/// <summary>
/// Get the UNWIND_INFO from a runtime function form the
/// Exception header in x64 applications.
/// </summary>
/// <param name="sh">Section Headers of the PE file.</param>
/// <returns>UNWIND_INFO for the runtime function.</returns>
private UNWIND_INFO GetUnwindInfo(IMAGE_SECTION_HEADER[] sh)
{
// Check if the last bit is set in the UnwindInfo. If so, it is a chained
// information.
var uwAddress = (UnwindInfo & 0x1) == 0x1
? UnwindInfo & 0xFFFE
: UnwindInfo;
var uw = new UNWIND_INFO(Buff, uwAddress.RVAtoFileMapping(sh));
return(uw);
}
public void UnwindInfoConstructorWorks_Test()
{
var unwindInfo = new UNWIND_INFO(RawStructures.RawUnwindInfo, 2);
Assert.AreEqual((byte) 0x1, unwindInfo.Version);
Assert.AreEqual((byte) 0x12, unwindInfo.Flags);
Assert.AreEqual((byte) 0x33, unwindInfo.SizeOfProlog);
Assert.AreEqual((byte) 0x5, unwindInfo.FrameRegister);
Assert.AreEqual((byte) 0x6, unwindInfo.FrameOffset);
Assert.AreEqual(1, unwindInfo.UnwindCode.Length);
Assert.AreEqual((byte) 0x77, unwindInfo.UnwindCode[0].CodeOffset);
Assert.AreEqual((byte) 0x8, unwindInfo.UnwindCode[0].UnwindOp);
Assert.AreEqual((byte) 0x9, unwindInfo.UnwindCode[0].Opinfo);
Assert.AreEqual(0xffeeddcc, unwindInfo.ExceptionHandler);
}
