LIEF: Library to Instrument Executable Formats Version 0.17.0
Loading...
Searching...
No Matches
UnpackedFunction.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2025 R. Thomas
2 * Copyright 2017 - 2025 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_RUNTIME_FUNCTION_AARCH64_UNPACKED_H
17#define LIEF_PE_RUNTIME_FUNCTION_AARCH64_UNPACKED_H
18
19#include "LIEF/span.hpp"
20#include "LIEF/visibility.h"
21#include "LIEF/iterators.hpp"
23
24namespace LIEF {
25namespace PE {
26namespace unwind_aarch64 {
27
32 public:
33
36 static epilog_scope_t from_raw(uint32_t raw);
38 uint32_t start_offset = 0;
39
41 uint16_t start_index = 0;
42
44 uint8_t reserved = 0;
45 };
46
47 using epilog_scopes_t = std::vector<epilog_scope_t>;
50
51 static std::unique_ptr<UnpackedFunction>
52 parse(Parser& ctx, BinaryStream& strm, uint32_t xdata_rva, uint32_t rva);
53
54 UnpackedFunction(uint32_t rva, uint32_t length) :
56 {}
57
60
63
64 ~UnpackedFunction() override = default;
65
66 std::unique_ptr<ExceptionInfo> clone() const override {
67 return std::unique_ptr<UnpackedFunction>(new UnpackedFunction(*this));
68 }
69
70 std::string to_string() const override;
71
73 uint32_t xdata_rva() const {
74 return xdata_rva_;
75 }
76
81 uint32_t version() const {
82 return version_;
83 }
84
87 uint8_t X() const {
88 return x_;
89 }
90
93 uint8_t E() const {
94 return e_;
95 }
96
99 uint16_t epilog_count() const {
100 return E() == 1 ? 0 : epilog_count_;
101 }
102
105 uint16_t epilog_offset() const {
106 return E() == 1 ? epilog_offset_ : uint16_t(-1);
107 }
108
110 uint32_t code_words() const {
111 return code_words_;
112 }
113
115 uint32_t exception_handler() const {
116 return exception_handler_;
117 }
118
121 return unwind_code_;
122 }
123
125 return unwind_code_;
126 }
127
130 return epilog_scopes_;
131 }
132
134 return epilog_scopes_;
135 }
136
137 UnpackedFunction& xdata_rva(uint32_t value) {
138 xdata_rva_ = value;
139 return *this;
140 }
141
142 UnpackedFunction& version(uint32_t value) {
143 version_ = value;
144 return *this;
145 }
146
147 UnpackedFunction& X(uint8_t value) {
148 x_ = value;
149 return *this;
150 }
151
152 UnpackedFunction& E(uint8_t value) {
153 e_ = value;
154 return *this;
155 }
156
158 epilog_offset_ = value;
159 return *this;
160 }
161
162 UnpackedFunction& code_words(uint32_t value) {
163 code_words_ = value;
164 return *this;
165 }
166
168 exception_handler_ = value;
169 return *this;
170 }
171
173 epilog_scopes_ = std::move(scopes);
174 return *this;
175 }
176
177 UnpackedFunction& unwind_code(std::vector<uint8_t> code) {
178 unwind_code_ = std::move(code);
179 return *this;
180 }
181
182 static bool classof(const ExceptionInfo* info) {
184 return false;
185 }
186 const auto* aarch64 = static_cast<const RuntimeFunctionAArch64*>(info);
187 return aarch64->flag() == PACKED_FLAGS::UNPACKED;
188 }
189
190 private:
191 uint32_t xdata_rva_ = 0;
192 uint32_t version_ = 0;
193 uint8_t x_ = 0;
194 uint8_t e_ = 0;
195 union {
197 uint32_t epilog_offset_ = 0;
198 };
199 uint32_t code_words_ = 0;
200 uint32_t exception_handler_ = 0;
201
202 epilog_scopes_t epilog_scopes_;
203 std::vector<uint8_t> unwind_code_;
204};
205}
206}
207}
208#endif
Class that is used to a read stream of data from different sources.
Definition BinaryStream.hpp:33
Main interface to parse PE binaries. In particular the static functions: Parser::parse should be used...
Definition PE/Parser.hpp:52
static bool classof(const ExceptionInfo *info)
Definition RuntimeFunctionAArch64.hpp:83
uint32_t length() const
Length of the function in bytes.
Definition RuntimeFunctionAArch64.hpp:67
PACKED_FLAGS
Definition RuntimeFunctionAArch64.hpp:40
@ UNPACKED
Definition RuntimeFunctionAArch64.hpp:41
RuntimeFunctionAArch64(uint64_t RVA, uint32_t length, PACKED_FLAGS flag)
Definition RuntimeFunctionAArch64.hpp:50
uint8_t X() const
1-bit field that indicates the presence (1) or absence (0) of exception data.
