LIEF: Library to Instrument Executable Formats Version 0.17.0
Loading...
Searching...
No Matches
UnpackedFunction.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2025 R. Thomas
2 * Copyright 2017 - 2025 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_RUNTIME_FUNCTION_AARCH64_UNPACKED_H
17#define LIEF_PE_RUNTIME_FUNCTION_AARCH64_UNPACKED_H
18
19#include "LIEF/span.hpp"
20#include "LIEF/visibility.h"
21#include "LIEF/iterators.hpp"
23
24namespace LIEF {
25namespace PE {
26namespace unwind_aarch64 {
27class LIEF_API UnpackedFunction : public RuntimeFunctionAArch64 {
32 public:
33 struct epilog_scope_t {
36 static epilog_scope_t from_raw(uint32_t raw); uint32_t start_offset = 0;
39 uint16_t start_index = 0;
42 uint8_t reserved = 0;
45 };
46
47 using epilog_scopes_t = std::vector<epilog_scope_t>;
48 using it_epilog_scopes = ref_iterator<epilog_scopes_t&>;
49 using it_const_epilog_scopes = const_ref_iterator<const epilog_scopes_t&>;
50
51 static std::unique_ptr<UnpackedFunction>
52 parse(Parser& ctx, BinaryStream& strm, uint32_t xdata_rva, uint32_t rva);
53
54 UnpackedFunction(uint32_t rva, uint32_t length) :
55 RuntimeFunctionAArch64(rva, length, PACKED_FLAGS::UNPACKED)
56 {}
57
58 UnpackedFunction(const UnpackedFunction&) = default;
59 UnpackedFunction& operator=(const UnpackedFunction&) = default;
60
61 UnpackedFunction(UnpackedFunction&&) = default;
62 UnpackedFunction& operator=(UnpackedFunction&&) = default;
63
64 ~UnpackedFunction() override = default;
65
66 std::unique_ptr<ExceptionInfo> clone() const override {
67 return std::unique_ptr<UnpackedFunction>(new UnpackedFunction(*this));
68 }
69
70 std::string to_string() const override;
71 uint32_t xdata_rva() const {
74 return xdata_rva_;
75 }
76 uint32_t version() const {
82 return version_;
83 }
84 uint8_t X() const {
88 return x_;
89 }
90 uint8_t E() const {
94 return e_;
95 }
96 uint16_t epilog_count() const {
100 return E() == 1 ? 0 : epilog_count_;
101 }
102 uint16_t epilog_offset() const {
106 return E() == 1 ? epilog_offset_ : uint16_t(-1);
107 }
108 uint32_t code_words() const {
111 return code_words_;
112 }
113 uint32_t exception_handler() const {
116 return exception_handler_;
117 }
118 span<const uint8_t> unwind_code() const {
121 return unwind_code_;
122 }
123
124 span<uint8_t> unwind_code() {
125 return unwind_code_;
126 }
127 it_epilog_scopes epilog_scopes() {
130 return epilog_scopes_;
131 }
132
133 it_const_epilog_scopes epilog_scopes() const {
134 return epilog_scopes_;
135 }
136
137 UnpackedFunction& xdata_rva(uint32_t value) {
138 xdata_rva_ = value;
139 return *this;
140 }
141
142 UnpackedFunction& version(uint32_t value) {
143 version_ = value;
144 return *this;
145 }
146
147 UnpackedFunction& X(uint8_t value) {
148 x_ = value;
149 return *this;
150 }
151
152 UnpackedFunction& E(uint8_t value) {
153 e_ = value;
154 return *this;
155 }
156
157 UnpackedFunction& epilog_cnt_offset(uint16_t value) {
158 epilog_offset_ = value;
159 return *this;
160 }
161
162 UnpackedFunction& code_words(uint32_t value) {
163 code_words_ = value;
164 return *this;
165 }
166
167 UnpackedFunction& exception_handler(uint32_t value) {
168 exception_handler_ = value;
169 return *this;
170 }
171
172 UnpackedFunction& epilog_scopes(epilog_scopes_t scopes) {
173 epilog_scopes_ = std::move(scopes);
174 return *this;
175 }
176
177 UnpackedFunction& unwind_code(std::vector<uint8_t> code) {
178 unwind_code_ = std::move(code);
179 return *this;
180 }
181
182 static bool classof(const ExceptionInfo* info) {
183 if (!RuntimeFunctionAArch64::classof(info)) {
184 return false;
185 }
186 const auto* aarch64 = static_cast<const RuntimeFunctionAArch64*>(info);
187 return aarch64->flag() == PACKED_FLAGS::UNPACKED;
188 }
189
190 private:
191 uint32_t xdata_rva_ = 0;
192 uint32_t version_ = 0;
193 uint8_t x_ = 0;
194 uint8_t e_ = 0;
195 union {
196 uint32_t epilog_count_;
197 uint32_t epilog_offset_ = 0;
198 };
199 uint32_t code_words_ = 0;
200 uint32_t exception_handler_ = 0;
201
202 epilog_scopes_t epilog_scopes_;
203 std::vector<uint8_t> unwind_code_;
204};
205}
206}
207}
208#endif
RuntimeFunctionAArch64.hpp
LIEF::PE::unwind_aarch64::UnpackedFunction
This class represents an unpacked AArch64 exception entry.
Definition UnpackedFunction.hpp:31
LIEF::PE::unwind_aarch64::UnpackedFunction::X
uint8_t X() const
1-bit field that indicates the presence (1) or absence (0) of exception data.
