LIEF: Library to Instrument Executable Formats Version 1.0.0
Loading...
Searching...
No Matches
UnpackedFunction.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2026 R. Thomas
2 * Copyright 2017 - 2026 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_RUNTIME_FUNCTION_AARCH64_UNPACKED_H
17#define LIEF_PE_RUNTIME_FUNCTION_AARCH64_UNPACKED_H
18
19#include "LIEF/span.hpp"
20#include "LIEF/visibility.h"
21#include "LIEF/iterators.hpp"
23
24namespace LIEF {
25namespace PE {
26namespace unwind_aarch64 {
27
33 public:
36 static epilog_scope_t from_raw(uint32_t raw);
38 uint32_t start_offset = 0;
39
41 uint16_t start_index = 0;
42
44 uint8_t reserved = 0;
45 };
46
47 using epilog_scopes_t = std::vector<epilog_scope_t>;
50
51 static std::unique_ptr<UnpackedFunction> parse(Parser& ctx, BinaryStream& strm,
52 uint32_t xdata_rva, uint32_t rva);
53
54 UnpackedFunction(uint32_t rva, uint32_t length) :
56
59
62
63 ~UnpackedFunction() override = default;
64
65 std::unique_ptr<ExceptionInfo> clone() const override {
66 return std::unique_ptr<UnpackedFunction>(new UnpackedFunction(*this));
67 }
68
69 std::string to_string() const override;
70
72 uint32_t xdata_rva() const {
73 return xdata_rva_;
74 }
75
80 uint32_t version() const {
81 return version_;
82 }
83
86 uint8_t X() const {
87 return x_;
88 }
89
92 uint8_t E() const {
93 return e_;
94 }
95
98 uint16_t epilog_count() const {
99 return E() == 1 ? 0 : epilog_count_;
100 }
101
104 uint16_t epilog_offset() const {
105 return E() == 1 ? epilog_offset_ : uint16_t(-1);
106 }
107
109 uint32_t code_words() const {
110 return code_words_;
111 }
112
114 uint32_t exception_handler() const {
115 return exception_handler_;
116 }
117
120 return unwind_code_;
121 }
122
124 return unwind_code_;
125 }
126
128 bool is_extended() const {
129 return is_extended_;
130 }
131
132 uint64_t epilog_scopes_offset() const {
133 return epilog_scopes_offset_;
134 }
135
136 uint64_t unwind_code_offset() const {
137 return unwind_code_offset_;
138 }
139
140 uint64_t exception_handler_offset() const {
141 return exception_handler_offset_;
142 }
143
146 return epilog_scopes_;
147 }
148
150 return epilog_scopes_;
151 }
152
153 UnpackedFunction& xdata_rva(uint32_t value) {
154 xdata_rva_ = value;
155 return *this;
156 }
157
158 UnpackedFunction& version(uint32_t value) {
159 version_ = value;
160 return *this;
161 }
162
163 UnpackedFunction& X(uint8_t value) {
164 x_ = value;
165 return *this;
166 }
167
168 UnpackedFunction& E(uint8_t value) {
169 e_ = value;
170 return *this;
171 }
172
174 epilog_offset_ = value;
175 return *this;
176 }
177
178 UnpackedFunction& code_words(uint32_t value) {
179 code_words_ = value;
180 return *this;
181 }
182
184 exception_handler_ = value;
185 return *this;
186 }
187
189 epilog_scopes_ = std::move(scopes);
190 return *this;
191 }
192
193 UnpackedFunction& unwind_code(std::vector<uint8_t> code) {
194 unwind_code_ = std::move(code);
195 return *this;
196 }
197
199 is_extended_ = value;
200 return *this;
201 }
202
203 static bool classof(const ExceptionInfo* info) {
205 return false;
206 }
207 const auto* aarch64 = static_cast<const RuntimeFunctionAArch64*>(info);
208 return aarch64->flag() == PACKED_FLAGS::UNPACKED;
209 }
210
211 private:
212 uint32_t xdata_rva_ = 0;
213 uint32_t version_ = 0;
214 uint8_t x_ = 0;
215 uint8_t e_ = 0;
216 union {
218 uint32_t epilog_offset_ = 0;
219 };
220 uint32_t code_words_ = 0;
221 uint32_t exception_handler_ = 0;
222
223 epilog_scopes_t epilog_scopes_;
224 std::vector<uint8_t> unwind_code_;
225 bool is_extended_ = false;
226
227 uint64_t epilog_scopes_offset_ = 0;
228 uint64_t unwind_code_offset_ = 0;
229 uint64_t exception_handler_offset_ = 0;
230};
231}
232}
233}
234#endif
Class that is used to a read stream of data from different sources.
Definition BinaryStream.hpp:33
Main interface to parse PE binaries. In particular, the static Parser::parse functions should be used...
Definition PE/Parser.hpp:52
static bool classof(const ExceptionInfo *info)
Definition RuntimeFunctionAArch64.hpp:86
uint32_t length() const
Length of the function in bytes.
Definition RuntimeFunctionAArch64.hpp:69
PACKED_FLAGS
Definition RuntimeFunctionAArch64.hpp:41
@ UNPACKED
Definition RuntimeFunctionAArch64.hpp:42
RuntimeFunctionAArch64(uint64_t RVA, uint32_t length, PACKED_FLAGS flag)
Definition RuntimeFunctionAArch64.hpp:51
uint8_t X() const
1-bit field that indicates the presence (1) or absence (0) of exception data.
