coda_ehframe.cpp

//writer nishant.pamnani@gmail.com
#include "coda_ehframe.h"
#include "coda_dwcodes.h"

void DwarfExpression(Activation *a, DWOpStk *opstk, UBYTE *cptr, UBYTE *ecptr);

UBYTE* DecULEB128(UBYTE *lebarr, uint64_t *rval)
{
  uint64_t val = 0;
  int shift = 0;
  while (true)
  {
    val |=  ((*lebarr & 0x7f) << shift);
    if (*lebarr & 0x80) {
      shift += 7;
      ++lebarr;
    } else
      break;
  }

  if (rval != NULL)
    *rval = val;
  return lebarr + 1;
}

UBYTE* DecSLEB128(UBYTE *lebarr, int64_t *rval)
{
  int64_t val = 0;
  UBYTE byte;
  int shift = 0;
  do
  {
    byte = *lebarr++;

    val |= ((byte & 0x7f) << shift);
    shift += 7;
    if (!(byte & 0x80)) {
      if (byte & 0x40) {
        val |= -(1UL << shift);
      }
      break;
    }
  } while(true);

  if (rval != NULL)
    *rval = val;
  return lebarr;
}

static inline void
CopyArchRegs(const user_regs_struct *urs, ArcReg *oregs)
{

  oregs[RAX] = urs->rax;
  oregs[RBX] = urs->rbx;
  oregs[RCX] = urs->rcx;
  oregs[RDX] = urs->rdx;
  oregs[RSI] = urs->rsi;
  oregs[RDI] = urs->rdi;
  oregs[RBP] = urs->rbp;
  oregs[RSP] = urs->rsp;
  oregs[R8]  = urs->r8;
  oregs[R9]  = urs->r9;
  oregs[R10] = urs->r10;
  oregs[R11] = urs->r11;
  oregs[R12] = urs->r12;
  oregs[R13] = urs->r13;
  oregs[R14] = urs->r14;
  oregs[R15] = urs->r15;
  oregs[RAR] = urs->rip;
}

void 
EHFrame::PrintFrame(ArcReg *regs, int fnum, FrameInfo *fi, int va_adjusted)
{
 
  int linecount = 0; 
  std::string symname;
  RetCode rc = CoreObject::GetCoreObject().Addr2Name(regs[RAR] + va_adjusted, symname);

  if (m_regs)
  {
    std::cout << std::endl;
    linecount += fnum + 1;
    Paginate(m_co->IsInteractiveMode(),linecount);
  }

  std::cout << std::dec << "[" << fnum << "] " 
  << "0x" << std::setw(16) << std::setfill('0') 
  << std::right
  << std::hex << regs[RAR] << " ";

  if (rc != FALIURE)
  {
    if(NULL != fi)
      if (fi->cie_info->is_signal_handler) 
        std::cout << "<signal handler trampoline> ";
      else
        std::cout << "<0x" 
        << std::hex << std::setw(16) << std::setfill('0') << fi->pc 
        << " - "
        << "0x" << std::hex << std::setw(16) << std::setfill('0') << fi->pc_end
        << "> ";
    else 
#if 0
      std::cout << "(0x" << std::setw(19) << std::setfill('X')  
      << " - " 
      << "0x"<< std::setw(17) << std::setfill('X') << ") ";
#else
      std::cout << "<-------------RANGE UNKNOWN-------------> ";
#endif

    if (PART_SUCCESS == rc) 
      std::cout << "?? ";
  }
  std::cout << symname <<std::endl;
  linecount += fnum + 1;
  Paginate(m_co->IsInteractiveMode(),linecount);

