Parses exception directory All the code related to handling exception directories is documented in https://auscitte.github.io/systems%20blog/Exception-Directory-pefile#implementation-details
(self, rva, size)
| 3608 | directories.remove(directory_index) |
| 3609 | |
| 3610 | def parse_exceptions_directory(self, rva, size): |
| 3611 | """Parses exception directory |
| 3612 | |
| 3613 | All the code related to handling exception directories is documented in |
| 3614 | https://auscitte.github.io/systems%20blog/Exception-Directory-pefile#implementation-details |
| 3615 | """ |
| 3616 | |
| 3617 | # "For x64 and Itanium platforms; the format is different for other platforms" |
| 3618 | if ( |
| 3619 | self.FILE_HEADER.Machine != MACHINE_TYPE["IMAGE_FILE_MACHINE_AMD64"] |
| 3620 | and self.FILE_HEADER.Machine != MACHINE_TYPE["IMAGE_FILE_MACHINE_IA64"] |
| 3621 | ): |
| 3622 | return None |
| 3623 | |
| 3624 | rf = Structure(self.__RUNTIME_FUNCTION_format__) |
| 3625 | rf_size = rf.sizeof() |
| 3626 | rva2rt = {} |
| 3627 | rt_funcs = [] |
| 3628 | rva2infos = {} |
| 3629 | for _ in range(size // rf_size): |
| 3630 | rf = self.__unpack_data__( |
| 3631 | self.__RUNTIME_FUNCTION_format__, |
| 3632 | self.get_data(rva, rf_size), |
| 3633 | file_offset=self.get_offset_from_rva(rva), |
| 3634 | ) |
| 3635 | |
| 3636 | if rf is None: |
| 3637 | break |
| 3638 | |
| 3639 | ui = None |
| 3640 | |
| 3641 | if (rf.UnwindData & 0x1) == 0: |
| 3642 | # according to "Improving Automated Analysis of Windows x64 Binaries", |
| 3643 | # if the lowest bit is set, (UnwindData & ~0x1) should point to the |
| 3644 | # chained RUNTIME_FUNCTION instead of UNWIND_INFO |
| 3645 | |
| 3646 | if ( |
| 3647 | rf.UnwindData in rva2infos |
| 3648 | ): # unwind info data structures can be shared among functions |
| 3649 | ui = rva2infos[rf.UnwindData] |
| 3650 | else: |
| 3651 | ui = UnwindInfo(file_offset=self.get_offset_from_rva(rf.UnwindData)) |
| 3652 | rva2infos[rf.UnwindData] = ui |
| 3653 | |
| 3654 | ws = ui.unpack_in_stages(self.get_data(rf.UnwindData, ui.sizeof())) |
| 3655 | if ws != None: |
| 3656 | self.__warnings.append(ws) |
| 3657 | break |
| 3658 | ws = ui.unpack_in_stages(self.get_data(rf.UnwindData, ui.sizeof())) |
| 3659 | if ws != None: |
| 3660 | self.__warnings.append(ws) |
| 3661 | break |
| 3662 | |
| 3663 | self.__structures__.append(ui) |
| 3664 | |
| 3665 | entry = ExceptionsDirEntryData(struct=rf, unwindinfo=ui) |
| 3666 | rt_funcs.append(entry) |
| 3667 |
nothing calls this directly
no test coverage detected