Zydis v4.1.1

Loading...
Searching...
No Matches
Utils

Miscellaneous utility functions. More...

## Functions
ZYDIS_EXPORT ZyanStatus | ZydisCalcAbsoluteAddress (const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operand, ZyanU64 runtime_address, ZyanU64 *result_address)
| Calculates the absolute address value for the given instruction operand.
ZYDIS_EXPORT ZyanStatus | ZydisCalcAbsoluteAddressEx (const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operand, ZyanU64 runtime_address, const ZydisRegisterContext *register_context, ZyanU64 *result_address)
| Calculates the absolute address value for the given instruction operand.

## Detailed Description

Miscellaneous utility functions.

Address translation and other helpers.

## Function Documentation

## ◆ ZydisCalcAbsoluteAddress()

ZYDIS_EXPORT ZyanStatus ZydisCalcAbsoluteAddress | ( | const ZydisDecodedInstruction * | instruction,
|  | const ZydisDecodedOperand * | operand,
|  | ZyanU64 | runtime_address,
|  | ZyanU64 * | result_address )

Calculates the absolute address value for the given instruction operand.

Parameters

  instruction | A pointer to the ZydisDecodedInstruction struct.
  operand | A pointer to the ZydisDecodedOperand struct.
  runtime_address | The runtime address of the instruction.
  result_address | A pointer to the memory that receives the absolute address.

Returns
  A zyan status code.

You should use this function in the following cases:

- IMM operands with relative address (e.g. JMP, CALL, ...)
- MEM operands with RIP/EIP-relative address (e.g. MOV RAX, [RIP+0x12345678])
- MEM operands with absolute address (e.g. MOV RAX, [0x12345678])
  - The displacement needs to get truncated and zero extended

## ◆ ZydisCalcAbsoluteAddressEx()

ZYDIS_EXPORT ZyanStatus ZydisCalcAbsoluteAddressEx | ( | const ZydisDecodedInstruction * | instruction,
|  | const ZydisDecodedOperand * | operand,
|  | ZyanU64 | runtime_address,
|  | const ZydisRegisterContext * | register_context,
|  | ZyanU64 * | result_address )

Calculates the absolute address value for the given instruction operand.

Parameters

  instruction | A pointer to the ZydisDecodedInstruction struct.
  operand | A pointer to the ZydisDecodedOperand struct.
  runtime_address | The runtime address of the instruction.
  register_context | A pointer to the ZydisRegisterContext struct.
  result_address | A pointer to the memory that receives the absolute target-address.

Returns
  A zyan status code.

This function behaves like ZydisCalcAbsoluteAddress but takes an additional register-context argument to allow calculation of addresses depending on runtime register values.

Note that IP/EIP/RIP from the register-context will be ignored in favor of the passed runtime-address.