  if (m_regs)
  {
    std::cout << std::hex <<  "rax = " <<  "0x" << regs[RAX] 
                          <<  " rbx = " << "0x" << regs[RBX] 
                          <<  " rcx = " << "0x" << regs[RCX] 
                          <<  " rdx = " << "0x" << regs[RDX]
                          << std::endl;
    linecount += fnum + 1;
    Paginate(m_co->IsInteractiveMode(),linecount);
    std::cout << std::hex <<  "rsi = " << "0x" << regs[RSI] 
                          <<  " rdi = " << "0x" << regs[RDI] 
                          <<  " rbp = " << "0x" << regs[RBP] 
                          <<  " rsp = " << "0x" << regs[RSP]
                          << std::endl;
    linecount += fnum + 1;
    Paginate(m_co->IsInteractiveMode(),linecount);
    std::cout << std::hex <<  "r8 = " << "0x" << regs[R8]  
                          <<  " r9 = " << "0x" << regs[R9]
                          <<  " r10 = " << "0x" << regs[R10] 
                          <<  " r11 = " << "0x" << regs[R11] 
                          << std::endl;
    linecount += fnum + 1;
    Paginate(m_co->IsInteractiveMode(),linecount);
    std::cout << std::hex <<  "r12 = " << "0x" << regs[R12] 
                          <<  " r13 = " << "0x" << regs[R13] 
                          <<  " r14 = " << "0x" << regs[R14] 
                          <<  " r15 = " << "0x" << regs[R15]  
                          << std::endl;
    linecount += fnum + 1;
    Paginate(m_co->IsInteractiveMode(),linecount);
    std::cout << std::hex <<  "rip = " << "0x" << regs[RAR] << std::endl; 
    linecount += fnum + 1;
    Paginate(m_co->IsInteractiveMode(),linecount);
  }
}

void 
EHFrame::AdjustTopFrame(ArcReg *regs, int *pfnum)
{

retry:
  uint64_t va = regs[RAR];

  ObjectEntry *oe = FindObjectEntry(va,false);

  if ( NULL == oe )  {
    //Adjust the frame, but before that print the frame generated by 
    //invalid jump.
    PrintFrame(regs,(*pfnum)++, NULL);
    va = regs[RAR] = GetValueAtVA<uint64_t>(regs[RSP]);
    regs[RSP] = regs[RSP] + 8;
    oe = FindObjectEntry(va,false);
    if ( NULL == oe )  {
    //This might be the return to invalid address,
    //possibly due to stack overflow.
    //It might be useless to unwind fruther.
    //Warn user about it
      fprintf(stdout,"WARNING!!! Unable to unwind further, possible"
                    " stack overflow.\n");
      fprintf(stdout,"STACK BUFFER OVERFLOW: consider enabling stack protector.\n");
      regs[RAR] = 0;
    } else
    //This might happen if control tried to jump to invalid location.
      fprintf(stdout,"WARNING!!! Possible jump to invalid address.\n");
  } 
  else
  {
    unsigned char retq = 0;
    try {
      retq = GetValueAtVA<unsigned char>(va);
    }
    catch (std::runtime_error &cObj)
    {
    }

    if (retq == 0xc3)
    {
      FrameInfo *fi = FindFrameInfo(va);
      PrintFrame(regs,(*pfnum)++,fi);
      regs[RAR] = GetValueAtVA<uint64_t>(regs[RSP]);
      regs[RSP] = regs[RSP] + 8;
      goto retry;
    }
  }
}

void
EHFrame::PrintBT(const user_regs_struct *urs)
{
  ArcReg regs[RMAX];
  ArcReg oregs[RMAX];

  CopyArchRegs(urs,oregs);
 
  int fnum = 0;
  AdjustTopFrame(oregs, &fnum); 
  FrameInfo *fi = NULL, *last_fi = NULL;
   
  do 
  {
    uint64_t va = oregs[RAR];
    int va_adjusted = 0;
    if (0 == va) {
      break;
    }
  
    fi = FindFrameInfo(va);
    if (NULL== last_fi || last_fi->cie_info->is_signal_handler)
      ;//do nothing
    else if (NULL != fi)
    {
      if(fi->cie_info->is_signal_handler)
        ;// do nothing
      else if (va == fi->pc)
      {
        fi = FindFrameInfo(va = va-1);
        va_adjusted = -1;
      }
    } else if (NULL == fi)
    {
      fi = FindFrameInfo(va = va-1);
      va_adjusted = -1;
    }

