LIEF: Library to Instrument Executable Formats Version 0.17.0
Loading...
Searching...
No Matches
RuntimeFunctionX64.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2025 R. Thomas
2 * Copyright 2017 - 2025 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_RUNTIME_FUNCTION_X64_H
17#define LIEF_PE_RUNTIME_FUNCTION_X64_H
18
19#include <memory>
20
21#include "LIEF/errors.hpp"
22#include "LIEF/visibility.h"
23#include "LIEF/enums.hpp"
24#include "LIEF/optional.hpp"
25
27
28namespace LIEF {
29class BinaryStream;
30
31namespace PE {
32class Parser;
33
34namespace unwind_x64 {
35class Code;
36}
37
43 public:
44
46 LIEF_LOCAL static std::unique_ptr<RuntimeFunctionX64>
47 parse(Parser& ctx, BinaryStream& strm, bool skip_unwind = false);
48
51 parse_unwind(Parser& ctx, BinaryStream& strm, RuntimeFunctionX64& func);
52
53 enum class UNWIND_FLAGS : uint8_t {
60
63 };
64
65 enum class UNWIND_OPCODES : uint32_t {
73
81
85
94
102
110
114
117 SPARE = 7,
118
123
128
132 };
133
134 enum class UNWIND_REG : uint32_t {
135 RAX = 0,
137 };
138
143 using opcodes_t = std::vector<std::unique_ptr<unwind_x64::Code>>;
144
146 uint8_t version = 0;
147
149 uint8_t flags = 0;
150
152 uint8_t sizeof_prologue = 0;
153
157 uint8_t count_opcodes = 0;
158
163 uint8_t frame_reg = 0;
164
167 uint8_t frame_reg_offset = 0;
168
171 std::vector<uint8_t> raw_opcodes;
172
178
182
184 bool has(UNWIND_FLAGS flag) const {
185 return (flags & (int)flag) != 0;
186 }
187
190
192 std::string to_string() const;
193
194 friend LIEF_API
195 std::ostream& operator<<(std::ostream& os, const unwind_info_t& info)
196 {
197 os << info.to_string();
198 return os;
199 }
200 };
201
202 RuntimeFunctionX64(uint32_t rva_start, uint32_t rva_end, uint32_t unwind_rva) :
204 rva_end_(rva_end),
205 unwind_rva_(unwind_rva)
206 {}
207
210
213
214 std::unique_ptr<ExceptionInfo> clone() const override {
215 return std::unique_ptr<RuntimeFunctionX64>(new RuntimeFunctionX64(*this));
216 }
217
218 std::string to_string() const override;
219
221 uint32_t rva_end() const {
222 return rva_end_;
223 }
224
226 uint32_t unwind_rva() const {
227 return unwind_rva_;
228 }
229
231 uint32_t size() const {
232 return rva_end() - rva_start();
233 }
234
236 const unwind_info_t* unwind_info() const {
237 return unwind_info_.has_value() ? &*unwind_info_ : nullptr;
238 }
239
241 return unwind_info_.has_value() ? &*unwind_info_ : nullptr;
242 }
243
245 unwind_info_ = std::move(info);
246 }
247
248 static bool classof(const ExceptionInfo* info) {
249 return info->arch() == ExceptionInfo::ARCH::X86_64;
250 }
251
253
254 private:
255 uint32_t rva_end_ = 0;
256 uint32_t unwind_rva_ = 0;
257 optional<unwind_info_t> unwind_info_;
258};
259
263
264}
265}
266
268
269#endif
Class that is used to a read stream of data from different sources.
Definition BinaryStream.hpp:33
uint32_t rva_start() const
Function start address.
Definition ExceptionInfo.hpp:70
ARCH
Arch discriminator for the subclasses.
Definition ExceptionInfo.hpp:50
@ X86_64
Definition ExceptionInfo.hpp:52
Main interface to parse PE binaries. In particular the static functions: Parser::parse should be used...
