RuntimeFunction

final class ntoseye.RuntimeFunction

Subclass of BaseRecord.

One function-table entry and its unwind data. Addresses are absolute, and the *_rva fields hold the raw image-relative values.

property begin: int

property begin_rva: int

property end: int

property end_rva: int

property symbol: str

The symbol at begin.

property unwind: Amd64UnwindInfo | Arm64PackedUnwind | Arm64XdataUnwind | None

The decoded unwind data. None if ntoseye cannot read it.

property unwind_data: int

The raw unwind word of the entry: the RVA of the unwind info, or the packed unwind data on ARM64.

property unwind_info: int | None

The address of the unwind info. None for ARM64 packed unwind data.