    PrintFrame(oregs,fnum++,fi, va_adjusted);
    if (NULL == fi)
      break; //can't unwind further
    fi->pc_to_match = va;

    memcpy(regs,oregs,sizeof(regs));
    fi->inregs= regs;
    fi->outregs= oregs;
    last_fi = fi;
  } while(GetPreviousFrame(fi)); // if false, no more previous frame
}

bool 
EHFrame::GetPreviousFrame(FrameInfo* fi)
{
  
  Activation a; 
  a.regs = fi->inregs;
  a.pc = fi->pc;

  a.is_init = true;
  InterpretCFInstructions(&a,fi);

  memcpy(a.initregrules,a.regrules,sizeof(RegRules));
  
  a.is_init = false;
  InterpretCFInstructions(&a,fi);
  
  if (a.regrules[RAR].IsUndefined()) {
    return false;
  }
 
  for (unsigned i = RAX; i < RMAX; i++)
  {
    if ( RSP == i ) 
    {
      fi->outregs[RSP]=a.CFA.CFA(&a);
      continue;
    }
    if ( a.regrules[i].IsUndefined() || a.regrules[i].IsSameValue())
    {
      fi->outregs[i] = fi->inregs[i];
      continue;
    }
    fi->outregs[i] = a.regrules[i].GetRegVal(&a);
  }

  return true;
}

void 
EHFrame::InterpretCFInstructions(Activation *a, FrameInfo *fi)
{

  UBYTE *cptr; 
  UBYTE *end_cptr; 
  if(a->is_init) {
    cptr = fi->cie_info->cie_ins; 
    end_cptr = fi->cie_info->cie_ins_end;
  } else 
  {
    cptr = fi->fde_ins; 
    end_cptr = fi->fde_ins_end;
  }

