Zydis v4.1.1

Loading...
Searching...
No Matches
Disassembler.h File Reference

All-in-one convenience function providing the simplest possible way to use Zydis. More...

`#include <Zydis/Decoder.h>`
`#include <Zydis/Formatter.h>`

Go to the source code of this file.

## Data Structures
struct | ZydisDisassembledInstruction_
| All commonly used information about a decoded instruction that Zydis can provide. More...

## Typedefs
typedef struct ZydisDisassembledInstruction_ | ZydisDisassembledInstruction
| All commonly used information about a decoded instruction that Zydis can provide.

## Functions
ZYDIS_EXPORT ZyanStatus | ZydisDisassembleIntel (ZydisMachineMode machine_mode, ZyanU64 runtime_address, const void *buffer, ZyanUSize length, ZydisDisassembledInstruction *instruction)
| Disassemble an instruction and format it to human-readable text in a single step (Intel syntax).
ZYDIS_EXPORT ZyanStatus | ZydisDisassembleATT (ZydisMachineMode machine_mode, ZyanU64 runtime_address, const void *buffer, ZyanUSize length, ZydisDisassembledInstruction *instruction)
| Disassemble an instruction and format it to human-readable text in a single step (AT&T syntax).

## Detailed Description

All-in-one convenience function providing the simplest possible way to use Zydis.

## Typedef Documentation

## ◆ ZydisDisassembledInstruction

typedef struct ZydisDisassembledInstruction_ ZydisDisassembledInstruction

All commonly used information about a decoded instruction that Zydis can provide.

This structure is filled in by calling ZydisDisassembleIntel or ZydisDisassembleATT.

## Function Documentation

## ◆ ZydisDisassembleATT()

ZYDIS_EXPORT ZyanStatus ZydisDisassembleATT | ( | ZydisMachineMode | machine_mode,
|  | ZyanU64 | runtime_address,
|  | const void * | buffer,
|  | ZyanUSize | length,
|  | ZydisDisassembledInstruction * | instruction )

Disassemble an instruction and format it to human-readable text in a single step (AT&T syntax).

Parameters

  machine_mode | The machine mode to assume when disassembling. When in doubt, pass ZYDIS_MACHINE_MODE_LONG_64 for what is typically referred to as "64-bit mode" or ZYDIS_MACHINE_MODE_LEGACY_32 for "32-bit mode".
  runtime_address | The program counter (eip / rip) to assume when formatting the instruction. Many instructions behave differently depending on the address they are located at.
  buffer | A pointer to the raw instruction bytes that you wish to decode.
  length | The length of the input buffer. Note that this can be bigger than the actual size of the instruction – you don't have to know the size up front. This length is merely used to prevent Zydis from doing out-of-bounds reads on your buffer.
  instruction | A pointer to receive the decoded instruction information. Can be uninitialized and reused on later calls.

This is a convenience function intended as a quick path for getting started with using Zydis. It internally calls a range of other more advanced functions to obtain all commonly needed information about the instruction. It is likely that you won't need most of this information in practice, so it is advisable to instead call these more advanced functions directly if you're concerned about performance.

This function essentially combines the following more advanced functions into a single call:

- ZydisDecoderInit
- ZydisDecoderDecodeInstruction
- ZydisDecoderDecodeOperands
- ZydisFormatterInit
- ZydisFormatterFormatInstruction

Returns
  A zyan status code.

## ◆ ZydisDisassembleIntel()

ZYDIS_EXPORT ZyanStatus ZydisDisassembleIntel | ( | ZydisMachineMode | machine_mode,
|  | ZyanU64 | runtime_address,
|  | const void * | buffer,
|  | ZyanUSize | length,
|  | ZydisDisassembledInstruction * | instruction )

Disassemble an instruction and format it to human-readable text in a single step (Intel syntax).

Parameters

  machine_mode | The machine mode to assume when disassembling. When in doubt, pass ZYDIS_MACHINE_MODE_LONG_64 for what is typically referred to as "64-bit mode" or ZYDIS_MACHINE_MODE_LEGACY_32 for "32-bit mode".
  runtime_address | The program counter (eip / rip) to assume when formatting the instruction. Many instructions behave differently depending on the address they are located at.
  buffer | A pointer to the raw instruction bytes that you wish to decode.
  length | The length of the input buffer. Note that this can be bigger than the actual size of the instruction – you don't have to know the size up front. This length is merely used to prevent Zydis from doing out-of-bounds reads on your buffer.
  instruction | A pointer to receive the decoded instruction information. Can be uninitialized and reused on later calls.

This is a convenience function intended as a quick path for getting started with using Zydis. It internally calls a range of other more advanced functions to obtain all commonly needed information about the instruction. It is likely that you won't need most of this information in practice, so it is advisable to instead call these more advanced functions directly if you're concerned about performance.

This function essentially combines the following more advanced functions into a single call:

- ZydisDecoderInit
- ZydisDecoderDecodeInstruction
- ZydisDecoderDecodeOperands
- ZydisFormatterInit
- ZydisFormatterFormatInstruction

Returns
  A zyan status code.