51 lines
9.7 KiB
HTML
Raw Normal View History

2019-09-06 15:57:44 -07:00
<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta name="generator" content="rustdoc"><meta name="description" content="API documentation for the Rust `exception` mod in crate `goblin`."><meta name="keywords" content="rust, rustlang, rust-lang, exception"><title>goblin::pe::exception - Rust</title><link rel="stylesheet" type="text/css" href="../../../normalize.css"><link rel="stylesheet" type="text/css" href="../../../rustdoc.css" id="mainThemeStyle"><link rel="stylesheet" type="text/css" href="../../../dark.css"><link rel="stylesheet" type="text/css" href="../../../light.css" id="themeStyle"><script src="../../../storage.js"></script><noscript><link rel="stylesheet" href="../../../noscript.css"></noscript><link rel="shortcut icon" href="../../../favicon.ico"><style type="text/css">#crate-search{background-image:url("../../../down-arrow.svg");}</style></head><body class="rustdoc mod"><!--[if lte IE 8]><div class="warning">This old browser is unsupported and will most likely display funky things.</div><![endif]--><nav class="sidebar"><div class="sidebar-menu">&#9776;</div><a href='../../../goblin/index.html'><div class='logo-container'><img src='../../../rust-logo.png' alt='logo'></div></a><p class='location'>Module exception</p><div class="sidebar-elems"><div class="block items"><ul><li><a href="#structs">Structs</a></li><li><a href="#enums">Enums</a></li></ul></div><p class='location'><a href='../../index.html'>goblin</a>::<wbr><a href='../index.html'>pe</a></p><script>window.sidebarCurrent = {name: 'exception', ty: 'mod', relpath: '../'};</script><script defer src="../sidebar-items.js"></script></div></nav><div class="theme-picker"><button id="theme-picker" aria-label="Pick another theme!"><img src="../../../brush.svg" width="18" alt="Pick another theme!"></button><div id="theme-choices"></div></div><script src="../../../theme.js"></script><nav class="sub"><form class="search-form js-only"><div class="search-container"><div><select id="crate-search"><option value="All crates">All crates</option></select><input class="search-input" name="search" autocomplete="off" spellcheck="false" placeholder="Click or press S to search, ? for more options…" type="search"></div><a id="settings-menu" href="../../../settings.html"><img src="../../../wheel.svg" width="18" alt="Change settings"></a></div></form></nav><section id="main" class="content"><h1 class='fqn'><span class='out-of-band'><span id='render-detail'><a id="toggle-all-docs" href="javascript:void(0)" title="collapse all docs">[<span class='inner'>&#x2212;</span>]</a></span><a class='srclink' href='../../../src/goblin/pe/exception.rs.html#1-826' title='goto source code'>[src]</a></span><span class='in-band'>Module <a href='../../index.html'>goblin</a>::<wbr><a href='../index.html'>pe</a>::<wbr><a class="mod" href=''>exception</a></span></h1><div class='docblock'><p>Exception handling and stack unwinding for x64.</p>
<p>Exception information is exposed via the <a href="struct.ExceptionData.html"><code>ExceptionData</code></a> structure. If present in a PE file,
it contains a list of <a href="struct.RuntimeFunction.html"><code>RuntimeFunction</code></a> entries that can be used to get <a href="struct.UnwindInfo.html"><code>UnwindInfo</code></a> for a
particular code location.</p>
<p>Unwind information contains a list of unwind codes which specify the operations that are
necessary to restore registers (including the stack pointer RSP) when unwinding out of a
function.</p>
<p>Depending on where the instruction pointer lies, there are three strategies to unwind:</p>
<ol>
<li>
<p>If the RIP is within an epilog, then control is leaving the function, there can be no
exception handler associated with this exception for this function, and the effects of the
epilog must be continued to compute the context of the caller function. To determine if the
RIP is within an epilog, the code stream from RIP on is examined. If that code stream can be
matched to the trailing portion of a legitimate epilog, then it's in an epilog, and the
remaining portion of the epilog is simulated, with the context record updated as each
instruction is processed. After this, step 1 is repeated.</p>
</li>
<li>
<p>Case b) If the RIP lies within the prologue, then control has not entered the function,
there can be no exception handler associated with this exception for this function, and the
effects of the prolog must be undone to compute the context of the caller function. The RIP
is within the prolog if the distance from the function start to the RIP is less than or
equal to the prolog size encoded in the unwind info. The effects of the prolog are unwound
by scanning forward through the unwind codes array for the first entry with an offset less
than or equal to the offset of the RIP from the function start, then undoing the effect of
all remaining items in the unwind code array. Step 1 is then repeated.</p>
