LIEF: Library to Instrument Executable Formats Version 1.0.0
Loading...
Searching...
No Matches
UnwindCodeX64.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2026 R. Thomas
2 * Copyright 2017 - 2026 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_UNWIND_CODE_X64_H
17#define LIEF_PE_UNWIND_CODE_X64_H
18#include <ostream>
19#include <memory>
20#include <string>
22
23namespace LIEF {
24class SpanStream;
25
26namespace PE {
28namespace unwind_x64 {
29
32 public:
35
37 static std::unique_ptr<Code>
38 create_from(const RuntimeFunctionX64::unwind_info_t& info,
39 SpanStream& stream);
40
41 Code() = delete;
42 Code(const Code&) = default;
43 Code& operator=(const Code&) = default;
44
45 Code(Code&&) = default;
46 Code& operator=(Code&&) = default;
47
48 virtual ~Code() = default;
49
50 Code(OPCODE opcode, uint32_t pos) :
51 pos_(pos),
52 opcode_(opcode) {}
53
56
58 OPCODE opcode() const {
59 return opcode_;
60 }
61
63 uint32_t position() const {
64 return pos_;
65 }
66
68 virtual std::string to_string() const;
69
70 LIEF_API friend std::ostream& operator<<(std::ostream& os, const Code& code) {
71 os << code.to_string();
72 return os;
73 }
74
75 protected:
76 uint32_t pos_ = 0;
77 OPCODE opcode_;
78};
79
82class LIEF_API Alloc : public Code {
83 public:
84 Alloc(OPCODE op, size_t pos, uint32_t size) :
85 Code(op, pos),
86 size_(size) {}
87
89 uint32_t size() const {
90 return size_;
91 }
92
93 std::string to_string() const override;
94
95 ~Alloc() override = default;
96
97 static bool classof(const Code* code) {
98 return code->opcode() == OPCODE::ALLOC_LARGE ||
99 code->opcode() == OPCODE::ALLOC_SMALL;
100 }
101
102 protected:
103 uint32_t size_ = 0;
104};
105
107class LIEF_API PushNonVol : public Code {
108 public:
109 PushNonVol() = delete;
110 PushNonVol(REG reg, size_t pos) :
111 Code(OPCODE::PUSH_NONVOL, pos),
112 reg_(reg) {}
113
114 std::string to_string() const override;
115
117 REG reg() const {
118 return reg_;
119 }
120
121 ~PushNonVol() override = default;
122
123 static bool classof(const Code* code) {
124 return code->opcode() == OPCODE::PUSH_NONVOL;
125 }
126
127 protected:
128 REG reg_;
129};
130
133 public:
134 PushMachFrame() = delete;
135 PushMachFrame(uint8_t value, size_t pos) :
136 Code(OPCODE::PUSH_MACHFRAME, pos),
137 value_(value) {}
138
140 uint8_t value() const {
141 return value_;
142 }
143
144 std::string to_string() const override;
145
146 ~PushMachFrame() override = default;
147
148 static bool classof(const Code* code) {
149 return code->opcode() == OPCODE::PUSH_MACHFRAME;
150 }
151
152 protected:
153 uint8_t value_;
154};
155
158class LIEF_API SetFPReg : public Code {
159 public:
160 SetFPReg() = delete;
161 SetFPReg(REG value, size_t pos) :
162 Code(OPCODE::SET_FPREG, pos),
163 reg_(value) {}
164
166 REG reg() const {
167 return reg_;
168 }
169
170 std::string to_string() const override;
171
172 ~SetFPReg() override = default;
173
174 static bool classof(const Code* code) {
175 return code->opcode() == OPCODE::SET_FPREG;
176 }
177
178 protected:
179 REG reg_;
180};
181
185 public:
186 SaveNonVolatile() = delete;
187 SaveNonVolatile(OPCODE op, REG value, size_t pos, uint32_t offset) :
188 Code(op, pos),
189 reg_(value),
190 offset_(offset) {}
191
192 REG reg() const {
193 return reg_;
194 }
195
196 uint32_t offset() const {
197 return offset_;
198 }
199
200 std::string to_string() const override;
201
202 ~SaveNonVolatile() override = default;
203
204 static bool classof(const Code* code) {
205 return code->opcode() == OPCODE::SAVE_NONVOL ||
206 code->opcode() == OPCODE::SAVE_NONVOL_FAR;
207 }
208
209 protected:
210 REG reg_;
211 uint32_t offset_ = 0;
212};
213
214class LIEF_API SaveXMM128 : public Code {
215 public:
216 SaveXMM128() = delete;
217 SaveXMM128(OPCODE op, uint8_t num, size_t pos, uint32_t offset) :
218 Code(op, pos),
219 num_(num),
220 offset_(offset) {}
221
222 uint8_t num() const {
223 return num_;
224 }
225
226 uint32_t offset() const {
227 return offset_;
228 }
229
230 std::string to_string() const override;
231
232 ~SaveXMM128() override = default;
233
234 static bool classof(const Code* code) {
235 return code->opcode() == OPCODE::SAVE_XMM128 ||
236 code->opcode() == OPCODE::SAVE_XMM128_FAR;
237 }
238
239 protected:
240 uint8_t num_ = 0;
241 uint32_t offset_ = 0;
242};
243
245class LIEF_API Epilog : public Code {
246 public:
247 Epilog() = delete;
248
249 Epilog(uint8_t flags, uint8_t size) :
250 Code(OPCODE::EPILOG, 0),
251 flags_(flags),
252 size_(size) {}
253
254 uint8_t flags() const {
255 return flags_;
256 }
257
259 uint32_t size() const {
260 return size_;
261 }
262
263 std::string to_string() const override;
264
265 ~Epilog() override = default;
266
267 static bool classof(const Code* code) {
268 return code->opcode() == OPCODE::EPILOG;
269 }
270
271 protected:
272 uint8_t flags_ = 0;
273 uint8_t size_ = 0;
274};
275
276class LIEF_API Spare : public Code {
277 public:
279 Code(OPCODE::SPARE, 0) {}
280
281 std::string to_string() const override {
282 return "Noop";
283 }
284
285 ~Spare() override = default;
286
287 static bool classof(const Code* code) {
288 return code->opcode() == OPCODE::SPARE;
289 }
290};
291
292}
293
294}
295}
296#endif
UNWIND_REG
Definition RuntimeFunctionX64.hpp:133
UNWIND_OPCODES
Definition RuntimeFunctionX64.hpp:64
std::string to_string() const override
Pretty representation.
