Zydis v4.1.1

Loading...
Searching...
No Matches
Formatter

Functions allowing formatting of previously decoded instructions to human readable text. More...

## Functions
ZYDIS_EXPORT ZyanStatus | ZydisFormatterInit (ZydisFormatter *formatter, ZydisFormatterStyle style)
| Initializes the given ZydisFormatter instance.
ZYDIS_EXPORT ZyanStatus | ZydisFormatterSetProperty (ZydisFormatter *formatter, ZydisFormatterProperty property, ZyanUPointer value)
| Changes the value of the specified formatter property.
ZYDIS_EXPORT ZyanStatus | ZydisFormatterSetHook (ZydisFormatter *formatter, ZydisFormatterFunction type, const void **callback)
| Replaces a formatter function with a custom callback and/or retrieves the currently used function.
ZYDIS_EXPORT ZyanStatus | ZydisFormatterFormatInstruction (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operands, ZyanU8 operand_count, char *buffer, ZyanUSize length, ZyanU64 runtime_address, void *user_data)
| Formats the given instruction and writes it into the output buffer.
ZYDIS_EXPORT ZyanStatus | ZydisFormatterFormatOperand (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operand, char *buffer, ZyanUSize length, ZyanU64 runtime_address, void *user_data)
| Formats the given operand and writes it into the output buffer.
ZYDIS_EXPORT ZyanStatus | ZydisFormatterTokenizeInstruction (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operands, ZyanU8 operand_count, void *buffer, ZyanUSize length, ZyanU64 runtime_address, ZydisFormatterTokenConst **token, void *user_data)
| Tokenizes the given instruction and writes it into the output buffer.
ZYDIS_EXPORT ZyanStatus | ZydisFormatterTokenizeOperand (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operand, void *buffer, ZyanUSize length, ZyanU64 runtime_address, ZydisFormatterTokenConst **token, void *user_data)
| Tokenizes the given operand and writes it into the output buffer.

## Detailed Description

Functions allowing formatting of previously decoded instructions to human readable text.

## Function Documentation

## ◆ ZydisFormatterFormatInstruction()

ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatInstruction | ( | const ZydisFormatter * | formatter,
|  | const ZydisDecodedInstruction * | instruction,
|  | const ZydisDecodedOperand * | operands,
|  | ZyanU8 | operand_count,
|  | char * | buffer,
|  | ZyanUSize | length,
|  | ZyanU64 | runtime_address,
|  | void * | user_data )

Formats the given instruction and writes it into the output buffer.

Parameters

  formatter | A pointer to the ZydisFormatter instance.
  instruction | A pointer to the ZydisDecodedInstruction struct.
  operands | A pointer to the decoded operands array.
  operand_count | The length of the operands array. Must be equal to or greater than the value of instruction->operand_count_visible.
  buffer | A pointer to the output buffer.
  length | The length of the output buffer (in characters).
  runtime_address | The runtime address of the instruction or ZYDIS_RUNTIME_ADDRESS_NONE to print relative addresses.
  user_data | A pointer to user-defined data which can be used in custom formatter callbacks. Can be ZYAN_NULL.

Returns
  A zyan status code.

## ◆ ZydisFormatterFormatOperand()

ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatOperand | ( | const ZydisFormatter * | formatter,
|  | const ZydisDecodedInstruction * | instruction,
|  | const ZydisDecodedOperand * | operand,
|  | char * | buffer,
|  | ZyanUSize | length,
|  | ZyanU64 | runtime_address,
|  | void * | user_data )

Formats the given operand and writes it into the output buffer.

Parameters

  formatter | A pointer to the ZydisFormatter instance.
  instruction | A pointer to the ZydisDecodedInstruction struct.
  operand | A pointer to the ZydisDecodedOperand struct of the operand to format.
  buffer | A pointer to the output buffer.
  length | The length of the output buffer (in characters).
  runtime_address | The runtime address of the instruction or ZYDIS_RUNTIME_ADDRESS_NONE to print relative addresses.
  user_data | A pointer to user-defined data which can be used in custom formatter callbacks. Can be ZYAN_NULL.

Returns
  A zyan status code.

Use ZydisFormatterFormatInstruction or ZydisFormatterFormatInstructionEx to format a complete instruction.