</li>
<li>
<p>If the RIP is not within a prolog or epilog and the function has an exception handler, then
the language-specific handler is called. The handler scans its data and calls filter
functions as appropriate. The language-specific handler can return that the exception was
handled or that the search is to be continued. It can also initiate an unwind directly.</p>
</li>
</ol>
<p>For more information, see <a href="https://docs.microsoft.com/en-us/cpp/build/exception-handling-x64?view=vs-2017">x64 exception handling</a>.</p>
</div><h2 id='structs' class='section-header'><a href="#structs">Structs</a></h2>
<table><tr class='module-item'><td><a class="struct" href="struct.ExceptionData.html" title='goblin::pe::exception::ExceptionData struct'>ExceptionData</a></td><td class='docblock-short'><p>Exception handling and stack unwind information for functions in the image.</p>
</td></tr><tr class='module-item'><td><a class="struct" href="struct.Register.html" title='goblin::pe::exception::Register struct'>Register</a></td><td class='docblock-short'><p>An x64 register used during unwinding.</p>
</td></tr><tr class='module-item'><td><a class="struct" href="struct.RuntimeFunction.html" title='goblin::pe::exception::RuntimeFunction struct'>RuntimeFunction</a></td><td class='docblock-short'><p>An unwind entry for a range of a function.</p>
</td></tr><tr class='module-item'><td><a class="struct" href="struct.RuntimeFunctionIterator.html" title='goblin::pe::exception::RuntimeFunctionIterator struct'>RuntimeFunctionIterator</a></td><td class='docblock-short'><p>Iterator over runtime function entries in <a href="struct.ExceptionData.html"><code>ExceptionData</code></a>.</p>
</td></tr><tr class='module-item'><td><a class="struct" href="struct.UnwindCode.html" title='goblin::pe::exception::UnwindCode struct'>UnwindCode</a></td><td class='docblock-short'><p>An unwind operation that is executed at a particular place in the function prolog.</p>
</td></tr><tr class='module-item'><td><a class="struct" href="struct.UnwindCodeIterator.html" title='goblin::pe::exception::UnwindCodeIterator struct'>UnwindCodeIterator</a></td><td class='docblock-short'><p>An iterator over unwind codes for a function or part of a function, returned from
<a href="struct.UnwindInfo.html"><code>UnwindInfo</code></a>.</p>
</td></tr><tr class='module-item'><td><a class="struct" href="struct.UnwindInfo.html" title='goblin::pe::exception::UnwindInfo struct'>UnwindInfo</a></td><td class='docblock-short'><p>Unwind information for a function or portion of a function.</p>
</td></tr></table><h2 id='enums' class='section-header'><a href="#enums">Enums</a></h2>
<table><tr class='module-item'><td><a class="enum" href="enum.StackFrameOffset.html" title='goblin::pe::exception::StackFrameOffset enum'>StackFrameOffset</a></td><td class='docblock-short'><p>An unsigned offset to a value in the local stack frame.</p>
</td></tr><tr class='module-item'><td><a class="enum" href="enum.UnwindHandler.html" title='goblin::pe::exception::UnwindHandler enum'>UnwindHandler</a></td><td class='docblock-short'><p>A language-specific handler that is called as part of the search for an exception handler or as
part of an unwind.</p>
</td></tr><tr class='module-item'><td><a class="enum" href="enum.UnwindOperation.html" title='goblin::pe::exception::UnwindOperation enum'>UnwindOperation</a></td><td class='docblock-short'><p>An unwind operation corresponding to code in the function prolog.</p>
</td></tr></table></section><section id="search" class="content hidden"></section><section class="footer"></section><aside id="help" class="hidden"><div><h1 class="hidden">Help</h1><div class="shortcuts"><h2>Keyboard Shortcuts</h2><dl><dt><kbd>?</kbd></dt><dd>Show this help dialog</dd><dt><kbd>S</kbd></dt><dd>Focus the search field</dd><dt><kbd></kbd></dt><dd>Move up in search results</dd><dt><kbd></kbd></dt><dd>Move down in search results</dd><dt><kbd></kbd></dt><dd>Switch tab</dd><dt><kbd>&#9166;</kbd></dt><dd>Go to active search result</dd><dt><kbd>+</kbd></dt><dd>Expand all sections</dd><dt><kbd>-</kbd></dt><dd>Collapse all sections</dd></dl></div><div class="infos"><h2>Search Tricks</h2><p>Prefix searches with a type followed by a colon (e.g., <code>fn:</code>) to restrict the search to a given type.</p><p>Accepted types are: <code>fn</code>, <code>mod</code>, <code>struct</code>, <code>enum</code>, <code>trait</code>, <code>type</code>, <code>macro</code>, and <code>const</code>.</p><p>Search functions by type signature (e.g., <code>vec -> usize</code> or <code>* -> vec</code>)</p><p>Search multiple things at once by splitting your query with comma (e.g., <code>str,u8</code> or <code>String,struct:Vec,test</code>)</p></div></div></aside><script>window.rootPath = "../../../";window.currentCrate = "goblin";</script><script src="../../../aliases.js"></script><script src="../../../main.js"></script><script defer src="../../../search-index.js"></script></body></html>