16#ifndef LIEF_PE_RUNTIME_FUNCTION_X64_H
17#define LIEF_PE_RUNTIME_FUNCTION_X64_H
46 LIEF_LOCAL static std::unique_ptr<RuntimeFunctionX64>
136 RCX,
RDX,
RBX,
RSP,
RBP,
RSI,
RDI,
R8,
R9,
R10,
R11,
R12,
R13,
R14,
R15,
143 using opcodes_t = std::vector<std::unique_ptr<unwind_x64::Code>>;
185 return (
flags & (
int)flag) != 0;
197 os << info.to_string();
214 std::unique_ptr<ExceptionInfo>
clone()
const override {
237 return unwind_info_.has_value() ? &*unwind_info_ :
nullptr;
241 return unwind_info_.has_value() ? &*unwind_info_ :
nullptr;
245 unwind_info_ = std::move(info);
255 uint32_t rva_end_ = 0;
256 uint32_t unwind_rva_ = 0;
Class that is used to a read stream of data from different sources.
Definition BinaryStream.hpp:33
uint32_t rva_start() const
Function start address.
Definition ExceptionInfo.hpp:70
ARCH
Arch discriminator for the subclasses.
Definition ExceptionInfo.hpp:50
@ X86_64
Definition ExceptionInfo.hpp:52
Main interface to parse PE binaries. In particular the static functions: Parser::parse should be used...
Definition PE/Parser.hpp:52
std::string to_string() const override
UNWIND_REG
Definition RuntimeFunctionX64.hpp:134
@ R14
Definition RuntimeFunctionX64.hpp:136
@ R12
Definition RuntimeFunctionX64.hpp:136
@ RBP
Definition RuntimeFunctionX64.hpp:136
@ R15
Definition RuntimeFunctionX64.hpp:136
@ R10
Definition RuntimeFunctionX64.hpp:136
@ RSP
Definition RuntimeFunctionX64.hpp:136
@ RDX
Definition RuntimeFunctionX64.hpp:136
@ R13
Definition RuntimeFunctionX64.hpp:136
@ RCX
Definition RuntimeFunctionX64.hpp:136
@ RSI
Definition RuntimeFunctionX64.hpp:136
@ RBX
Definition RuntimeFunctionX64.hpp:136
@ R11
Definition RuntimeFunctionX64.hpp:136
@ R9
Definition RuntimeFunctionX64.hpp:136
@ RAX
Definition RuntimeFunctionX64.hpp:135
@ RDI
Definition RuntimeFunctionX64.hpp:136
@ R8
Definition RuntimeFunctionX64.hpp:136
void unwind_info(unwind_info_t info)
Definition RuntimeFunctionX64.hpp:244
const unwind_info_t * unwind_info() const
Detailed unwind information.
Definition RuntimeFunctionX64.hpp:236
UNWIND_OPCODES
Definition RuntimeFunctionX64.hpp:65
@ SAVE_XMM128
Save all 128 bits of a nonvolatile XMM register on the stack. The operation info is the number of the...
Definition RuntimeFunctionX64.hpp:122
@ SAVE_NONVOL_FAR
Save a nonvolatile integer register on the stack with a long offset, using a MOV instead of a PUSH....
Definition RuntimeFunctionX64.hpp:109
@ SAVE_XMM128_FAR
Save all 128 bits of a nonvolatile XMM register on the stack with a long offset. The operation info i...
Definition RuntimeFunctionX64.hpp:127
@ SPARE
Reserved Originally SAVE_XMM128_FAR in version 1, but deprecated and removed.
Definition RuntimeFunctionX64.hpp:117
@ EPILOG
This entry is only revelant for version 2. It describes the function epilog.
Definition RuntimeFunctionX64.hpp:113
@ PUSH_MACHFRAME
Push a machine frame. This unwind code is used to record the effect of a hardware interrupt or except...
Definition RuntimeFunctionX64.hpp:131
@ PUSH_NONVOL
Push a nonvolatile integer register, decrementing RSP by 8. The operation info is the number of the r...
Definition RuntimeFunctionX64.hpp:72
@ SAVE_NONVOL
Save a nonvolatile integer register on the stack using a MOV instead of a PUSH. This code is primaril...
Definition RuntimeFunctionX64.hpp:101
@ SET_FPREG
Establish the frame pointer register by setting the register to some offset of the current RSP....
Definition RuntimeFunctionX64.hpp:93
@ ALLOC_SMALL
Allocate a small-sized area on the stack. The size of the allocation is the operation info field * 8 ...
