Skip to content

Image Exception Directory

AFP edited this page Apr 1, 2023 · 2 revisions

How to Access Image Exception Directory

after initialize the PE class you can get access the Image Exception Directory structure by calling GetImageExceptionDirectory() method. by calling this function, you get the object of ImageExceptionDirectory class, so you can retrieve the fields, change or modify them.

#include <iostream>
#include <POEX.h> // include POEX header

int main()
{
    auto pe = POEX::PE(L"1.exe");

    // Access to Image Exception Directory
    auto exceptionDirectory = pe.GetImageExceptionDirectory();

    // other stuff in here

    return 0;
}

With calling GetImageExceptionDirectory method, you can access the structure and method in bellow:

/// <summary>
/// Get all Runtime Function
/// </summary>
/// <returns>list of Runtime function</returns>
auto GetExceptionDirectories() -> std::vector<std::unique_ptr<ExceptionTable>>;

And with ExceptionTable you can access to Exception Table Structure:

/// <summary>
/// Get RVA Start of the function in code.
/// </summary>
/// <returns></returns>
auto BeginAddress() const -> unsigned long;

/// <summary>
/// Set RVA Start of the function in code.
/// </summary>
/// <param name="offset"></param>
/// <returns></returns>
auto BeginAddress(const unsigned long& offset) -> void;

/// <summary>
/// Get RVA End of the function in code.
/// </summary>
/// <returns></returns>
auto EndAddress() const -> unsigned long;

/// <summary>
/// Set RVA End of the function in code.
/// </summary>
/// <param name="offset"></param>
/// <returns></returns>
auto EndAddress(const unsigned long& offset) -> void;

/// <summary>
/// Get Pointer to the unwind information.
/// </summary>
/// <returns></returns>
auto UnwInfo() const -> unsigned long;

/// <summary>
/// Set Pointer to the unwind information.
/// </summary>
/// <param name="pointer">Pointer to the unwind information</param>
/// <returns></returns>
auto UnwInfo(const unsigned long& pointer) ->void;