Zydis: Formatter

Zydis v4.1.0

Loading...
Searching...
No Matches
Functions
Formatter

Functions allowing formatting of previously decoded instructions to human readable text. More...

## Functions
ZYDIS_EXPORT ZyanStatus | ZydisFormatterInit (ZydisFormatter *formatter, ZydisFormatterStyle style)
| Initializes the given `ZydisFormatter` instance.
ZYDIS_EXPORT ZyanStatus | ZydisFormatterSetProperty (ZydisFormatter *formatter, ZydisFormatterProperty property, ZyanUPointer value)
| Changes the value of the specified formatter `property`.
ZYDIS_EXPORT ZyanStatus | ZydisFormatterSetHook (ZydisFormatter *formatter, ZydisFormatterFunction type, const void **callback)
| Replaces a formatter function with a custom callback and/or retrieves the currently used function.
ZYDIS_EXPORT ZyanStatus | ZydisFormatterFormatInstruction (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operands, ZyanU8 operand_count, char *buffer, ZyanUSize length, ZyanU64 runtime_address, void *user_data)
| Formats the given instruction and writes it into the output buffer.
ZYDIS_EXPORT ZyanStatus | ZydisFormatterFormatOperand (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operand, char *buffer, ZyanUSize length, ZyanU64 runtime_address, void *user_data)
| Formats the given operand and writes it into the output buffer.
ZYDIS_EXPORT ZyanStatus | ZydisFormatterTokenizeInstruction (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operands, ZyanU8 operand_count, void *buffer, ZyanUSize length, ZyanU64 runtime_address, ZydisFormatterTokenConst **token, void *user_data)
| Tokenizes the given instruction and writes it into the output buffer.
ZYDIS_EXPORT ZyanStatus | ZydisFormatterTokenizeOperand (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operand, void *buffer, ZyanUSize length, ZyanU64 runtime_address, ZydisFormatterTokenConst **token, void *user_data)
| Tokenizes the given operand and writes it into the output buffer.

## Detailed Description

Functions allowing formatting of previously decoded instructions to human readable text.

## Function Documentation

## ◆ ZydisFormatterFormatInstruction()

ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatInstruction | ( | const ZydisFormatter * | formatter,
|  | const ZydisDecodedInstruction * | instruction,
|  | const ZydisDecodedOperand * | operands,
|  | ZyanU8 | operand_count,
|  | char * | buffer,
|  | ZyanUSize | length,
|  | ZyanU64 | runtime_address,
|  | void * | user_data )

Formats the given instruction and writes it into the output buffer.

Parameters

  formatter | A pointer to the `ZydisFormatter` instance.
  instruction | A pointer to the `ZydisDecodedInstruction` struct.
  operands | A pointer to the decoded operands array.
  operand_count | The length of the `operands` array. Must be equal to or greater than the value of `instruction->operand_count_visible`.
  buffer | A pointer to the output buffer.
  length | The length of the output buffer (in characters).
  runtime_address | The runtime address of the instruction or `ZYDIS_RUNTIME_ADDRESS_NONE` to print relative addresses.
  user_data | A pointer to user-defined data which can be used in custom formatter callbacks. Can be `ZYAN_NULL`.

Returns
  A zyan status code.

## ◆ ZydisFormatterFormatOperand()

ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatOperand | ( | const ZydisFormatter * | formatter,
|  | const ZydisDecodedInstruction * | instruction,
|  | const ZydisDecodedOperand * | operand,
|  | char * | buffer,
|  | ZyanUSize | length,
|  | ZyanU64 | runtime_address,
|  | void * | user_data )

Formats the given operand and writes it into the output buffer.

Parameters

  formatter | A pointer to the `ZydisFormatter` instance.
  instruction | A pointer to the `ZydisDecodedInstruction` struct.
  operand | A pointer to the `ZydisDecodedOperand` struct of the operand to format.
  buffer | A pointer to the output buffer.
  length | The length of the output buffer (in characters).
  runtime_address | The runtime address of the instruction or `ZYDIS_RUNTIME_ADDRESS_NONE` to print relative addresses.
  user_data | A pointer to user-defined data which can be used in custom formatter callbacks. Can be `ZYAN_NULL`.

Returns
  A zyan status code.

Use `ZydisFormatterFormatInstruction` or `ZydisFormatterFormatInstructionEx` to format a complete instruction.