static bool classof(const Code *code)
Definition UnwindCodeX64.hpp:97
Alloc(OPCODE op, size_t pos, uint32_t size)
Definition UnwindCodeX64.hpp:84
~Alloc() override=default
uint32_t size() const
The size allocated.
Definition UnwindCodeX64.hpp:89
virtual ~Code()=default
OPCODE opcode() const
The original opcode.
Definition UnwindCodeX64.hpp:58
Code & operator=(const Code &)=default
Code & operator=(Code &&)=default
RuntimeFunctionX64::UNWIND_REG REG
Definition UnwindCodeX64.hpp:34
friend std::ostream & operator<<(std::ostream &os, const Code &code)
Definition UnwindCodeX64.hpp:70
Code(OPCODE opcode, uint32_t pos)
Definition UnwindCodeX64.hpp:50
uint32_t position() const
Offset in the prolog.
Definition UnwindCodeX64.hpp:63
RuntimeFunctionX64::UNWIND_OPCODES OPCODE
Definition UnwindCodeX64.hpp:33
Code(OPCODE opcode)
Definition UnwindCodeX64.hpp:54
Code(const Code &)=default
virtual std::string to_string() const
Pretty representation.
uint32_t size() const
Size of the epilog.
Definition UnwindCodeX64.hpp:259
std::string to_string() const override
Pretty representation.
Epilog(uint8_t flags, uint8_t size)
Definition UnwindCodeX64.hpp:249
static bool classof(const Code *code)
Definition UnwindCodeX64.hpp:267
uint8_t flags() const
Definition UnwindCodeX64.hpp:254
~Epilog() override=default
std::string to_string() const override
Pretty representation.
static bool classof(const Code *code)
Definition UnwindCodeX64.hpp:148
uint8_t value() const
0 or 1
Definition UnwindCodeX64.hpp:140
PushMachFrame(uint8_t value, size_t pos)
Definition UnwindCodeX64.hpp:135
static bool classof(const Code *code)
Definition UnwindCodeX64.hpp:123
std::string to_string() const override
Pretty representation.
PushNonVol(REG reg, size_t pos)
Definition UnwindCodeX64.hpp:110
~PushNonVol() override=default
REG reg() const
The register pushed.
Definition UnwindCodeX64.hpp:117
REG reg() const
Definition UnwindCodeX64.hpp:192
uint32_t offset() const
Definition UnwindCodeX64.hpp:196
SaveNonVolatile(OPCODE op, REG value, size_t pos, uint32_t offset)
Definition UnwindCodeX64.hpp:187
static bool classof(const Code *code)
Definition UnwindCodeX64.hpp:204
std::string to_string() const override
Pretty representation.
SaveXMM128(OPCODE op, uint8_t num, size_t pos, uint32_t offset)
Definition UnwindCodeX64.hpp:217
static bool classof(const Code *code)
Definition UnwindCodeX64.hpp:234
uint32_t offset() const
Definition UnwindCodeX64.hpp:226
uint8_t num() const
Definition UnwindCodeX64.hpp:222
~SaveXMM128() override=default
std::string to_string() const override
Pretty representation.
static bool classof(const Code *code)
Definition UnwindCodeX64.hpp:174
REG reg() const
Frame pointer register.
Definition UnwindCodeX64.hpp:166
SetFPReg(REG value, size_t pos)
Definition UnwindCodeX64.hpp:161
~SetFPReg() override=default
std::string to_string() const override
Pretty representation.
static bool classof(const Code *code)
Definition UnwindCodeX64.hpp:287
Spare()
Definition UnwindCodeX64.hpp:278
~Spare() override=default
std::string to_string() const override
Pretty representation.
Definition UnwindCodeX64.hpp:281
Definition SpanStream.hpp:32
This namespace wraps code related to PE-x64 unwinding code.
Definition RuntimeFunctionX64.hpp:34
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
LIEF namespace.
Definition Abstract/Binary.hpp:40
This structure represents the UNWIND_INFO which records the effects a function has on the stack point...
Definition RuntimeFunctionX64.hpp:155
#define LIEF_API
Definition visibility.h:43