This analyzer improves the representation and underlying data of PE exceptions metadata, primarily for ARM64 and ARM64EC binaries.
.pdata section started { 0x140017000 - 0x140017d50 } 140017000 00 10 00 00 40 27 01 00 20 10 00 00 4c 27 01 00 . . . . @ ' . . . . . L ' . . 140017010 60 10 00 00 5c 27 01 00 80 10 00 00 6c 27 01 00 ` . . . \ ' . . . . . . l ' . . 140017020 e0 10 00 00 18 29 01 00 00 11 00 00 c0 2a 01 00 . . . . . ) . . . . . . . * . . 140017030 18 11 00 00 cc 2a 01 00 50 11 00 00 e4 2c 01 00 . . . . . * . . P . . . . , . . 140017040 80 11 00 00 ec 2c 01 00 00 12 00 00 f4 2c 01 00 . . . . . , . . . . . . . , . . 140017050 80 12 00 00 fc 2c 01 00 00 13 00 00 04 2d 01 00 . . . . . , . . . . . . . - . . 140017060 80 13 00 00 0c 2d 01 00 f0 13 00 00 14 2d 01 00 . . . . . - . . . . . . . - . . 140017070 60 14 00 00 1c 2d 01 00 d0 14 00 00 24 2d 01 00 ` . . . . - . . . . . . $ - . . 140017080 40 15 00 00 2c 2d 01 00 b0 15 00 00 34 2d 01 00 @ . . . , - . . . . . . 4 - . . 140017090 20 16 00 00 3c 2d 01 00 90 16 00 00 44 2d 01 00 . . . < - . . . . . . D - . . 1400170a0 00 17 00 00 4c 2d 01 00 50 17 00 00 54 2d 01 00 . . . . L - . . P . . . T - . . 1400170b0 a0 17 00 00 5c 2d 01 00 f0 17 00 00 64 2d 01 00 . . . . \ - . . . . . . d - . . 1400170c0 40 18 00 00 6c 2d 01 00 b0 18 00 00 74 2d 01 00 @ . . . l - . . . . . . t - . . 1400170d0 20 19 00 00 7c 2d 01 00 90 19 00 00 84 2d 01 00 . . . | - . . . . . . . - . . 1400170e0 00 1a 00 00 8c 2d 01 00 70 1a 00 00 94 2d 01 00 . . . . . - . . p . . . . - . . 1400170f0 e0 1a 00 00 9c 2d 01 00 50 1b 00 00 a4 2d 01 00 . . . . . - . . P . . . . - . . 140017100 c0 1b 00 00 ac 2d 01 00 30 1c 00 00 b4 2d 01 00 . . . . . - . . 0 . . . . - . . 140017110 a0 1c 00 00 bc 2d 01 00 10 1d 00 00 c4 2d 01 00 . . . . . - . . . . . . . - . . 140017120 80 1d 00 00 cc 2d 01 00 d0 1d 00 00 d4 2d 01 00 . . . . . - . . . . . . . - . . 140017130 20 1e 00 00 dc 2d 01 00 70 1e 00 00 e4 2d 01 00 . . . . - . . p . . . . - . .
.pdata section started { 0x140017000 - 0x140017d50 } 140017000 struct _LIEF_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY __arm64_runtime_function_entry = 140017000 { 140017000 uint32_t B e g i n A d d r e s s = 0x1000 140017004 uint32_t U n w i n d D a t a = 0x12740 140017008 } 140017008 struct _LIEF_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY __arm64_runtime_function_entry = 140017008 { 140017008 uint32_t B e g i n A d d r e s s = 0x1020 14001700c uint32_t U n w i n d D a t a = 0x1274c 140017010 } 140017010 struct _LIEF_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY __arm64_runtime_function_entry = 140017010 { 140017010 uint32_t B e g i n A d d r e s s = 0x1060 140017014 uint32_t U n w i n d D a t a = 0x1275c 140017018 } 140017018 struct _LIEF_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY __arm64_runtime_function_entry = 140017018 { 140017018 uint32_t B e g i n A d d r e s s = 0x1080 14001701c uint32_t U n w i n d D a t a = 0x1276c 140017020 } 140017020 struct _LIEF_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY __arm64_runtime_function_entry =
.rdata section started { 0x140010000 - 0x1400152d8 } 140012710 0b 00 20 08 81 e4 e3 e3 14 00 40 40 0a 00 c0 02 . . . . . . . . . @ @ . . . . 140012720 e1 81 e6 e6 e6 e6 e7 66 89 fc e4 81 e7 4e 88 e7 . . . . . . . f . . . . . N . . 140012730 4c 86 e7 4a 84 e7 48 82 e7 66 89 fc e3 e3 e4 e3 L . . J . . H . . f . . . . . . 140012740 06 00 40 08 05 00 80 00 01 e4 e4 00 0b 00 40 10 . . @ . . . . . . . . . . . @ .
.rdata section started { 0x140010000 - 0x1400152d8 } 140012710 struct L I E F _ I M A G E _ A R M 6 4 _ R U N T I M E _ F U N C T I O N _ E N T R Y _ X D A T A __arm64_runtime_function_entry_xdata = 140012710 { 140012710 uint32_t H e a d e r D a t a = 0x820000b 140012714 } 140012714 uint8_t __arm64_unwind_code[0x4] = 140012714 { 140012714 [ 0x0 ] = 0x81 140012715 [ 0x1 ] = 0xe4 140012716 [ 0x2 ] = 0xe3 140012717 [ 0x3 ] = 0xe3 140012718 } 140012718 struct L I E F _ I M A G E _ A R M 6 4 _ R U N T I M E _ F U N C T I O N _ E N T R Y _ X D A T A __arm64_runtime_function_entry_xdata = 140012718 { 140012718 uint32_t H e a d e r D a t a = 0x40400014 14001271c } 14001271c uint32_t __arm64_epilog_scopes[0x1] = 14001271c { 14001271c [ 0x0 ] = 0x02c0000a 140012720 } 140012720 uint8_t __arm64_unwind_code[0x20] = 140012720 { 140012720 [ 0x00 ] = 0xe1 140012721 [ 0x01 ] = 0x81 140012722 [ 0x02 ] = 0xe6 140012723 [ 0x03 ] = 0xe6 140012724 [ 0x04 ] = 0xe6 140012725 [ 0x05 ] = 0xe6 [ . . . . ] 140012740 }
Additionally, it defines functions automatically based on the metadata of exceptions. This results in a more accurate representation of the binary, as illustrated in this feature map: