LIEF: Library to Instrument Executable Formats Version 0.17.0
Loading...
Searching...
No Matches
UnpackedFunction.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2025 R. Thomas
2 * Copyright 2017 - 2025 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_RUNTIME_FUNCTION_AARCH64_UNPACKED_H
17#define LIEF_PE_RUNTIME_FUNCTION_AARCH64_UNPACKED_H
18
19#include "LIEF/span.hpp"
20#include "LIEF/visibility.h"
21#include "LIEF/iterators.hpp"
23
24namespace LIEF {
25namespace PE {
26namespace unwind_aarch64 {
27
32 public:
33
36 static epilog_scope_t from_raw(uint32_t raw);
38 uint32_t start_offset = 0;
39
41 uint16_t start_index = 0;
42
44 uint8_t reserved = 0;
45 };
46
47 using epilog_scopes_t = std::vector<epilog_scope_t>;
50
51 static std::unique_ptr<UnpackedFunction>
52 parse(Parser& ctx, BinaryStream& strm, uint32_t xdata_rva, uint32_t rva);
53
54 UnpackedFunction(uint32_t rva, uint32_t length) :
56 {}
57
60
63
64 ~UnpackedFunction() override = default;
65
66 std::unique_ptr<ExceptionInfo> clone() const override {
67 return std::unique_ptr<UnpackedFunction>(new UnpackedFunction(*this));
68 }
69
70 std::string to_string() const override;
71
73 uint32_t xdata_rva() const {
74 return xdata_rva_;
75 }
76
81 uint32_t version() const {
82 return version_;
83 }
84
87 uint8_t X() const {
88 return x_;
89 }
90
93 uint8_t E() const {
94 return e_;
95 }
96
99 uint16_t epilog_count() const {
100 return E() == 1 ? 0 : epilog_count_;
101 }
102
105 uint16_t epilog_offset() const {
106 return E() == 1 ? epilog_offset_ : uint16_t(-1);
107 }
108
110 uint32_t code_words() const {
111 return code_words_;
112 }
113
115 uint32_t exception_handler() const {
116 return exception_handler_;
117 }
118
121 return unwind_code_;
122 }
123
125 return unwind_code_;
126 }
127
129 bool is_extended() const {
130 return is_extended_;
131 }
132
133 uint64_t epilog_scopes_offset() const {
134 return epilog_scopes_offset_;
135 }
136
137 uint64_t unwind_code_offset() const {
138 return unwind_code_offset_;
139 }
140
141 uint64_t exception_handler_offset() const {
142 return exception_handler_offset_;
143 }
144
147 return epilog_scopes_;
148 }
149
151 return epilog_scopes_;
152 }
153
154 UnpackedFunction& xdata_rva(uint32_t value) {
155 xdata_rva_ = value;
156 return *this;
157 }
158
159 UnpackedFunction& version(uint32_t value) {
160 version_ = value;
161 return *this;
162 }
163
164 UnpackedFunction& X(uint8_t value) {
165 x_ = value;
166 return *this;
167 }
168
169 UnpackedFunction& E(uint8_t value) {
170 e_ = value;
171 return *this;
172 }
173
175 epilog_offset_ = value;
176 return *this;
177 }
178
179 UnpackedFunction& code_words(uint32_t value) {
180 code_words_ = value;
181 return *this;
182 }
183
185 exception_handler_ = value;
186 return *this;
187 }
188
190 epilog_scopes_ = std::move(scopes);
191 return *this;
192 }
193
194 UnpackedFunction& unwind_code(std::vector<uint8_t> code) {
195 unwind_code_ = std::move(code);
196 return *this;
197 }
198
200 is_extended_ = value;
201 return *this;
202 }
203
204 static bool classof(const ExceptionInfo* info) {
206 return false;
207 }
208 const auto* aarch64 = static_cast<const RuntimeFunctionAArch64*>(info);
209 return aarch64->flag() == PACKED_FLAGS::UNPACKED;
210 }
211
212 private:
213 uint32_t xdata_rva_ = 0;
214 uint32_t version_ = 0;
215 uint8_t x_ = 0;
216 uint8_t e_ = 0;
217 union {
219 uint32_t epilog_offset_ = 0;
220 };
221 uint32_t code_words_ = 0;
222 uint32_t exception_handler_ = 0;
223
224 epilog_scopes_t epilog_scopes_;
225 std::vector<uint8_t> unwind_code_;
226 bool is_extended_ = false;
227
228 uint64_t epilog_scopes_offset_ = 0;
229 uint64_t unwind_code_offset_ = 0;
230 uint64_t exception_handler_offset_ = 0;
231};
232}
233}
234}
235#endif
Class that is used to a read stream of data from different sources.
Definition BinaryStream.hpp:33
Main interface to parse PE binaries. In particular the static functions: Parser::parse should be used...
Definition PE/Parser.hpp:52
static bool classof(const ExceptionInfo *info)
Definition RuntimeFunctionAArch64.hpp:84
uint32_t length() const
Length of the function in bytes.
Definition RuntimeFunctionAArch64.hpp:67
PACKED_FLAGS
Definition RuntimeFunctionAArch64.hpp:40
@ UNPACKED
Definition RuntimeFunctionAArch64.hpp:41
RuntimeFunctionAArch64(uint64_t RVA, uint32_t length, PACKED_FLAGS flag)
Definition RuntimeFunctionAArch64.hpp:50
uint8_t X() const
1-bit field that indicates the presence (1) or absence (0) of exception data.