  Stack<State*> StateStk; 
  while (cptr < end_cptr)
  {
    UBYTE DW_byte_code = *cptr++;
    switch(DW_byte_code & 0xc0)
    {
      case DW_CFA_restore:
      {
        uint64_t reg = DW_byte_code & 0x3f;
        a->regrules[reg] = a->initregrules[reg];
        if(coda_debug)
        printf("  DW_CFA_restore reg(%lu)\n", reg);
        break;
      }
      case DW_CFA_advance_loc:
      {
        uint64_t delta = DW_byte_code & 0x3f;
        uint64_t newpc = a->pc + delta * fi->cie_info->caf;
        if (fi->pc_to_match < newpc) 
          return;
        a->pc =  newpc;
        if(coda_debug)
        printf(" DW_CFA_advance_loc to %lx\n", a->pc);
        break;
      }
      case DW_CFA_offset:
      {
        uint64_t reg = DW_byte_code & 0x3f;
        uint64_t foff;
        cptr = DecULEB128(cptr, &foff); 
        a->regrules[reg].Offset(foff * fi->cie_info->daf);
        if(coda_debug)
        printf("  DW_CFA_offset reg(%lu) factored off(%lu)\n",reg,foff);
        if(coda_debug)
        printf("    offset rule => reg(%lu) at (CFA%+ld)\n",reg, (foff * fi->cie_info->daf) );
        break;
      }
      default:
      {
        switch(DW_byte_code)
        {
          case DW_CFA_def_cfa:
          {
            uint64_t reg;
            uint64_t off;
            cptr = DecULEB128(cptr, &reg); 
            cptr = DecULEB128(cptr, &off); 
            a->CFA.CFA(reg,off);
            if(coda_debug)
            printf("  DW_CFA_def_cfa reg(%lu) off(%lu)\n",reg,off);
            break;
          }
          case DW_CFA_def_cfa_offset:
          {
            uint64_t newoff;
            cptr = DecULEB128(cptr, &newoff); 
            a->CFA.CFANewOffset(newoff);
            if(coda_debug)
            printf("  DW_CFA_def_cfa_offset new_off(%lu)\n",newoff);
            break;
          }
          case DW_CFA_val_expression:
          case DW_CFA_expression:
          case DW_CFA_def_cfa_expression:
          {
            uint64_t reg;
            if (DW_CFA_val_expression == DW_byte_code
                ||
                DW_CFA_expression == DW_byte_code)
            {
              cptr = DecULEB128(cptr, &reg); 
            }
            uint64_t length = 0;
#if 0
            UBYTE form_block = *cptr++;
            switch(form_block)
            {
              case DW_FORM_block1:
              {
                fprintf(stdout,"DW_FORM_block1 ");
                length = *cptr++;
                break;
              }
              case DW_FORM_block2:
              {
                fprintf(stdout,"DW_FORM_block2 ");
                length = *(unsigned short*)cptr;
                cptr += 2;
                break;
              }
              case DW_FORM_block4:
              {
                fprintf(stdout,"DW_FORM_block4 ");
                length = *(unsigned*)cptr;
                cptr += 4;
                break;
              }
              case DW_FORM_block:
              {
                fprintf(stdout,"DW_FORM_block ");
                cptr = DecULEB128(cptr, &length); 
              }
            }
#else
            cptr = DecULEB128(cptr, &length); 
#endif
            UBYTE * ecptr = cptr + length;
            if (DW_CFA_val_expression == DW_byte_code) {
              a->regrules[reg].ValExpression(cptr,ecptr);
              if(coda_debug)
              printf("  DW_CFA_val_expression reg(%lu) len(%lu)\n"
                                                               ,reg, length);
            } else if (DW_CFA_expression == DW_byte_code) {
              a->regrules[reg].Expression(cptr,ecptr);
              if(coda_debug)
              printf("  DW_CFA_expression reg(%lu) len(%lu)\n"
                                                               ,reg, length);
            } else {
              a->CFA.CFAExpression(cptr,ecptr); 
              if(coda_debug)
              printf("  DW_CFA_def_cfa_expression len(%lu)\n", length);
            }
            cptr = ecptr;
            break;
          }
          case DW_CFA_def_cfa_register:
          {
            uint64_t newreg;
            cptr = DecULEB128(cptr, &newreg); 
            a->CFA.CFANewReg(newreg);
            if(coda_debug)
            printf("  DW_CFA_def_cfa_register new_reg(%lu)\n",newreg);
            break;
          }
          case DW_CFA_advance_loc1:
          {
            uint64_t delta = *cptr++;
            uint64_t newpc = a->pc + delta * fi->cie_info->caf;
            if (fi->pc_to_match < newpc) 
              return;
            a->pc =  newpc;
            if(coda_debug)
            printf(" DW_CFA_advance_loc1 to %lx\n", a->pc);
            break;
          }
          case DW_CFA_advance_loc2:
          {
            uint64_t delta = *(unsigned short*)cptr;
            cptr += 2;
            uint64_t newpc = a->pc + delta * fi->cie_info->caf;
            if (fi->pc_to_match < newpc) 
              return;
            a->pc =  newpc;
            if(coda_debug)
            printf(" DW_CFA_advance_loc2 to %lx\n", a->pc);
            break;
          }
          case DW_CFA_advance_loc4:
          {
            uint64_t delta = *(unsigned int*)cptr;
            cptr += 4;
            uint64_t newpc = a->pc + delta * fi->cie_info->caf;
            if (fi->pc_to_match < newpc) 
              return;
            a->pc =  newpc;
            if(coda_debug)
            printf(" DW_CFA_advance_loc1 to %lx\n", a->pc);
            break;
          }
          case DW_CFA_undefined: 
          {
            uint64_t reg;
            cptr = DecULEB128(cptr, &reg);
            a->regrules[reg].Undefined();
            if(coda_debug)
            printf("  DW_CFA_undefined:\n");
            break;
          }
          case DW_CFA_same_value:
          {
            uint64_t reg;
            cptr = DecULEB128(cptr, &reg);
            a->regrules[reg].SameValue();
            if(coda_debug)
            printf("  DW_CFA_same_value:\n");
            break;
          }
          case DW_CFA_remember_state:
          {
            State *sr = new State;
            memcpy(&sr->CFA,&a->CFA,sizeof(CanonicalFrameAddr));
            memcpy(&sr->regrules,&a->regrules,sizeof(RegRules));
            StateStk.push(sr);
            if(coda_debug)
            printf("  DW_CFA_remember_state:\n");
            break;
          }
          case DW_CFA_restore_state:
          {