## ◆ ZydisFormatterInit()

ZYDIS_EXPORT ZyanStatus ZydisFormatterInit | ( | ZydisFormatter * | formatter,
|  | ZydisFormatterStyle | style )

Initializes the given ZydisFormatter instance.

Parameters

  formatter | A pointer to the ZydisFormatter instance.
  style | The base formatter style (either AT&T or Intel style).

Returns
  A zyan status code.

## ◆ ZydisFormatterSetHook()

ZYDIS_EXPORT ZyanStatus ZydisFormatterSetHook | ( | ZydisFormatter * | formatter,
|  | ZydisFormatterFunction | type,
|  | const void ** | callback )

Replaces a formatter function with a custom callback and/or retrieves the currently used function.

Parameters

  formatter | A pointer to the ZydisFormatter instance.
  type | The formatter function-type.
  callback | A pointer to a variable that contains the pointer of the callback function and receives the pointer of the currently used function.

Returns
  A zyan status code.

Call this function with callback pointing to a ZYAN_NULL value to retrieve the currently used function without replacing it.

This function returns ZYAN_STATUS_INVALID_OPERATION if a function can't be replaced for the current formatter-style.

## ◆ ZydisFormatterSetProperty()

ZYDIS_EXPORT ZyanStatus ZydisFormatterSetProperty | ( | ZydisFormatter * | formatter,
|  | ZydisFormatterProperty | property,
|  | ZyanUPointer | value )

Changes the value of the specified formatter property.

Parameters

  formatter | A pointer to the ZydisFormatter instance.
  property | The id of the formatter-property.
  value | The new value.

Returns
  A zyan status code.

This function returns ZYAN_STATUS_INVALID_OPERATION if a property can't be changed for the current formatter-style.

## ◆ ZydisFormatterTokenizeInstruction()

ZYDIS_EXPORT ZyanStatus ZydisFormatterTokenizeInstruction | ( | const ZydisFormatter * | formatter,
|  | const ZydisDecodedInstruction * | instruction,
|  | const ZydisDecodedOperand * | operands,
|  | ZyanU8 | operand_count,
|  | void * | buffer,
|  | ZyanUSize | length,
|  | ZyanU64 | runtime_address,
|  | ZydisFormatterTokenConst ** | token,
|  | void * | user_data )

Tokenizes the given instruction and writes it into the output buffer.

Parameters

  formatter | A pointer to the ZydisFormatter instance.
  instruction | A pointer to the ZydisDecodedInstruction struct.
  operands | A pointer to the decoded operands array.
  operand_count | The length of the operands array. Must be equal to or greater than the value of instruction->operand_count_visible.
  buffer | A pointer to the output buffer.
  length | The length of the output buffer (in bytes).
  runtime_address | The runtime address of the instruction or ZYDIS_RUNTIME_ADDRESS_NONE to print relative addresses.
  token | Receives a pointer to the first token in the output buffer.
  user_data | A pointer to user-defined data which can be used in custom formatter callbacks. Can be ZYAN_NULL.

Returns
  A zyan status code.

## ◆ ZydisFormatterTokenizeOperand()

ZYDIS_EXPORT ZyanStatus ZydisFormatterTokenizeOperand | ( | const ZydisFormatter * | formatter,
|  | const ZydisDecodedInstruction * | instruction,
|  | const ZydisDecodedOperand * | operand,
|  | void * | buffer,
|  | ZyanUSize | length,
|  | ZyanU64 | runtime_address,
|  | ZydisFormatterTokenConst ** | token,
|  | void * | user_data )

Tokenizes the given operand and writes it into the output buffer.

Parameters

  formatter | A pointer to the ZydisFormatter instance.
  instruction | A pointer to the ZydisDecodedInstruction struct.
  operand | A pointer to the ZydisDecodedOperand struct of the operand to format.
  buffer | A pointer to the output buffer.
  length | The length of the output buffer (in bytes).
  runtime_address | The runtime address of the instruction or ZYDIS_RUNTIME_ADDRESS_NONE to print relative addresses.
  token | Receives a pointer to the first token in the output buffer.
  user_data | A pointer to user-defined data which can be used in custom formatter callbacks. Can be ZYAN_NULL.

Returns
  A zyan status code.

Use ZydisFormatterTokenizeInstruction to tokenize a complete instruction.