Definition UnpackedFunction.hpp:86
static std::unique_ptr< UnpackedFunction > parse(Parser &ctx, BinaryStream &strm, uint32_t xdata_rva, uint32_t rva)
UnpackedFunction(uint32_t rva, uint32_t length)
Definition UnpackedFunction.hpp:54
UnpackedFunction & code_words(uint32_t value)
Definition UnpackedFunction.hpp:178
it_epilog_scopes epilog_scopes()
Iterator over the epilog scopes.
Definition UnpackedFunction.hpp:145
span< uint8_t > unwind_code()
Definition UnpackedFunction.hpp:123
uint16_t epilog_offset() const
If E() == 1, index of the first unwind code that describes the one and only epilog.
Definition UnpackedFunction.hpp:104
const_ref_iterator< const epilog_scopes_t & > it_const_epilog_scopes
Definition UnpackedFunction.hpp:49
bool is_extended() const
Whether it uses 2-words encoding.
Definition UnpackedFunction.hpp:128
uint8_t E() const
1-bit field that indicates that information describing a single epilog is packed into the header (1) ...
Definition UnpackedFunction.hpp:92
UnpackedFunction & version(uint32_t value)
Definition UnpackedFunction.hpp:158
uint64_t epilog_scopes_offset() const
Definition UnpackedFunction.hpp:132
UnpackedFunction & epilog_cnt_offset(uint16_t value)
Definition UnpackedFunction.hpp:173
UnpackedFunction & E(uint8_t value)
Definition UnpackedFunction.hpp:168
UnpackedFunction & epilog_scopes(epilog_scopes_t scopes)
Definition UnpackedFunction.hpp:188
uint32_t exception_handler() const
Exception handler RVA (if any).
Definition UnpackedFunction.hpp:114
UnpackedFunction & is_extended(bool value)
Definition UnpackedFunction.hpp:198
uint32_t code_words() const
Number of 32-bit words needed to contain all of the unwind codes.
Definition UnpackedFunction.hpp:109
UnpackedFunction & X(uint8_t value)
Definition UnpackedFunction.hpp:163
uint32_t xdata_rva() const
RVA where this unpacked data is located (usually pointing in .xdata).
Definition UnpackedFunction.hpp:72
uint64_t exception_handler_offset() const
Definition UnpackedFunction.hpp:140
UnpackedFunction & exception_handler(uint32_t value)
Definition UnpackedFunction.hpp:183
UnpackedFunction & xdata_rva(uint32_t value)
Definition UnpackedFunction.hpp:153
UnpackedFunction & operator=(UnpackedFunction &&)=default
std::vector< epilog_scope_t > epilog_scopes_t
Definition UnpackedFunction.hpp:47
uint64_t unwind_code_offset() const
Definition UnpackedFunction.hpp:136
UnpackedFunction & operator=(const UnpackedFunction &)=default
span< const uint8_t > unwind_code() const
Bytes that contain the unwind codes.
Definition UnpackedFunction.hpp:119
uint32_t epilog_count_
Definition UnpackedFunction.hpp:217
uint32_t epilog_offset_
Definition UnpackedFunction.hpp:218
it_const_epilog_scopes epilog_scopes() const
Definition UnpackedFunction.hpp:149
UnpackedFunction(UnpackedFunction &&)=default
uint32_t version() const
Describes the version of the remaining .xdata.
Definition UnpackedFunction.hpp:80
std::unique_ptr< ExceptionInfo > clone() const override
Definition UnpackedFunction.hpp:65
UnpackedFunction(const UnpackedFunction &)=default
std::string to_string() const override
UnpackedFunction & unwind_code(std::vector< uint8_t > code)
Definition UnpackedFunction.hpp:193
static bool classof(const ExceptionInfo *info)
Definition UnpackedFunction.hpp:203
ref_iterator< epilog_scopes_t & > it_epilog_scopes
Definition UnpackedFunction.hpp:48
uint16_t epilog_count() const
If E() == 0, specifies the count of the total number of epilog scopes. Otherwise, return 0
Definition UnpackedFunction.hpp:98
Iterator which returns reference on container's values.
Definition iterators.hpp:45
This namespace wraps code related to PE-ARM64 unwinding code.
Definition PackedFunction.hpp:26
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
LIEF namespace.
Definition Abstract/Binary.hpp:40
tcb::span< ElementType, Extent > span
Definition span.hpp:22
ref_iterator< CT, U, typename decay_t< CT >::const_iterator > const_ref_iterator
Iterator which return const ref on container's values.
Definition iterators.hpp:286
This structure describes an epilog scope.
Definition UnpackedFunction.hpp:35
uint8_t reserved
Reserved for future expansion. Should be 0.
Definition UnpackedFunction.hpp:44
uint16_t start_index
Byte index of the first unwind code that describes this epilog.
Definition UnpackedFunction.hpp:41
uint32_t start_offset
Offset of the epilog relatives to the start of the function.
Definition UnpackedFunction.hpp:38
#define LIEF_API
Definition visibility.h:43