            if (!StateStk.empty()) {
              State *sr = StateStk.top();
              StateStk.pop();
              memcpy(&a->CFA,&sr->CFA,sizeof(CanonicalFrameAddr));
              memcpy(&a->regrules,&sr->regrules,sizeof(RegRules));
              delete sr;
            }
            if(coda_debug)
            printf("  DW_CFA_restore_state:\n");
            break;
          }
          case DW_CFA_register:
          {
            uint64_t freg;
            uint64_t sreg;
            cptr = DecULEB128(cptr, &freg); 
            cptr = DecULEB128(cptr, &sreg); 
            a->regrules[freg].Register(sreg);
            break;
          }
          case DW_CFA_val_offset:
          {
            uint64_t reg;
            uint64_t foff;
            cptr = DecULEB128(cptr, &reg); 
            cptr = DecULEB128(cptr, &foff); 
            a->regrules[reg].ValOffset(foff * fi->cie_info->daf);
            fprintf(stdout,"  DW_CFA_val_offset reg(%lu) factored off(%lu)\n",reg,foff);
            fprintf(stdout,"    offset rule => reg(%lu) at (CFA%+ld)\n",reg, (foff * fi->cie_info->daf) );
            break;
          }
          case DW_CFA_nop:
            if(coda_debug)
            printf("  DW_CFA_nop\n");
            break;
          default:
            fprintf(stdout,"Dwarf byte code not understood, BYTE CODE(0x%x)\n",DW_byte_code);
            break;
        }
      }
    }
  }
} 

FrameInfo* 
EHFrame::FindFrameInfo(uint64_t va)
{
  static std::map<ABSOff,UBYTE*> *map_ehfhdr = new std::map<ABSOff,UBYTE*>;

  ElfW(Phdr) * ehfhdr = FindEHFrameHdr(va);
  if (!ehfhdr) 
    return NULL; 
  ObjectEntry *oe = FindObjectEntry(va);

  off_t off2EHF = oe->phdr->p_offset + ehfhdr->p_offset;
  uint64_t vaEHF = oe->phdr->p_vaddr + ehfhdr->p_offset;

  UBYTE *ehfhdrmem;
 
  std::map<ABSOff,UBYTE*>::iterator iter = map_ehfhdr->find(off2EHF); 
  if(iter == map_ehfhdr->end()) { 

    ehfhdrmem = new UBYTE[ehfhdr->p_filesz];
    m_corefile >> File::Offset(off2EHF)
               >> File::Units(ehfhdr->p_filesz) >> ehfhdrmem; 
    (*map_ehfhdr)[off2EHF] = ehfhdrmem;
  } else {
    ehfhdrmem = iter->second;
  }

  UnwEHFrameHdr *uefh = (UnwEHFrameHdr*)ehfhdrmem;

  if (uefh->EHFramePtrEnc == (DW_EH_PE_pcrel|DW_EH_PE_sdata4)) 
  {
     int tmp = *(int*)((char*)ehfhdrmem + 4);
     EHFramePtr = tmp + (vaEHF + 4); 
  }

  unsigned fdecnt = 0;
  if (uefh->FDECountEnc == DW_EH_PE_udata4) 
  {
    fdecnt = *(unsigned*)((char*)ehfhdrmem + 4 + 4); 
  }
  else
    return NULL;

  FDETable *fdetbl;
  if (uefh->TableEnc == (DW_EH_PE_datarel|DW_EH_PE_sdata4))
  { 
    fdetbl = (FDETable*)((char*)ehfhdrmem + 4 + 4 + 4); 

    unsigned fde_start = 0;
    unsigned fde_end = fdecnt;
   
    uint64_t va_func;
    while ((fde_end - fde_start) > 1)  
    {
      unsigned mid = (fde_start + fde_end)/2;
      va_func = vaEHF + fdetbl[mid].InitialLocation;
      if (va < va_func)
        fde_end = mid;
      else
        fde_start = mid;
    }
   
    unsigned fde_entry =  (fde_start + fde_end) / 2;
    uint64_t va_fde =  vaEHF + fdetbl[fde_entry].FDEAddress;
    off_t off2fde = oe->phdr->p_offset + (va_fde - oe->phdr->p_vaddr);
    FrameInfo* fi = GetFrameInfo(off2fde, va_fde);
    if (va > fi->pc_end) {
      if (coda_debug)
      {
        std::cout << "FindFrameInfo: (va > fi->pc_end)\n";
      }
      return NULL;
    }
    return fi;
  }
  return NULL;
}