Definition PE/Parser.hpp:52
std::string to_string() const override
UNWIND_REG
Definition RuntimeFunctionX64.hpp:134
@ R14
Definition RuntimeFunctionX64.hpp:136
@ R12
Definition RuntimeFunctionX64.hpp:136
@ RBP
Definition RuntimeFunctionX64.hpp:136
@ R15
Definition RuntimeFunctionX64.hpp:136
@ R10
Definition RuntimeFunctionX64.hpp:136
@ RSP
Definition RuntimeFunctionX64.hpp:136
@ RDX
Definition RuntimeFunctionX64.hpp:136
@ R13
Definition RuntimeFunctionX64.hpp:136
@ RCX
Definition RuntimeFunctionX64.hpp:136
@ RSI
Definition RuntimeFunctionX64.hpp:136
@ RBX
Definition RuntimeFunctionX64.hpp:136
@ R11
Definition RuntimeFunctionX64.hpp:136
@ R9
Definition RuntimeFunctionX64.hpp:136
@ RAX
Definition RuntimeFunctionX64.hpp:135
@ RDI
Definition RuntimeFunctionX64.hpp:136
@ R8
Definition RuntimeFunctionX64.hpp:136
void unwind_info(unwind_info_t info)
Definition RuntimeFunctionX64.hpp:244
const unwind_info_t * unwind_info() const
Detailed unwind information.
Definition RuntimeFunctionX64.hpp:236
UNWIND_OPCODES
Definition RuntimeFunctionX64.hpp:65
@ SAVE_XMM128
Save all 128 bits of a nonvolatile XMM register on the stack. The operation info is the number of the...
Definition RuntimeFunctionX64.hpp:122
@ SAVE_NONVOL_FAR
Save a nonvolatile integer register on the stack with a long offset, using a MOV instead of a PUSH....
Definition RuntimeFunctionX64.hpp:109
@ SAVE_XMM128_FAR
Save all 128 bits of a nonvolatile XMM register on the stack with a long offset. The operation info i...
Definition RuntimeFunctionX64.hpp:127
@ SPARE
Reserved Originally SAVE_XMM128_FAR in version 1, but deprecated and removed.
Definition RuntimeFunctionX64.hpp:117
@ EPILOG
This entry is only revelant for version 2. It describes the function epilog.
Definition RuntimeFunctionX64.hpp:113
@ PUSH_MACHFRAME
Push a machine frame. This unwind code is used to record the effect of a hardware interrupt or except...
Definition RuntimeFunctionX64.hpp:131
@ PUSH_NONVOL
Push a nonvolatile integer register, decrementing RSP by 8. The operation info is the number of the r...
Definition RuntimeFunctionX64.hpp:72
@ SAVE_NONVOL
Save a nonvolatile integer register on the stack using a MOV instead of a PUSH. This code is primaril...
Definition RuntimeFunctionX64.hpp:101
@ SET_FPREG
Establish the frame pointer register by setting the register to some offset of the current RSP....
Definition RuntimeFunctionX64.hpp:93
@ ALLOC_SMALL
Allocate a small-sized area on the stack. The size of the allocation is the operation info field * 8 ...
Definition RuntimeFunctionX64.hpp:84
@ ALLOC_LARGE
Allocate a large-sized area on the stack. There are two forms. If the operation info equals 0,...
Definition RuntimeFunctionX64.hpp:80
RuntimeFunctionX64(RuntimeFunctionX64 &&)=default
RuntimeFunctionX64(uint32_t rva_start, uint32_t rva_end, uint32_t unwind_rva)
Definition RuntimeFunctionX64.hpp:202
uint32_t unwind_rva() const
Unwind info address.
Definition RuntimeFunctionX64.hpp:226
RuntimeFunctionX64 & operator=(const RuntimeFunctionX64 &)=default
std::unique_ptr< ExceptionInfo > clone() const override
Definition RuntimeFunctionX64.hpp:214
uint32_t size() const
Size of the function (in bytes).