Definition UnpackedFunction.hpp:87
static std::unique_ptr< UnpackedFunction > parse(Parser &ctx, BinaryStream &strm, uint32_t xdata_rva, uint32_t rva)
UnpackedFunction(uint32_t rva, uint32_t length)
Definition UnpackedFunction.hpp:54
UnpackedFunction & code_words(uint32_t value)
Definition UnpackedFunction.hpp:162
it_epilog_scopes epilog_scopes()
Iterator over the epilog scopes.
Definition UnpackedFunction.hpp:129
span< uint8_t > unwind_code()
Definition UnpackedFunction.hpp:124
uint16_t epilog_offset() const
If E() == 1, index of the first unwind code that describes the one and only epilog.
Definition UnpackedFunction.hpp:105
const_ref_iterator< const epilog_scopes_t & > it_const_epilog_scopes
Definition UnpackedFunction.hpp:49
uint8_t E() const
1-bit field that indicates that information describing a single epilog is packed into the header (1) ...
Definition UnpackedFunction.hpp:93
UnpackedFunction & version(uint32_t value)
Definition UnpackedFunction.hpp:142
UnpackedFunction & epilog_cnt_offset(uint16_t value)
Definition UnpackedFunction.hpp:157
UnpackedFunction & E(uint8_t value)
Definition UnpackedFunction.hpp:152
UnpackedFunction & epilog_scopes(epilog_scopes_t scopes)
Definition UnpackedFunction.hpp:172
uint32_t exception_handler() const
Exception handler RVA (if any).
Definition UnpackedFunction.hpp:115
uint32_t code_words() const
Number of 32-bit words needed to contain all of the unwind codes.
Definition UnpackedFunction.hpp:110
UnpackedFunction & X(uint8_t value)
Definition UnpackedFunction.hpp:147
uint32_t xdata_rva() const
RVA where this unpacked data is located (usually pointing in .xdata).
Definition UnpackedFunction.hpp:73
UnpackedFunction & exception_handler(uint32_t value)
Definition UnpackedFunction.hpp:167
UnpackedFunction & xdata_rva(uint32_t value)
Definition UnpackedFunction.hpp:137
UnpackedFunction & operator=(UnpackedFunction &&)=default
std::vector< epilog_scope_t > epilog_scopes_t
Definition UnpackedFunction.hpp:47
UnpackedFunction & operator=(const UnpackedFunction &)=default
span< const uint8_t > unwind_code() const
Bytes that contain the unwind codes.
Definition UnpackedFunction.hpp:120
uint32_t epilog_count_
Definition UnpackedFunction.hpp:196
uint32_t epilog_offset_
Definition UnpackedFunction.hpp:197
it_const_epilog_scopes epilog_scopes() const
Definition UnpackedFunction.hpp:133
UnpackedFunction(UnpackedFunction &&)=default
uint32_t version() const
Describes the version of the remaining .xdata.
Definition UnpackedFunction.hpp:81
std::unique_ptr< ExceptionInfo > clone() const override
Definition UnpackedFunction.hpp:66
UnpackedFunction(const UnpackedFunction &)=default
std::string to_string() const override
UnpackedFunction & unwind_code(std::vector< uint8_t > code)
Definition UnpackedFunction.hpp:177
static bool classof(const ExceptionInfo *info)
Definition UnpackedFunction.hpp:182
ref_iterator< epilog_scopes_t & > it_epilog_scopes
Definition UnpackedFunction.hpp:48
uint16_t epilog_count() const
If E() == 0, specifies the count of the total number of epilog scopes. Otherwise, return 0
Definition UnpackedFunction.hpp:99
Iterator which returns reference on container's values.
Definition iterators.hpp:46
This namespace wraps code related to PE-ARM64 unwinding code.
Definition PackedFunction.hpp:26
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
LIEF namespace.
Definition Abstract/Binary.hpp:40
tcb::span< ElementType, Extent > span
Definition span.hpp:22
ref_iterator< CT, U, typename decay_t< CT >::const_iterator > const_ref_iterator
Iterator which return const ref on container's values.
Definition iterators.hpp:257
This strucure describes an epilog scope.
Definition UnpackedFunction.hpp:35
uint8_t reserved
Reserved for future expansion. Should be 0.
Definition UnpackedFunction.hpp:44
uint16_t start_index
Byte index of the first unwind code that describes this epilog.
Definition UnpackedFunction.hpp:41
uint32_t start_offset
Offset of the epilog relatives to the start of the function.
Definition UnpackedFunction.hpp:38
#define LIEF_API
Definition visibility.h:41