHFRAME:
        if (bApplyOperation) {
            *pFrameSize += 5 + operationInfo;
        }
        break;
    default:
        if (bApplyOperation) {
            LogError("UNWIND_INFO operation is not implemented: %d", unwindOperation);
            return E_INVALIDARG;
        }
}