ElfW(Phdr) *
EHFrame::FindEHFrameHdr(uint64_t va)
{
  ObjectEntry *oe = FindObjectEntry(va);

  if (!oe) {
    return NULL;
  }

  static std::map<ABSOff,ElfW(Phdr)*> *map_ehframe = new std::map<ABSOff,ElfW(Phdr)*>;

  std::map<ABSOff,ElfW(Phdr)*>::iterator iter = map_ehframe->find(oe->phdr->p_offset);
  if (iter != map_ehframe->end()) {
    return iter->second;
  }

  ElfW(Ehdr) ehdr;
  m_corefile >> File::Offset(oe->phdr->p_offset) >> ehdr;

  if (!ElfHdr(ehdr))
  {
    return NULL;
  }
  
  m_corefile >> File::Offset(oe->phdr->p_offset + ehdr.e_phoff);

  ElfW(Phdr) * phdr_arr = new ElfW(Phdr)[ehdr.e_phnum];
  m_corefile >> File::Units(ehdr.e_phnum) >> phdr_arr;  

  for(int ndx = 0; ndx < ehdr.e_phnum; ndx++)
  {
    if (PT_GNU_EH_FRAME == phdr_arr[ndx].p_type) 
    {
      ElfW(Phdr) *ehfhdr = new ElfW(Phdr);
      memcpy(ehfhdr, &phdr_arr[ndx], sizeof(ElfW(Phdr)));
      delete [] phdr_arr;
      (*map_ehframe)[oe->phdr->p_offset] = ehfhdr;
      return ehfhdr;
    }
  }
  return NULL;
}

FrameInfo *
EHFrame::GetFrameInfo(off_t off2fde, uint64_t va_fde)
{

  static MapFrameInfo *map_fi = new MapFrameInfo;

  MapFrameInfo::iterator it = map_fi->find(off2fde);
  if (it != map_fi->end()) {
    return it->second; 
  }

  uint32_t tmp;
  uint64_t fde_len = 0;
  m_corefile >> File::Offset(off2fde) >> tmp;

  fde_len = tmp;

  bool _64bitdw = false;
  if (0xffffffffU == fde_len)
  {
    m_corefile >> fde_len;
    _64bitdw = true;
  }
 
  UBYTE *fde_mem_start;
  UBYTE *fde_mem;
  fde_mem_start = fde_mem = new UBYTE[fde_len]; 
  
  m_corefile >> File::Units(fde_len) >> fde_mem;

  off_t cie_off = _64bitdw?*(uint64_t*)fde_mem:*(uint32_t*)fde_mem; 

  fde_mem +=  (_64bitdw? 8 : 4);
 
  off_t off2cie  =  (off2fde + (_64bitdw? 12:4)) - cie_off;
  CIEInfo *cie_info = GetCIEInfo(off2cie);
  FrameInfo *fi = new FrameInfo;
  (*map_fi)[off2fde] = fi;
  fi->cie_info = cie_info;

  VirtualAddr fde_va;
  fde_va.va = va_fde;
  fde_va.adjust = (_64bitdw? 12:4) + (fde_mem - fde_mem_start);
  uint64_t pc_begin = DecodeFDEEnc(cie_info->fde_enc, &fde_mem, &fde_va);
  fde_va.va = pc_begin;
  fde_va.adjust = 0;
  uint64_t pc_end = DecodeFDEEnc(cie_info->fde_enc, &fde_mem, &fde_va);

  fi->pc = pc_begin;
  fi->pc_end = pc_end;

  uint64_t aug_len;
  fde_mem = DecULEB128(fde_mem, &aug_len); 
 
  fde_mem += aug_len; 

  fi->fde_ins = fde_mem;
  fi->fde_ins_end = fde_mem_start + fde_len;
  
  return fi;
}

CIEInfo* 
EHFrame::GetCIEInfo(off_t off2cie)
{
  static MapCIEInfo *map_cie = new MapCIEInfo;

