The x64 Exception Handling display shows the all the exception handling data in the x64 PE file. These are RUNTIME_FUNCTION records.
x86 PE files handle exceptions using a different technique, as such there is no corresponding data in an x86 PE file. This display is not available when working with a 32 bit (x86) PE file.
Each line of the grid displays the following information. If you expand the entry you can see the codes used for that exception handler.
#
The index of the RUNTIME_FUNCTION in the PE file.
Function
The name of the function this RUNTIME_FUNCTION relates to
This value is only populated if debug information can be read for this PE file.
Filename
The filename of the function this RUNTIME_FUNCTION relates to
This value is only populated if debug information can be read for this PE file.
Line
The line number of the function this RUNTIME_FUNCTION relates to
This value is only populated if debug information can be read for this PE file.
Begin
The relative virtual address of the start of the area affected by the exception handler.
End
The relative virtual address of the end of the area affected by the exception handler.
Unwind
The relative virtual address of the unwind data for the exception handler.
Version
The version format of the exception handling data
Flags
Flags that indicate how what this exception handler is.
Valid values are:
•Exception Handler
•Termination Handler
•Chained unwind info
Prolog
Size of the function prologue.
Frame Reg
The name of frame register.
Frame Offset
The offset for the frame.
Codes
The number of codes used by this exception handler.
Except RVA
The relative virtual address of the exception handler.
