virtualx-engine/drivers/pe_bliss/pe_exception_directory.cpp

#include "pe_exception_directory.h"

namespace pe_bliss
{
using namespace pe_win;

//EXCEPTION DIRECTORY (exists on PE+ only)
//Default constructor
exception_entry::exception_entry()
	:begin_address_(0), end_address_(0), unwind_info_address_(0),
	unwind_info_version_(0),
	flags_(0),
	size_of_prolog_(0),
	count_of_codes_(0),
	frame_register_(0),
	frame_offset_(0)
{}

//Constructor from data
exception_entry::exception_entry(const image_runtime_function_entry& entry, const unwind_info& unwind_info)
	:begin_address_(entry.BeginAddress), end_address_(entry.EndAddress), unwind_info_address_(entry.UnwindInfoAddress),
	unwind_info_version_(unwind_info.Version),
	flags_(unwind_info.Flags),
	size_of_prolog_(unwind_info.SizeOfProlog),
	count_of_codes_(unwind_info.CountOfCodes),
	frame_register_(unwind_info.FrameRegister),
	frame_offset_(unwind_info.FrameOffset)
{}

//Returns starting address of function, affected by exception unwinding
uint32_t exception_entry::get_begin_address() const
{
	return begin_address_;
}

//Returns ending address of function, affected by exception unwinding
uint32_t exception_entry::get_end_address() const
{
	return end_address_;
}

//Returns unwind info address
uint32_t exception_entry::get_unwind_info_address() const
{
	return unwind_info_address_;
}

//Returns UNWIND_INFO structure version
uint8_t exception_entry::get_unwind_info_version() const
{
	return unwind_info_version_;
}

//Returns unwind info flags
uint8_t exception_entry::get_flags() const
{
	return flags_;
}

//The function has an exception handler that should be called
//when looking for functions that need to examine exceptions
bool exception_entry::has_exception_handler() const
{
	return (flags_ & unw_flag_ehandler) ? true : false;
}

//The function has a termination handler that should be called
//when unwinding an exception
bool exception_entry::has_termination_handler() const
{
	return (flags_ & unw_flag_uhandler) ? true : false;
}

//The unwind info structure is not the primary one for the procedure
bool exception_entry::is_chaininfo() const
{
	return (flags_ & unw_flag_chaininfo) ? true : false;
}

//Returns size of function prolog
uint8_t exception_entry::get_size_of_prolog() const
{
	return size_of_prolog_;
}

//Returns number of unwind slots
uint8_t exception_entry::get_number_of_unwind_slots() const
{
	return count_of_codes_;
}

//If the function uses frame pointer
bool exception_entry::uses_frame_pointer() const
{
	return frame_register_ != 0;
}

//Number of the nonvolatile register used as the frame pointer,
//using the same encoding for the operation info field of UNWIND_CODE nodes
uint8_t exception_entry::get_frame_pointer_register_number() const
{
	return frame_register_;
}

//The scaled offset from RSP that is applied to the FP reg when it is established.
//The actual FP reg is set to RSP + 16 * this number, allowing offsets from 0 to 240
uint8_t exception_entry::get_scaled_rsp_offset() const
{
	return frame_offset_;
}

//Returns exception directory data (exists on PE+ only)
//Unwind opcodes are not listed, because their format and list are subject to change
const exception_entry_list get_exception_directory_data(const pe_base& pe)
{
	exception_entry_list ret;

	//If image doesn't have exception directory, return empty list
	if(!pe.has_exception_directory())
		return ret;

	//Check the length in bytes of the section containing exception directory
	if(pe.section_data_length_from_rva(pe.get_directory_rva(image_directory_entry_exception), pe.get_directory_rva(image_directory_entry_exception), section_data_virtual, true)
		< sizeof(image_runtime_function_entry))
		throw pe_exception("Incorrect exception directory", pe_exception::incorrect_exception_directory);

	unsigned long current_pos = pe.get_directory_rva(image_directory_entry_exception);

	//Check if structures are DWORD-aligned
	if(current_pos % sizeof(uint32_t))
		throw pe_exception("Incorrect exception directory", pe_exception::incorrect_exception_directory);

	//First IMAGE_RUNTIME_FUNCTION_ENTRY table
	image_runtime_function_entry exception_table = pe.section_data_from_rva<image_runtime_function_entry>(current_pos, section_data_virtual, true);

	//todo: virtual addresses BeginAddress and EndAddress are not checked to be inside image
	while(exception_table.BeginAddress)
	{
		//Check addresses
		if(exception_table.BeginAddress > exception_table.EndAddress)
			throw pe_exception("Incorrect exception directory", pe_exception::incorrect_exception_directory);

		//Get unwind information
		unwind_info info = pe.section_data_from_rva<unwind_info>(exception_table.UnwindInfoAddress, section_data_virtual, true);

		//Create exception entry and save it
		ret.push_back(exception_entry(exception_table, info));

		//Go to next exception entry
		current_pos += sizeof(image_runtime_function_entry);
		exception_table = pe.section_data_from_rva<image_runtime_function_entry>(current_pos, section_data_virtual, true);
	}

	return ret;
}
}