Definition UnpackedFunction.hpp:87
static std::unique_ptr< UnpackedFunction > parse(Parser &ctx, BinaryStream &strm, uint32_t xdata_rva, uint32_t rva)
UnpackedFunction(uint32_t rva, uint32_t length)
Definition UnpackedFunction.hpp:54
UnpackedFunction & code_words(uint32_t value)
Definition UnpackedFunction.hpp:179
it_epilog_scopes epilog_scopes()
Iterator over the epilog scopes.
Definition UnpackedFunction.hpp:146
span< uint8_t > unwind_code()
Definition UnpackedFunction.hpp:124
uint16_t epilog_offset() const
If E() == 1, index of the first unwind code that describes the one and only epilog.
Definition UnpackedFunction.hpp:105
const_ref_iterator< const epilog_scopes_t & > it_const_epilog_scopes
Definition UnpackedFunction.hpp:49
bool is_extended() const
Whether it uses 2-words encoding.
Definition UnpackedFunction.hpp:129
uint8_t E() const
1-bit field that indicates that information describing a single epilog is packed into the header (1) ...
Definition UnpackedFunction.hpp:93
UnpackedFunction & version(uint32_t value)
Definition UnpackedFunction.hpp:159
uint64_t epilog_scopes_offset() const
Definition UnpackedFunction.hpp:133
UnpackedFunction & epilog_cnt_offset(uint16_t value)
Definition UnpackedFunction.hpp:174
UnpackedFunction & E(uint8_t value)
Definition UnpackedFunction.hpp:169
UnpackedFunction & epilog_scopes(epilog_scopes_t scopes)
Definition UnpackedFunction.hpp:189
uint32_t exception_handler() const
Exception handler RVA (if any).
Definition UnpackedFunction.hpp:115
UnpackedFunction & is_extended(bool value)
Definition UnpackedFunction.hpp:199
uint32_t code_words() const
Number of 32-bit words needed to contain all of the unwind codes.
Definition UnpackedFunction.hpp:110
UnpackedFunction & X(uint8_t value)
Definition UnpackedFunction.hpp:164
uint32_t xdata_rva() const
RVA where this unpacked data is located (usually pointing in .xdata).
Definition UnpackedFunction.hpp:73
uint64_t exception_handler_offset() const
Definition UnpackedFunction.hpp:141
UnpackedFunction & exception_handler(uint32_t value)
Definition UnpackedFunction.hpp:184
UnpackedFunction & xdata_rva(uint32_t value)
Definition UnpackedFunction.hpp:154
UnpackedFunction & operator=(UnpackedFunction &&)=default
std::vector< epilog_scope_t > epilog_scopes_t
Definition UnpackedFunction.hpp:47
uint64_t unwind_code_offset() const
Definition UnpackedFunction.hpp:137
UnpackedFunction & operator=(const UnpackedFunction &)=default
span< const uint8_t > unwind_code() const
Bytes that contain the unwind codes.
Definition UnpackedFunction.hpp:120
uint32_t epilog_count_
Definition UnpackedFunction.hpp:218
uint32_t epilog_offset_
Definition UnpackedFunction.hpp:219
it_const_epilog_scopes epilog_scopes() const
Definition UnpackedFunction.hpp:150
UnpackedFunction(UnpackedFunction &&)=default
uint32_t version() const
Describes the version of the remaining .xdata.
Definition UnpackedFunction.hpp:81
std::unique_ptr< ExceptionInfo > clone() const override
Definition UnpackedFunction.hpp:66
UnpackedFunction(const UnpackedFunction &)=default
std::string to_string() const override
UnpackedFunction & unwind_code(std::vector< uint8_t > code)
Definition UnpackedFunction.hpp:194
static bool classof(const ExceptionInfo *info)
Definition UnpackedFunction.hpp:204
ref_iterator< epilog_scopes_t & > it_epilog_scopes
Definition UnpackedFunction.hpp:48
uint16_t epilog_count() const
If E() == 0, specifies the count of the total number of epilog scopes. Otherwise, return 0
Definition UnpackedFunction.hpp:99
Iterator which returns reference on container's values.
Definition iterators.hpp:46
This namespace wraps code related to PE-ARM64 unwinding code.
Definition PackedFunction.hpp:26
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
LIEF namespace.
Definition Abstract/Binary.hpp:40
tcb::span< ElementType, Extent > span
Definition span.hpp:22
ref_iterator< CT, U, typename decay_t< CT >::const_iterator > const_ref_iterator
Iterator which return const ref on container's values.
Definition iterators.hpp:257
This structure describes an epilog scope.
Definition UnpackedFunction.hpp:35
uint8_t reserved
Reserved for future expansion. Should be 0.
Definition UnpackedFunction.hpp:44
uint16_t start_index
Byte index of the first unwind code that describes this epilog.
Definition UnpackedFunction.hpp:41
uint32_t start_offset
Offset of the epilog relatives to the start of the function.
Definition UnpackedFunction.hpp:38
#define LIEF_API
Definition visibility.h:41