  MapCIEInfo::iterator it = map_cie->find(off2cie);
  if (it != map_cie->end()) {
   
    return it->second; 
  }
  
  uint32_t tmp;
  uint64_t cie_len = 0;
  m_corefile >> File::Offset(off2cie) >> tmp;
  cie_len = tmp;

  if (0xffffffffU == cie_len)
  {
    m_corefile >> cie_len;
  }

  UBYTE *cie_start;
  cie_start = new UBYTE[cie_len]; 
  m_corefile >> File::Units(cie_len) >> cie_start;

  int cie_ver = *(UBYTE*)(cie_start+4);
  
  const char * aug_str =(const char* )cie_start + 4 + 1;
 
  uint64_t caf; 
  int64_t daf; 

  UBYTE * cptr = cie_start + 5 + strlen(aug_str) + 1;

  cptr = DecULEB128(cptr, &caf); 
  cptr = DecSLEB128(cptr, &daf); 

  uint64_t rar;
  rar = (cie_ver == 1) ? *cptr++: (cptr=DecULEB128(cptr,&rar),rar);
  
  uint64_t aug_data_len;
  UBYTE fde_enc;
  bool signal_handler_frame = false;
  if ( *aug_str == 'z' ) 
  {
    cptr = DecULEB128(cptr, &aug_data_len); 
  
    UBYTE *dcptr = cptr; 
    while(*aug_str != '\0')
    {
      if (*aug_str == 'R') {
        fde_enc = *dcptr++;
      } else if (*aug_str == 'P') {
          UBYTE p_size = getSize(*dcptr++);
          dcptr += p_size;
      } else if(*aug_str == 'L') {
        ++dcptr;
      } else if (*aug_str == 'S') {
        signal_handler_frame = true;
      }
      ++aug_str;
    }
  } else 
  {
    std::cerr << "Don't know how to proceed further\n";
    exit (1);
  }

  cptr += aug_data_len; 

  UBYTE *cie_end = cie_start + cie_len;

  CIEInfo *cie_info = new CIEInfo;
  (*map_cie)[off2cie] = cie_info;

  cie_info->caf = caf;
  cie_info->daf = daf;
  cie_info->rar = rar;
  cie_info->is_signal_handler = signal_handler_frame;
  cie_info->fde_enc = fde_enc;
  cie_info->cie_ins = cptr;
  cie_info->cie_ins_end = cie_end;
  return cie_info;
}

uint64_t 
EHFrame::DecodeFDEEnc(UBYTE enc, UBYTE **cptr, VirtualAddr* fde_va)
{

  uint64_t value;
  switch (enc & 0xf)
  {
    case DW_EH_PE_absptr:
      if (m_co->CoreHdr().e_ident[EI_CLASS] == ELFCLASS32)
      {
        value = *(uint32_t *)(*cptr);
        *cptr += 4; 
      }
      else 
      {
        value = *(uint64_t *)(*cptr);
        *cptr += 8; 
      }
 
      break; 
    case DW_EH_PE_uleb128:
      *cptr = DecULEB128(*cptr, &value); 
      break; 
    case DW_EH_PE_udata2: 
      value = *(uint16_t *)(*cptr);
      *cptr += 2;
      break; 
    case DW_EH_PE_udata4:  
      value = *(uint32_t *)(*cptr);
      *cptr += 4;
      break; 
    case DW_EH_PE_udata8:  
      value = *(uint64_t *)(*cptr);
      *cptr += 8;
      break; 
    case DW_EH_PE_sleb128: 
      int64_t svalue;
      *cptr = DecSLEB128(*cptr, &svalue); 
      value = svalue;
      break; 
    case DW_EH_PE_sdata2 : 
      value = *(int16_t *)(*cptr);
      *cptr += 2;
      break; 
    case DW_EH_PE_sdata4:  
      value = *(int32_t *)(*cptr);
      *cptr += 4;
      break; 
    case DW_EH_PE_sdata8:  
      value = *(uint64_t *)(*cptr);
      *cptr += 8;
      break; 
  }

