Parse function table data for the given PE file. Only really relevant for non-x86 images. Args: pe: the PE image whose function data should be parsed image_base: the absolute address at which the image was loaded
(self, pe: pefile.PE, image_base: int)
| 125 | return self.ql.os.path.virtual_to_host_path(vpath), basename.casefold() |
| 126 | |
| 127 | def init_function_tables(self, pe: pefile.PE, image_base: int): |
| 128 | """Parse function table data for the given PE file. |
| 129 | Only really relevant for non-x86 images. |
| 130 | |
| 131 | Args: |
| 132 | pe: the PE image whose function data should be parsed |
| 133 | image_base: the absolute address at which the image was loaded |
| 134 | """ |
| 135 | if self.ql.arch.type is not QL_ARCH.X86: |
| 136 | |
| 137 | # Check if the PE file has an exception directory |
| 138 | if hasattr(pe, 'DIRECTORY_ENTRY_EXCEPTION'): |
| 139 | exception_dir = pe.OPTIONAL_HEADER.DATA_DIRECTORY[ |
| 140 | pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXCEPTION'] |
| 141 | ] |
| 142 | |
| 143 | self.function_table_lookup[image_base] = exception_dir.VirtualAddress |
| 144 | |
| 145 | runtime_function_list = list(pe.DIRECTORY_ENTRY_EXCEPTION) |
| 146 | |
| 147 | if image_base not in self.function_tables: |
| 148 | self.function_tables[image_base] = [] |
| 149 | |
| 150 | self.function_tables[image_base].extend(runtime_function_list) |
| 151 | |
| 152 | self.ql.log.debug(f'Parsed {len(runtime_function_list)} exception directory entries') |
| 153 | |
| 154 | else: |
| 155 | self.ql.log.debug(f'Image has no exception directory; skipping exception data') |
| 156 | |
| 157 | def lookup_function_entry(self, base_addr: int, control_pc: int): |
| 158 | """Look up a RUNTIME_FUNCTION entry and its index in a module's |