LIEF::PE::RuntimeFunctionX64::unwind_info_t Struct Reference

This structure represents the UNWIND_INFO which records the effects a function has on the stack pointer, and where the nonvolatile registers are saved on the stack. More...

#include <RuntimeFunctionX64.hpp>

Collaboration diagram for LIEF::PE::RuntimeFunctionX64::unwind_info_t:

Public Types
using	opcodes_t = std::vector<std::unique_ptr<unwind_x64::Code>>

Public Member Functions
bool	has (UNWIND_FLAGS flag) const
	Check if the given flag is used.
opcodes_t	opcodes () const
	Enhanced representation of the unwind code.
std::string	to_string () const
	Pretty representation of this structure as a string.

Public Attributes
uint8_t	version = 0
	Version number of the unwind data, currently 1 or 2.
uint8_t	flags = 0
	See: UNWIND_FLAGS.
uint8_t	sizeof_prologue = 0
	Length of the function prolog in bytes.
uint8_t	count_opcodes = 0
	The number of slots in the unwind codes array. Some unwind codes, for example, UNWIND_OPCODES::SAVE_NONVOL, require more than one slot in the array.
uint8_t	frame_reg = 0
	If nonzero, then the function uses a frame pointer (FP), and this field is the number of the nonvolatile register used as the frame pointer, using the same encoding for the operation info field of UNWIND_OPCODES nodes.
uint8_t	frame_reg_offset = 0
	If the frame register field is nonzero, this field is the scaled offset from RSP that is applied to the FP register when it's established.
std::vector< uint8_t >	raw_opcodes
	An array of items that explains the effect of the prolog on the nonvolatile registers and RSP.
optional< uint32_t >	handler
	An image-relative pointer to either the function's language-specific exception or termination handler. This value is set if one of these flags is set: UNWIND_FLAGS::EXCEPTION_HANDLER, UNWIND_FLAGS::TERMINATE_HANDLER.
RuntimeFunctionX64 *	chained = nullptr
	If UNWIND_FLAGS::CHAIN_INFO is set, this attributes references the chained runtime function.

Detailed Description

This structure represents the UNWIND_INFO which records the effects a function has on the stack pointer, and where the nonvolatile registers are saved on the stack.

Member Typedef Documentation

opcodes_t

using LIEF::PE::RuntimeFunctionX64::unwind_info_t::opcodes_t = std::vector<std::unique_ptr<unwind_x64::Code>>

Member Function Documentation

has()

bool LIEF::PE::RuntimeFunctionX64::unwind_info_t::has ( UNWIND_FLAGS flag ) const

inline

Check if the given flag is used.

opcodes()

opcodes_t LIEF::PE::RuntimeFunctionX64::unwind_info_t::opcodes

(

)

const

Enhanced representation of the unwind code.

to_string()

std::string LIEF::PE::RuntimeFunctionX64::unwind_info_t::to_string

(

)

const

Pretty representation of this structure as a string.

Member Data Documentation

chained

RuntimeFunctionX64* LIEF::PE::RuntimeFunctionX64::unwind_info_t::chained = nullptr

If UNWIND_FLAGS::CHAIN_INFO is set, this attributes references the chained runtime function.

count_opcodes

uint8_t LIEF::PE::RuntimeFunctionX64::unwind_info_t::count_opcodes = 0

The number of slots in the unwind codes array. Some unwind codes, for example, UNWIND_OPCODES::SAVE_NONVOL, require more than one slot in the array.

flags

uint8_t LIEF::PE::RuntimeFunctionX64::unwind_info_t::flags = 0

See: UNWIND_FLAGS.

frame_reg

uint8_t LIEF::PE::RuntimeFunctionX64::unwind_info_t::frame_reg = 0

If nonzero, then the function uses a frame pointer (FP), and this field is the number of the nonvolatile register used as the frame pointer, using the same encoding for the operation info field of UNWIND_OPCODES nodes.

frame_reg_offset

uint8_t LIEF::PE::RuntimeFunctionX64::unwind_info_t::frame_reg_offset = 0

If the frame register field is nonzero, this field is the scaled offset from RSP that is applied to the FP register when it's established.

handler

optional<uint32_t> LIEF::PE::RuntimeFunctionX64::unwind_info_t::handler

An image-relative pointer to either the function's language-specific exception or termination handler. This value is set if one of these flags is set: UNWIND_FLAGS::EXCEPTION_HANDLER, UNWIND_FLAGS::TERMINATE_HANDLER.

raw_opcodes

std::vector<uint8_t> LIEF::PE::RuntimeFunctionX64::unwind_info_t::raw_opcodes

An array of items that explains the effect of the prolog on the nonvolatile registers and RSP.

sizeof_prologue

uint8_t LIEF::PE::RuntimeFunctionX64::unwind_info_t::sizeof_prologue = 0

Length of the function prolog in bytes.

version

uint8_t LIEF::PE::RuntimeFunctionX64::unwind_info_t::version = 0

Version number of the unwind data, currently 1 or 2.

---

The documentation for this struct was generated from the following file:

• RuntimeFunctionX64.hpp