Ghidra - Analyzers - Exceptions¶This analyzer improves the representation and underlying data of PE exceptions metadata, primarily for ARM64 and ARM64EC binaries. 140017000 00 ?? 00h140017001 10 ?? 10h140017002 00 ?? 00h140017003 00 ?? 00h140017004 40 ?? 40h @140017005 27 ?? 27h '140017006 01 ?? 01h140017007 00 ?? 00h140017008 20 ?? 20h140017009 10 ?? 10h14001700a 00 ?? 00h14001700b 00 ?? 00h14001700c 4c ?? 4Ch L14001700d 27 ?? 27h '14001700e 01 ?? 01h14001700f 00 ?? 00h140017010 60 ?? 60h `140017011 10 ?? 10h140017012 00 ?? 00h140017013 00 ?? 00h140017014 5c ?? 5Ch \140017015 27 ?? 27h '140017016 01 ?? 01h140017017 00 ?? 00h140017018 80 ?? 80h140017019 10 ?? 10h14001701a 00 ?? 00h14001701b 00 ?? 00h14001701c 6c ?? 6Ch l14001701d 27 ?? 27h '14001701e 01 ?? 01h14001701f 00 ?? 00h140017020 e0 ?? E0h 140017000 00 10 00 00 40 27 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017000 00 10 00 00 ibo32 __aarch64_function@140001000 BeginAddress XREF[2]: 14000029c(*), 140011238(*) 140017004 40 27 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012740 ExceptionInfoRVA140017008 20 10 00 00 4c 27 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017008 20 10 00 00 ibo32 __aarch64_function@140001020 BeginAddress 14001700c 4c 27 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_14001274c ExceptionInfoRVA140017010 60 10 00 00 5c 27 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017010 60 10 00 00 ibo32 __aarch64_function@140001060 BeginAddress 140017014 5c 27 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_14001275c ExceptionInfoRVA140017018 80 10 00 00 6c 27 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017018 80 10 00 00 ibo32 __aarch64_function@140001080 BeginAddress 14001701c 6c 27 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_14001276c ExceptionInfoRVA140017020 e0 10 00 00 18 29 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017020 e0 10 00 00 ibo32 __aarch64_function@1400010e0 BeginAddress 140017024 18 29 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012918 ExceptionInfoRVA140017028 00 11 00 00 c0 2a 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017028 00 11 00 00 ibo32 __aarch64_function@140001100 BeginAddress 14001702c c0 2a 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012ac0 ExceptionInfoRVA140017030 18 11 00 00 cc 2a 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017030 18 11 00 00 ibo32 __aarch64_function@140001118 BeginAddress 140017034 cc 2a 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012acc ExceptionInfoRVA140017038 50 11 00 00 e4 2c 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017038 50 11 00 00 ibo32 __aarch64_function@140001150 BeginAddress 14001703c e4 2c 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012ce4 ExceptionInfoRVA140017040 80 11 00 00 ec 2c 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017040 80 11 00 00 ibo32 __aarch64_function@140001180 BeginAddress 140017044 ec 2c 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012cec ExceptionInfoRVA140017048 00 12 00 00 f4 2c 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017048 00 12 00 00 ibo32 __aarch64_function@140001200 BeginAddress 14001704c f4 2c 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012cf4 ExceptionInfoRVA140017050 80 12 00 00 fc 2c 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017050 80 12 00 00 ibo32 __aarch64_function@140001280 BeginAddress 140017054 fc 2c 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012cfc ExceptionInfoRVA 140012710 0b ?? 0Bh140012711 00 ?? 00h140012712 20 ?? 20h140012713 08 ?? 08h140012714 81 ?? 81h140012715 e4 ?? E4h140012716 e3 ?? E3h140012717 e3 ?? E3h140012718 14 ?? 14h140012719 00 ?? 00h14001271a 40 ?? 40h @14001271b 40 ?? 40h @14001271c 0a ?? 0Ah14001271d 00 ?? 00h14001271e c0 ?? C0h14001271f 02 ?? 02h140012720 e1 ?? E1h140012721 81 ?? 81h140012722 e6 ?? E6h140012723 e6 ?? E6h140012724 e6 ?? E6h140012725 e6 ?? E6h140012726 e7 ?? E7h140012727 66 ?? 66h f140012728 89 ?? 89h140012729 fc ?? FCh14001272a e4 ?? E4h14001272b 81 ?? 81h14001272c e7 ?? E7h14001272d 4e ?? 4Eh N14001272e 88 ?? 88h14001272f e7 ?? E7h140012730 4c ?? 4Ch L140012731 86 ?? 86h140012732 e7 ?? E7h140012733 4a ?? 4Ah J140012734 84 ?? 84h 140012710 0b 00 20 08 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA 140012710 0b 00 20 dword:18 Bh FunctionLength XREF[1]: 140017a14(*) 140012712 20 dword:2 0h Version 140012712 20 dword:1 0h ExceptionDataPresent 140012712 20 dword:1 1h EpilogInHeader 140012712 20 08 dword:5 0h EpilogCount 140012713 08 dword:5 1h CodeWords __arm64_unwind_code@140012714140012714 81 e4 e3 e3 db[4] 140012714 [0] 81h, E4h, E3h, E3h IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA XREF[1]: 140017a1c(*)140012718 14 00 40 40 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA 140012718 14 00 40 dword:18 14h FunctionLength XREF[1]: 140017a1c(*) 14001271a 40 dword:2 0h Version 14001271a 40 dword:1 0h ExceptionDataPresent 14001271a 40 dword:1 0h EpilogInHeader 14001271a 40 40 dword:5 1h EpilogCount 14001271b 40 dword:5 8h CodeWords __arm64_epilog_scopes@14001271c14001271c 0a 00 c0 02 EpilogScope[1] 14001271c 0a 00 c0 02 EpilogScope [0] 14001271c 0a 00 c0 dword:18 Ah StartOffset 14001271e c0 dword:4 0h Res 14001271e c0 02 dword:10 Bh ExceptionDataPresent __arm64_unwind_code@140012720140012720 e1 81 e6 e6 e6 e6 e7 66 89 fc e4 81 e7 db[32] 4e 88 e7 4c 86 e7 4a 84 e7 48 82 e7 66 89 fc e3 e3 e4 e3 140012720 [0] E1h, 81h, E6h, E6h, 140012724 [4] E6h, E6h, E7h, 66h, 140012728 [8] 89h, FCh, E4h, 81h, 14001272c [12] E7h, 4Eh, 88h, E7h, 140012730 [16] 4Ch, 86h, E7h, 4Ah, 140012734 [20] 84h, E7h, 48h, 82h, 140012738 [24] E7h, 66h, 89h, FCh, 14001273c [28] E3h, E3h, E4h, E3h IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA XREF[1]: 140017004(*)
