LIEF: Library to Instrument Executable Formats Version 2.0.0
Loading...
Searching...
No Matches
UnpackedFunction.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2026 R. Thomas
2 * Copyright 2017 - 2026 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_RUNTIME_FUNCTION_AARCH64_UNPACKED_H
17#define LIEF_PE_RUNTIME_FUNCTION_AARCH64_UNPACKED_H
18
19#include <memory>
20
22#include "LIEF/iterators.hpp"
23#include "LIEF/span.hpp"
24#include "LIEF/visibility.h"
25
26
28
34 public:
37 static epilog_scope_t from_raw(uint32_t raw);
39 uint32_t start_offset = 0;
40
42 uint16_t start_index = 0;
43
45 uint8_t reserved = 0;
46 };
47
48 using epilog_scopes_t = std::vector<epilog_scope_t>;
51
52 static std::unique_ptr<UnpackedFunction> parse(Parser& ctx, BinaryStream& strm,
53 uint64_t size, uint64_t nb_scopes,
54 uint32_t xdata_rva, uint32_t rva);
55
56 UnpackedFunction(uint32_t rva, uint32_t length) :
58
61
64
65 ~UnpackedFunction() override = default;
66
67 std::unique_ptr<ExceptionInfo> clone() const override {
68 return std::make_unique<UnpackedFunction>(*this);
69 }
70
71 std::string to_string() const override;
72
74 uint32_t xdata_rva() const {
75 return xdata_rva_;
76 }
77
82 uint32_t version() const {
83 return version_;
84 }
85
88 uint8_t X() const {
89 return x_;
90 }
91
94 uint8_t E() const {
95 return e_;
96 }
97
100 uint16_t epilog_count() const {
101 return E() == 1 ? 0 : epilog_count_;
102 }
103
106 uint16_t epilog_offset() const {
107 return E() == 1 ? epilog_offset_ : uint16_t(-1);
108 }
109
111 uint32_t code_words() const {
112 return code_words_;
113 }
114
116 uint32_t exception_handler() const {
117 return exception_handler_;
118 }
119
122 return unwind_code_;
123 }
124
126 return unwind_code_;
127 }
128
130 bool is_extended() const {
131 return is_extended_;
132 }
133
134 uint64_t epilog_scopes_offset() const {
135 return epilog_scopes_offset_;
136 }
137
138 uint64_t unwind_code_offset() const {
139 return unwind_code_offset_;
140 }
141
142 uint64_t exception_handler_offset() const {
143 return exception_handler_offset_;
144 }
145
148 return epilog_scopes_;
149 }
150
152 return epilog_scopes_;
153 }
154
155 UnpackedFunction& xdata_rva(uint32_t value) {
156 xdata_rva_ = value;
157 return *this;
158 }
159
160 UnpackedFunction& version(uint32_t value) {
161 version_ = value;
162 return *this;
163 }
164
165 UnpackedFunction& X(uint8_t value) {
166 x_ = value;
167 return *this;
168 }
169
170 UnpackedFunction& E(uint8_t value) {
171 e_ = value;
172 return *this;
173 }
174
176 epilog_offset_ = value;
177 return *this;
178 }
179
180 UnpackedFunction& code_words(uint32_t value) {
181 code_words_ = value;
182 return *this;
183 }
184
186 exception_handler_ = value;
187 return *this;
188 }
189
191 epilog_scopes_ = std::move(scopes);
192 return *this;
193 }
194
195 UnpackedFunction& unwind_code(std::vector<uint8_t> code) LIEF_LIFETIMEBOUND {
196 unwind_code_ = std::move(code);
197 return *this;
198 }
199
201 is_extended_ = value;
202 return *this;
203 }
204
205 static bool classof(const ExceptionInfo* info) {
207 return false;
208 }
209 const auto* aarch64 = static_cast<const RuntimeFunctionAArch64*>(info);
210 return aarch64->flag() == PACKED_FLAGS::UNPACKED;
211 }
212
213 private:
214 uint32_t xdata_rva_ = 0;
215 uint32_t version_ = 0;
216 uint8_t x_ = 0;
217 uint8_t e_ = 0;
218 union {
219 uint32_t epilog_count_;
220 uint32_t epilog_offset_ = 0;
221 };
222 uint32_t code_words_ = 0;
223 uint32_t exception_handler_ = 0;
224
225 epilog_scopes_t epilog_scopes_;
226 std::vector<uint8_t> unwind_code_;
227 bool is_extended_ = false;
228
229 uint64_t epilog_scopes_offset_ = 0;
230 uint64_t unwind_code_offset_ = 0;
231 uint64_t exception_handler_offset_ = 0;
232};
233}
234
235
236#endif
Class that is used to a read stream of data from different sources.
Definition BinaryStream.hpp:35
Main interface to parse PE binaries. In particular, the static Parser::parse functions should be used...
Definition PE/Parser.hpp:54
static bool classof(const ExceptionInfo *info)
Definition RuntimeFunctionAArch64.hpp:84
uint32_t length() const
Length of the function in bytes.
Definition RuntimeFunctionAArch64.hpp:67
PACKED_FLAGS
Definition RuntimeFunctionAArch64.hpp:41
@ UNPACKED
Definition RuntimeFunctionAArch64.hpp:42
RuntimeFunctionAArch64(uint64_t RVA, uint32_t length, PACKED_FLAGS flag)
Definition RuntimeFunctionAArch64.hpp:51
uint8_t X() const
1-bit field that indicates the presence (1) or absence (0) of exception data.
Definition UnpackedFunction.hpp:88
UnpackedFunction(uint32_t rva, uint32_t length)
Definition UnpackedFunction.hpp:56
static std::unique_ptr< UnpackedFunction > parse(Parser &ctx, BinaryStream &strm, uint64_t size, uint64_t nb_scopes, uint32_t xdata_rva, uint32_t rva)
UnpackedFunction & code_words(uint32_t value)
Definition UnpackedFunction.hpp:180
it_epilog_scopes epilog_scopes()
Iterator over the epilog scopes.
Definition UnpackedFunction.hpp:147
span< uint8_t > unwind_code()
Definition UnpackedFunction.hpp:125
uint16_t epilog_offset() const
If E() == 1, index of the first unwind code that describes the one and only epilog.
Definition UnpackedFunction.hpp:106
const_ref_iterator< const epilog_scopes_t & > it_const_epilog_scopes
Definition UnpackedFunction.hpp:50
bool is_extended() const
Whether it uses 2-words encoding.
Definition UnpackedFunction.hpp:130
uint8_t E() const
1-bit field that indicates that information describing a single epilog is packed into the header (1) ...
Definition UnpackedFunction.hpp:94
UnpackedFunction & version(uint32_t value)
Definition UnpackedFunction.hpp:160
uint64_t epilog_scopes_offset() const
Definition UnpackedFunction.hpp:134
UnpackedFunction & epilog_cnt_offset(uint16_t value)
Definition UnpackedFunction.hpp:175
UnpackedFunction & E(uint8_t value)
Definition UnpackedFunction.hpp:170
UnpackedFunction & epilog_scopes(epilog_scopes_t scopes)
Definition UnpackedFunction.hpp:190
uint32_t exception_handler() const
Exception handler RVA (if any).
Definition UnpackedFunction.hpp:116
UnpackedFunction & is_extended(bool value)
Definition UnpackedFunction.hpp:200
uint32_t code_words() const
Number of 32-bit words needed to contain all the unwind codes.
Definition UnpackedFunction.hpp:111
UnpackedFunction & X(uint8_t value)
Definition UnpackedFunction.hpp:165
uint32_t xdata_rva() const
RVA where this unpacked data is located (usually pointing in .xdata).
Definition UnpackedFunction.hpp:74
uint64_t exception_handler_offset() const
Definition UnpackedFunction.hpp:142
UnpackedFunction & exception_handler(uint32_t value)
Definition UnpackedFunction.hpp:185
UnpackedFunction & xdata_rva(uint32_t value)
Definition UnpackedFunction.hpp:155
UnpackedFunction & operator=(UnpackedFunction &&)=default
std::vector< epilog_scope_t > epilog_scopes_t
Definition UnpackedFunction.hpp:48
uint64_t unwind_code_offset() const
Definition UnpackedFunction.hpp:138
UnpackedFunction & operator=(const UnpackedFunction &)=default
span< const uint8_t > unwind_code() const
Bytes that contain the unwind codes.
Definition UnpackedFunction.hpp:121
it_const_epilog_scopes epilog_scopes() const
Definition UnpackedFunction.hpp:151
UnpackedFunction(UnpackedFunction &&)=default
uint32_t version() const
Describes the version of the remaining .xdata.
Definition UnpackedFunction.hpp:82
std::unique_ptr< ExceptionInfo > clone() const override
Definition UnpackedFunction.hpp:67
UnpackedFunction(const UnpackedFunction &)=default
std::string to_string() const override
UnpackedFunction & unwind_code(std::vector< uint8_t > code)
Definition UnpackedFunction.hpp:195
static bool classof(const ExceptionInfo *info)
Definition UnpackedFunction.hpp:205
ref_iterator< epilog_scopes_t & > it_epilog_scopes
Definition UnpackedFunction.hpp:49
uint16_t epilog_count() const
If E() == 0, specifies the count of the total number of epilog scopes. Otherwise, return 0
Definition UnpackedFunction.hpp:100
Iterator which returns reference on container's values.
Definition iterators.hpp:47
#define LIEF_LIFETIMEBOUND
Definition compiler_attributes.hpp:72
This namespace wraps code related to PE-ARM64 unwinding code.
Definition PackedFunction.hpp:25
tcb::span< ElementType, Extent > span
Definition span.hpp:22
ref_iterator< CT, U, typename decay_t< CT >::const_iterator > const_ref_iterator
Iterator which returns a const ref on container's values.
Definition iterators.hpp:317
This structure describes an epilog scope.
Definition UnpackedFunction.hpp:36
uint8_t reserved
Reserved for future expansion. Should be 0.
Definition UnpackedFunction.hpp:45
uint16_t start_index
Byte index of the first unwind code that describes this epilog.
Definition UnpackedFunction.hpp:42
uint32_t start_offset
Offset of the epilog relatives to the start of the function.
Definition UnpackedFunction.hpp:39
#define LIEF_API
Definition visibility.h:45