The UNWIND_CODE is a struct in the UNWIND_INFO used to describe exception handling in x64 applications and to walk the stack.
Inheritance: AbstractStructure
示例#1
0
        public void UnwindCodeConstructorWorks_Test()
        {
            var unwindCode = new UNWIND_CODE(RawStructures.RawUnwindCode, 2);

            Assert.AreEqual((byte) 0x11, unwindCode.CodeOffset);
            Assert.AreEqual((byte) 0x2, unwindCode.UnwindOp);
            Assert.AreEqual((byte) 0x3, unwindCode.Opinfo);
            Assert.AreEqual((ushort) 0x5544, unwindCode.FrameOffset);
        }
        private UNWIND_CODE[] ParseUnwindCodes(byte[] buff, uint offset)
        {
            var  ucList             = new List <UNWIND_CODE>();
            var  i                  = 0;
            uint nodeSize           = 0x2;
            var  currentUnwindeCode = offset;

            while (i < CountOfCodes)
            {
                int numberOfNodes;
                var uw = new UNWIND_CODE(buff, currentUnwindeCode);
                currentUnwindeCode += nodeSize; // CodeOffset and UnwindOp/Opinfo (= 0x2 byte)

                switch (uw.UnwindOp)
                {
                case (byte)Constants.UnwindOpCodes.UWOP_PUSH_NONVOL:
                    break;

                case (byte)Constants.UnwindOpCodes.UWOP_ALLOC_LARGE:
                    currentUnwindeCode += (uint)(uw.Opinfo == 0 ? 0x2 : 0x4);
                    break;

                case (byte)Constants.UnwindOpCodes.UWOP_ALLOC_SMALL:
                    break;

                case (byte)Constants.UnwindOpCodes.UWOP_SET_FPREG:
                    break;

                case (byte)Constants.UnwindOpCodes.UWOP_SAVE_NONVOL:
                    currentUnwindeCode += 0x2;
                    break;

                case (byte)Constants.UnwindOpCodes.UWOP_SAVE_NONVOL_FAR:
                    currentUnwindeCode += 0x4;
                    break;

                case (byte)Constants.UnwindOpCodes.UWOP_SAVE_XMM128:
                    currentUnwindeCode += 0x2;
                    break;

                case (byte)Constants.UnwindOpCodes.UWOP_SAVE_XMM128_FAR:
                    currentUnwindeCode += 0x4;
                    break;

                case (byte)Constants.UnwindOpCodes.UWOP_PUSH_MACHFRAME:
                    break;
                }

                if ((uw.UnwindOp == (byte)Constants.UnwindOpCodes.UWOP_ALLOC_LARGE &&
                     uw.Opinfo == 0x0) ||
                    (uw.UnwindOp == (byte)Constants.UnwindOpCodes.UWOP_SAVE_NONVOL) ||
                    (uw.UnwindOp == (byte)Constants.UnwindOpCodes.UWOP_SAVE_XMM128))
                {
                    numberOfNodes = 2;
                }
                else if ((uw.UnwindOp == (byte)Constants.UnwindOpCodes.UWOP_ALLOC_LARGE &&
                          uw.Opinfo == 0x1) ||
                         (uw.UnwindOp == (byte)Constants.UnwindOpCodes.UWOP_SAVE_NONVOL_FAR) ||
                         (uw.UnwindOp == (byte)Constants.UnwindOpCodes.UWOP_SAVE_XMM128_FAR))
                {
                    numberOfNodes = 3;
                }
                else
                {
                    numberOfNodes = 1;
                }

                i += numberOfNodes;

                ucList.Add(uw);
            }
            return(ucList.ToArray());
        }
示例#3
0
        private UNWIND_CODE[] ParseUnwindCodes(byte[] buff, uint offset)
        {
            var ucList = new List<UNWIND_CODE>();
            var i = 0;
            uint nodeSize = 0x2;
            var currentUnwindeCode = offset;
            while (i < CountOfCodes)
            {
                int numberOfNodes;
                var uw = new UNWIND_CODE(buff, currentUnwindeCode);
                currentUnwindeCode += nodeSize; // CodeOffset and UnwindOp/Opinfo (= 0x2 byte)

                switch (uw.UnwindOp)
                {
                    case (byte) Constants.UnwindOpCodes.UWOP_PUSH_NONVOL:
                        break;
                    case (byte) Constants.UnwindOpCodes.UWOP_ALLOC_LARGE:
                        currentUnwindeCode += (uint) (uw.Opinfo == 0 ? 0x2 : 0x4);
                        break;
                    case (byte) Constants.UnwindOpCodes.UWOP_ALLOC_SMALL:
                        break;
                    case (byte) Constants.UnwindOpCodes.UWOP_SET_FPREG:
                        break;
                    case (byte) Constants.UnwindOpCodes.UWOP_SAVE_NONVOL:
                        currentUnwindeCode += 0x2;
                        break;
                    case (byte) Constants.UnwindOpCodes.UWOP_SAVE_NONVOL_FAR:
                        currentUnwindeCode += 0x4;
                        break;
                    case (byte) Constants.UnwindOpCodes.UWOP_SAVE_XMM128:
                        currentUnwindeCode += 0x2;
                        break;
                    case (byte) Constants.UnwindOpCodes.UWOP_SAVE_XMM128_FAR:
                        currentUnwindeCode += 0x4;
                        break;
                    case (byte) Constants.UnwindOpCodes.UWOP_PUSH_MACHFRAME:
                        break;
                }

                if ((uw.UnwindOp == (byte) Constants.UnwindOpCodes.UWOP_ALLOC_LARGE
                     && uw.Opinfo == 0x0)
                    || (uw.UnwindOp == (byte) Constants.UnwindOpCodes.UWOP_SAVE_NONVOL)
                    || (uw.UnwindOp == (byte) Constants.UnwindOpCodes.UWOP_SAVE_XMM128))
                {
                    numberOfNodes = 2;
                }
                else if ((uw.UnwindOp == (byte) Constants.UnwindOpCodes.UWOP_ALLOC_LARGE
                          && uw.Opinfo == 0x1)
                         || (uw.UnwindOp == (byte) Constants.UnwindOpCodes.UWOP_SAVE_NONVOL_FAR)
                         || (uw.UnwindOp == (byte) Constants.UnwindOpCodes.UWOP_SAVE_XMM128_FAR))
                {
                    numberOfNodes = 3;
                }
                else
                {
                    numberOfNodes = 1;
                }

                i += numberOfNodes;

                ucList.Add(uw);
            }
            return ucList.ToArray();
        }