## ◆ ZydisFormatterInit()

ZYDIS_EXPORT ZyanStatus ZydisFormatterInit | ( | ZydisFormatter * | formatter,
|  | ZydisFormatterStyle | style )

Initializes the given `ZydisFormatter` instance.

Parameters

  formatter | A pointer to the `ZydisFormatter` instance.
  style | The base formatter style (either `AT&T` or `Intel` style).

Returns
  A zyan status code.

## ◆ ZydisFormatterSetHook()

ZYDIS_EXPORT ZyanStatus ZydisFormatterSetHook | ( | ZydisFormatter * | formatter,
|  | ZydisFormatterFunction | type,
|  | const void ** | callback )

Replaces a formatter function with a custom callback and/or retrieves the currently used function.

Parameters

  formatter | A pointer to the `ZydisFormatter` instance.
  type | The formatter function-type.
  callback | A pointer to a variable that contains the pointer of the callback function and receives the pointer of the currently used function.

Returns
  A zyan status code.

Call this function with `callback` pointing to a `ZYAN_NULL` value to retrieve the currently used function without replacing it.

This function returns `ZYAN_STATUS_INVALID_OPERATION` if a function can't be replaced for the current formatter-style.

## ◆ ZydisFormatterSetProperty()

ZYDIS_EXPORT ZyanStatus ZydisFormatterSetProperty | ( | ZydisFormatter * | formatter,
|  | ZydisFormatterProperty | property,
|  | ZyanUPointer | value )

Changes the value of the specified formatter `property`.

Parameters

  formatter | A pointer to the `ZydisFormatter` instance.
  property | The id of the formatter-property.
  value | The new value.

Returns
  A zyan status code.

This function returns `ZYAN_STATUS_INVALID_OPERATION` if a property can't be changed for the current formatter-style.

## ◆ ZydisFormatterTokenizeInstruction()

ZYDIS_EXPORT ZyanStatus ZydisFormatterTokenizeInstruction | ( | const ZydisFormatter * | formatter,
|  | const ZydisDecodedInstruction * | instruction,
|  | const ZydisDecodedOperand * | operands,
|  | ZyanU8 | operand_count,
|  | void * | buffer,
|  | ZyanUSize | length,
|  | ZyanU64 | runtime_address,
|  | ZydisFormatterTokenConst ** | token,
|  | void * | user_data )

Tokenizes the given instruction and writes it into the output buffer.

Parameters

  formatter | A pointer to the `ZydisFormatter` instance.
  instruction | A pointer to the `ZydisDecodedInstruction` struct.
  operands | A pointer to the decoded operands array.
  operand_count | The length of the `operands` array. Must be equal to or greater than the value of `instruction->operand_count_visible`.
  buffer | A pointer to the output buffer.
  length | The length of the output buffer (in bytes).
  runtime_address | The runtime address of the instruction or `ZYDIS_RUNTIME_ADDRESS_NONE` to print relative addresses.
  token | Receives a pointer to the first token in the output buffer.
  user_data | A pointer to user-defined data which can be used in custom formatter callbacks. Can be `ZYAN_NULL`.

Returns
  A zyan status code.

## ◆ ZydisFormatterTokenizeOperand()

ZYDIS_EXPORT ZyanStatus ZydisFormatterTokenizeOperand | ( | const ZydisFormatter * | formatter,
|  | const ZydisDecodedInstruction * | instruction,
|  | const ZydisDecodedOperand * | operand,
|  | void * | buffer,
|  | ZyanUSize | length,
|  | ZyanU64 | runtime_address,
|  | ZydisFormatterTokenConst ** | token,
|  | void * | user_data )

Tokenizes the given operand and writes it into the output buffer.

Parameters

  formatter | A pointer to the `ZydisFormatter` instance.
  instruction | A pointer to the `ZydisDecodedInstruction` struct.
  operand | A pointer to the `ZydisDecodedOperand` struct of the operand to format.
  buffer | A pointer to the output buffer.
  length | The length of the output buffer (in bytes).
  runtime_address | The runtime address of the instruction or `ZYDIS_RUNTIME_ADDRESS_NONE` to print relative addresses.
  token | Receives a pointer to the first token in the output buffer.
  user_data | A pointer to user-defined data which can be used in custom formatter callbacks. Can be `ZYAN_NULL`.

Returns
  A zyan status code.

Use `ZydisFormatterTokenizeInstruction` to tokenize a complete instruction.