Definition RuntimeFunctionX64.hpp:231
RuntimeFunctionX64(const RuntimeFunctionX64 &)=default
static bool classof(const ExceptionInfo *info)
Definition RuntimeFunctionX64.hpp:248
UNWIND_FLAGS
Definition RuntimeFunctionX64.hpp:53
@ CHAIN_INFO
The chained info payload references a previous RUNTIME_FUNCTION.
Definition RuntimeFunctionX64.hpp:62
@ EXCEPTION_HANDLER
The function has an exception handler that should be called when looking for functions that need to e...
Definition RuntimeFunctionX64.hpp:56
@ TERMINATE_HANDLER
The function has a termination handler that should be called when unwinding an exception.
Definition RuntimeFunctionX64.hpp:59
unwind_info_t * unwind_info()
Definition RuntimeFunctionX64.hpp:240
uint32_t rva_end() const
Function end address.
Definition RuntimeFunctionX64.hpp:221
RuntimeFunctionX64 & operator=(RuntimeFunctionX64 &&)=default
Base class for all unwind operations.
Definition UnwindCodeX64.hpp:31
Definition optional.hpp:23
#define ENABLE_BITMASK_OPERATORS(X)
Definition enums.hpp:24
This namespace wraps code related to PE-x64 unwinding code.
Definition RuntimeFunctionX64.hpp:34
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
const char * to_string(CODE_PAGES e)
LIEF namespace.
Definition Abstract/Binary.hpp:40
result< ok_t > ok_error_t
Opaque structure that is used by LIEF to avoid writing result<void> f(...). Instead,...
Definition errors.hpp:109
This structure represents the UNWIND_INFO which records the effects a function has on the stack point...
Definition RuntimeFunctionX64.hpp:142
uint8_t sizeof_prologue
Length of the function prolog in bytes.
Definition RuntimeFunctionX64.hpp:152
uint8_t frame_reg
If nonzero, then the function uses a frame pointer (FP), and this field is the number of the nonvolat...
Definition RuntimeFunctionX64.hpp:163
optional< uint32_t > handler
An image-relative pointer to either the function's language-specific exception or termination handler...
Definition RuntimeFunctionX64.hpp:177
bool has(UNWIND_FLAGS flag) const
Check if the given flag is used.
Definition RuntimeFunctionX64.hpp:184
opcodes_t opcodes() const
Enhanced representation of the unwind code.
uint8_t frame_reg_offset
If the frame register field is nonzero, this field is the scaled offset from RSP that is applied to t...
Definition RuntimeFunctionX64.hpp:167
std::string to_string() const
Pretty representation of this structure as a string.
uint8_t flags
See: UNWIND_FLAGS.
Definition RuntimeFunctionX64.hpp:149
std::vector< std::unique_ptr< unwind_x64::Code > > opcodes_t
Definition RuntimeFunctionX64.hpp:143
std::vector< uint8_t > raw_opcodes
An array of items that explains the effect of the prolog on the nonvolatile registers and RSP.
Definition RuntimeFunctionX64.hpp:171
friend std::ostream & operator<<(std::ostream &os, const unwind_info_t &info)
Definition RuntimeFunctionX64.hpp:195
uint8_t version
Version number of the unwind data, currently 1 or 2.
Definition RuntimeFunctionX64.hpp:146
uint8_t count_opcodes
The number of slots in the unwind codes array. Some unwind codes, for example, UNWIND_OPCODES::SAVE_N...
Definition RuntimeFunctionX64.hpp:157
RuntimeFunctionX64 * chained
If UNWIND_FLAGS::CHAIN_INFO is set, this attributes references the chained runtime function.
Definition RuntimeFunctionX64.hpp:181
#define LIEF_API
Definition visibility.h:41
#define LIEF_LOCAL
Definition visibility.h:42