Definition RuntimeFunctionX64.hpp:84
@ ALLOC_LARGE
Allocate a large-sized area on the stack. There are two forms. If the operation info equals 0,...
Definition RuntimeFunctionX64.hpp:80
~RuntimeFunctionX64()=default
RuntimeFunctionX64(RuntimeFunctionX64 &&)=default
RuntimeFunctionX64(uint32_t rva_start, uint32_t rva_end, uint32_t unwind_rva)
Definition RuntimeFunctionX64.hpp:202
uint32_t unwind_rva() const
Unwind info address.
Definition RuntimeFunctionX64.hpp:226
RuntimeFunctionX64 & operator=(const RuntimeFunctionX64 &)=default
std::unique_ptr< ExceptionInfo > clone() const override
Definition RuntimeFunctionX64.hpp:214
uint32_t size() const
Size of the function (in bytes).
Definition RuntimeFunctionX64.hpp:231
RuntimeFunctionX64(const RuntimeFunctionX64 &)=default
static bool classof(const ExceptionInfo *info)
Definition RuntimeFunctionX64.hpp:248
UNWIND_FLAGS
Definition RuntimeFunctionX64.hpp:53
@ CHAIN_INFO
The chained info payload references a previous RUNTIME_FUNCTION.
Definition RuntimeFunctionX64.hpp:62
@ EXCEPTION_HANDLER
The function has an exception handler that should be called when looking for functions that need to e...
Definition RuntimeFunctionX64.hpp:56
@ TERMINATE_HANDLER
The function has a termination handler that should be called when unwinding an exception.
Definition RuntimeFunctionX64.hpp:59
unwind_info_t * unwind_info()
Definition RuntimeFunctionX64.hpp:240
uint32_t rva_end() const
Function end address.
Definition RuntimeFunctionX64.hpp:221
RuntimeFunctionX64 & operator=(RuntimeFunctionX64 &&)=default
Base class for all unwind operations.
Definition UnwindCodeX64.hpp:31
Definition optional.hpp:23
#define ENABLE_BITMASK_OPERATORS(X)
Definition enums.hpp:24
This namespace wraps code related to PE-x64 unwinding code.
Definition RuntimeFunctionX64.hpp:34
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
const char * to_string(CODE_PAGES e)
LIEF namespace.
Definition Abstract/Binary.hpp:40
result< ok_t > ok_error_t
Opaque structure that is used by LIEF to avoid writing result<void> f(...). Instead,...
Definition errors.hpp:109
This structure represents the UNWIND_INFO which records the effects a function has on the stack point...
Definition RuntimeFunctionX64.hpp:142
uint8_t sizeof_prologue
Length of the function prolog in bytes.
Definition RuntimeFunctionX64.hpp:152
uint8_t frame_reg
If nonzero, then the function uses a frame pointer (FP), and this field is the number of the nonvolat...
Definition RuntimeFunctionX64.hpp:163
optional< uint32_t > handler
An image-relative pointer to either the function's language-specific exception or termination handler...
Definition RuntimeFunctionX64.hpp:177
bool has(UNWIND_FLAGS flag) const
Check if the given flag is used.
Definition RuntimeFunctionX64.hpp:184
opcodes_t opcodes() const
Enhanced representation of the unwind code.
uint8_t frame_reg_offset
If the frame register field is nonzero, this field is the scaled offset from RSP that is applied to t...
Definition RuntimeFunctionX64.hpp:167
std::string to_string() const
Pretty representation of this structure as a string.
uint8_t flags
See: UNWIND_FLAGS.
Definition RuntimeFunctionX64.hpp:149
std::vector< std::unique_ptr< unwind_x64::Code > > opcodes_t
Definition RuntimeFunctionX64.hpp:143
std::vector< uint8_t > raw_opcodes
An array of items that explains the effect of the prolog on the nonvolatile registers and RSP.
Definition RuntimeFunctionX64.hpp:171
friend std::ostream & operator<<(std::ostream &os, const unwind_info_t &info)
Definition RuntimeFunctionX64.hpp:195
uint8_t version
Version number of the unwind data, currently 1 or 2.
Definition RuntimeFunctionX64.hpp:146
uint8_t count_opcodes
The number of slots in the unwind codes array. Some unwind codes, for example, UNWIND_OPCODES::SAVE_N...
Definition RuntimeFunctionX64.hpp:157
RuntimeFunctionX64 * chained
If UNWIND_FLAGS::CHAIN_INFO is set, this attributes references the chained runtime function.
Definition RuntimeFunctionX64.hpp:181
#define LIEF_API
Definition visibility.h:41
#define LIEF_LOCAL
Definition visibility.h:42