class Rex::PeParsey::PeBase::UnwindInfo

Attributes

count_of_codes[R]
flags[R]
frame_register[R]
frame_register_offset[R]
size_of_prolog[R]
version[R]

Public Class Methods

new(pe, unwind_rva) click to toggle source
# File lib/rex/peparsey/pebase.rb, line 1050
def initialize(pe, unwind_rva)
  data = pe.read_rva(unwind_rva, UNWIND_INFO_HEADER_SZ)

  unwind  = UNWIND_INFO_HEADER.make_struct
  unwind.from_s(data)

  @version               = unwind.v['VersionFlags'] & 0x7
  @flags                 = unwind.v['VersionFlags'] >> 3
  @size_of_prolog        = unwind.v['SizeOfProlog']
  @count_of_codes        = unwind.v['CountOfCodes']
  @frame_register        = unwind.v['FrameRegisterAndOffset'] & 0xf
  @frame_register_offset = unwind.v['FrameRegisterAndOffset'] >> 4

  # Parse unwind codes
  clist = pe.read_rva(unwind_rva + UNWIND_INFO_HEADER_SZ, count_of_codes * 4)

  @unwind_codes = []

  while clist.length > 0
    @unwind_codes << UnwindCode.new(clist)
  end
end

Public Instance Methods

unwind_codes() click to toggle source
# File lib/rex/peparsey/pebase.rb, line 1076
def unwind_codes
  @unwind_codes
end