  switch(enc & 0xf0)
  {
    case DW_EH_PE_pcrel :  
      value += fde_va->va + fde_va->adjust;
      break; 
    case DW_EH_PE_datarel: 
      value += EHFramePtr;
  }
 
  return value; 
}

uint64_t CanonicalFrameAddr::CFA(Activation *a)
{

  uint64_t cfa;
  if (EXPR == cur_rule) {
    DWOpStk opstk;
    DwarfExpression(a,&opstk,cfi,end_cfi);
    cfa = opstk.top();
    opstk.pop();
  } else {
    cfa = a->regs[cur_reg] + cur_offset;
  }
  
  return cfa;
}

uint64_t RegisterRule::GetRegVal(Activation *a)
{
  uint64_t cfa; 
  uint64_t value; 

  switch(cur_rule)
  {
    case OFFSET:
    case VAL_OFFSET:
    {
      cfa = a->CFA.CFA(a);
      value = cfa + cur_off;
      if(OFFSET == cur_rule)
        return CoreObject::GetCoreObject().GetValueAtVA<uint64_t>(value);
      return value;
    }
    case REGISTER:
     return a->regs[cur_reg];
    case EXPR:
    case VAL_EXPR:
    {
      DWOpStk opstk;
      cfa = a->CFA.CFA(a);
      opstk.push(cfa); 
      DwarfExpression(a,&opstk,cfi,end_cfi);
      value = opstk.top();
      opstk.pop();
      if (EXPR == cur_rule) 
        return CoreObject::GetCoreObject().GetValueAtVA<uint64_t>(value);
      return value;
    }
    case ARCH:
      return -1;
  }
  return -1;
}

void DwarfExpression(Activation *a, DWOpStk *opstk, UBYTE *cptr, UBYTE *ecptr)
{

  while (cptr < ecptr)
  {
    UBYTE DW_byte_code = *cptr++;
    int64_t soff;
    uint64_t value;
    switch (DW_byte_code)
    {
     
      case DW_OP_deref:
        value = opstk->top();
        opstk->pop();
        opstk->push(CoreObject::GetCoreObject().GetValueAtVA<uint64_t>(value));
        break;
      case DW_OP_breg7:
      case DW_OP_breg16:
        cptr=DecSLEB128(cptr, &soff); 
        value = a->regs[DW_byte_code - DW_OP_breg0] + soff;
        opstk->push(value);
        if(coda_debug)
        printf("    DW_OP_breg%d %ld\n",DW_byte_code - DW_OP_breg0,soff);
        break;
      case DW_OP_lit3:
      case DW_OP_lit11:
      case DW_OP_lit15:
        fprintf(stdout,"    DW_OP_lit%d\n",DW_byte_code - DW_OP_lit0);
        break;
      case DW_OP_and:
        fprintf(stdout,"    DW_OP_and\n");
        break;
      case DW_OP_ge:
        fprintf(stdout,"    DW_OP_ge\n");
        break;
      case DW_OP_shl:
        fprintf(stdout,"    DW_OP_shl\n");
        break;
      case DW_OP_plus:
        fprintf(stdout,"    DW_OP_plus\n");
        break;
      default:
        fprintf(stdout,"Dwarf byte code not understood, BYTE CODE(0x%x)\n",DW_byte_code);
    }
  }
}

UBYTE 
EHFrame::getSize(UBYTE enc)
{
  switch (enc & 0xf)
  {
    case DW_EH_PE_absptr:
    case DW_EH_PE_sleb128: 
    case DW_EH_PE_uleb128:
      return m_co->CoreHdr().e_ident[EI_CLASS] == ELFCLASS32 ? 4 : 8;
    case DW_EH_PE_udata2: 
    case DW_EH_PE_sdata2 : 
      return 2;
    case DW_EH_PE_sdata4:  
    case DW_EH_PE_udata4:  
      return 4;
    case DW_EH_PE_udata8:  
    case DW_EH_PE_sdata8:  
      return 8;
  }
}