Definition UnpackedFunction.hpp:87
LIEF::PE::unwind_aarch64::UnpackedFunction::parse
static std::unique_ptr< UnpackedFunction > parse(Parser &ctx, BinaryStream &strm, uint32_t xdata_rva, uint32_t rva)
LIEF::PE::unwind_aarch64::UnpackedFunction::UnpackedFunction
UnpackedFunction(uint32_t rva, uint32_t length)
Definition UnpackedFunction.hpp:54
LIEF::PE::unwind_aarch64::UnpackedFunction::code_words
UnpackedFunction & code_words(uint32_t value)
Definition UnpackedFunction.hpp:162
LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scopes
it_epilog_scopes epilog_scopes()
Iterator over the epilog scopes.
Definition UnpackedFunction.hpp:129
LIEF::PE::unwind_aarch64::UnpackedFunction::unwind_code
span< uint8_t > unwind_code()
Definition UnpackedFunction.hpp:124
LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_offset
uint16_t epilog_offset() const
If E() == 1, index of the first unwind code that describes the one and only epilog.
Definition UnpackedFunction.hpp:105
LIEF::PE::unwind_aarch64::UnpackedFunction::E
uint8_t E() const
1-bit field that indicates that information describing a single epilog is packed into the header (1) ...
Definition UnpackedFunction.hpp:93
LIEF::PE::unwind_aarch64::UnpackedFunction::version
UnpackedFunction & version(uint32_t value)
Definition UnpackedFunction.hpp:142
LIEF::PE::unwind_aarch64::UnpackedFunction::~UnpackedFunction
~UnpackedFunction() override=default
LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_cnt_offset
UnpackedFunction & epilog_cnt_offset(uint16_t value)
Definition UnpackedFunction.hpp:157
LIEF::PE::unwind_aarch64::UnpackedFunction::E
UnpackedFunction & E(uint8_t value)
Definition UnpackedFunction.hpp:152
LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scopes
UnpackedFunction & epilog_scopes(epilog_scopes_t scopes)
Definition UnpackedFunction.hpp:172
LIEF::PE::unwind_aarch64::UnpackedFunction::exception_handler
uint32_t exception_handler() const
Exception handler RVA (if any)
Definition UnpackedFunction.hpp:115
LIEF::PE::unwind_aarch64::UnpackedFunction::code_words
uint32_t code_words() const
Number of 32-bit words needed to contain all of the unwind codes.
Definition UnpackedFunction.hpp:110
LIEF::PE::unwind_aarch64::UnpackedFunction::X
UnpackedFunction & X(uint8_t value)
Definition UnpackedFunction.hpp:147
LIEF::PE::unwind_aarch64::UnpackedFunction::xdata_rva
uint32_t xdata_rva() const
RVA where this unpacked data is located (usually pointing in .xdata)
Definition UnpackedFunction.hpp:73
LIEF::PE::unwind_aarch64::UnpackedFunction::exception_handler
UnpackedFunction & exception_handler(uint32_t value)
Definition UnpackedFunction.hpp:167
LIEF::PE::unwind_aarch64::UnpackedFunction::xdata_rva
UnpackedFunction & xdata_rva(uint32_t value)
Definition UnpackedFunction.hpp:137
LIEF::PE::unwind_aarch64::UnpackedFunction::operator=
UnpackedFunction & operator=(UnpackedFunction &&)=default
LIEF::PE::unwind_aarch64::UnpackedFunction::operator=
UnpackedFunction & operator=(const UnpackedFunction &)=default
LIEF::PE::unwind_aarch64::UnpackedFunction::unwind_code
span< const uint8_t > unwind_code() const
Bytes that contain the unwind codes.
Definition UnpackedFunction.hpp:120
LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scopes
it_const_epilog_scopes epilog_scopes() const
Definition UnpackedFunction.hpp:133
LIEF::PE::unwind_aarch64::UnpackedFunction::UnpackedFunction
UnpackedFunction(UnpackedFunction &&)=default
LIEF::PE::unwind_aarch64::UnpackedFunction::version
uint32_t version() const
Describes the version of the remaining .xdata.
Definition UnpackedFunction.hpp:81
LIEF::PE::unwind_aarch64::UnpackedFunction::clone
std::unique_ptr< ExceptionInfo > clone() const override
Definition UnpackedFunction.hpp:66
LIEF::PE::unwind_aarch64::UnpackedFunction::UnpackedFunction
UnpackedFunction(const UnpackedFunction &)=default
LIEF::PE::unwind_aarch64::UnpackedFunction::to_string
std::string to_string() const override
LIEF::PE::unwind_aarch64::UnpackedFunction::unwind_code
UnpackedFunction & unwind_code(std::vector< uint8_t > code)
Definition UnpackedFunction.hpp:177
LIEF::PE::unwind_aarch64::UnpackedFunction::classof
static bool classof(const ExceptionInfo *info)
Definition UnpackedFunction.hpp:182
LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_count
uint16_t epilog_count() const
If E() == 0, specifies the count of the total number of epilog scopes. Otherwise, return 0
Definition UnpackedFunction.hpp:99
iterators.hpp
LIEF::PE::unwind_aarch64
This namespace wraps code related to PE-ARM64 unwinding code.
Definition PackedFunction.hpp:26
LIEF::PE
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
LIEF::PE::ACCELERATOR_CODES::E
@ E
Definition AcceleratorCodes.hpp:82
LIEF
LIEF namespace.
Definition Abstract/Binary.hpp:36
span.hpp
LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scope_t::from_raw
static epilog_scope_t from_raw(uint32_t raw)
visibility.h
LIEF_API
#define LIEF_API
Definition visibility.h:41