Zydis: Decoder

Zydis v4.1.0

Loading...
Searching...
No Matches
Topics | Functions
Decoder

Functions allowing decoding of instruction bytes to a machine interpretable struct. More...

## Topics
| CPU flags
| FPU flags

## Functions
ZYDIS_EXPORT ZyanStatus | ZydisDecoderInit (ZydisDecoder *decoder, ZydisMachineMode machine_mode, ZydisStackWidth stack_width)
| Initializes the given `ZydisDecoder` instance.
ZYDIS_EXPORT ZyanStatus | ZydisDecoderEnableMode (ZydisDecoder *decoder, ZydisDecoderMode mode, ZyanBool enabled)
| Enables or disables the specified decoder-mode.
ZYDIS_EXPORT ZyanStatus | ZydisDecoderDecodeFull (const ZydisDecoder *decoder, const void *buffer, ZyanUSize length, ZydisDecodedInstruction *instruction, ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT])
| Decodes the instruction in the given input `buffer` and returns all details (e.g.
ZYDIS_EXPORT ZyanStatus | ZydisDecoderDecodeInstruction (const ZydisDecoder *decoder, ZydisDecoderContext *context, const void *buffer, ZyanUSize length, ZydisDecodedInstruction *instruction)
| Decodes the instruction in the given input `buffer`.
ZYDIS_EXPORT ZyanStatus | ZydisDecoderDecodeOperands (const ZydisDecoder *decoder, const ZydisDecoderContext *context, const ZydisDecodedInstruction *instruction, ZydisDecodedOperand *operands, ZyanU8 operand_count)
| Decodes the instruction operands.

## Detailed Description

Functions allowing decoding of instruction bytes to a machine interpretable struct.

## Function Documentation

## ◆ ZydisDecoderDecodeFull()

ZYDIS_EXPORT ZyanStatus ZydisDecoderDecodeFull | ( | const ZydisDecoder * | decoder,
|  | const void * | buffer,
|  | ZyanUSize | length,
|  | ZydisDecodedInstruction * | instruction,
|  | ZydisDecodedOperand | operands[ZYDIS_MAX_OPERAND_COUNT] )

Decodes the instruction in the given input `buffer` and returns all details (e.g.

operands).

Parameters

  decoder | A pointer to the `ZydisDecoder` instance.
  buffer | A pointer to the input buffer.
  length | The length of the input buffer. Note that this can be bigger than the actual size of the instruction – you don't have to know the size up front. This length is merely used to prevent Zydis from doing out-of-bounds reads on your buffer.
  instruction | A pointer to the `ZydisDecodedInstruction` struct receiving the details about the decoded instruction.
  operands | A pointer to an array with `ZYDIS_MAX_OPERAND_COUNT` entries that receives the decoded operands. The number of operands decoded is determined by the `instruction.operand_count` field. Excess entries are zeroed.

This is a convenience function that combines the following functions into one call:

- `ZydisDecoderDecodeInstruction`
- `ZydisDecoderDecodeOperands`

Please refer to `ZydisDecoderDecodeInstruction` if operand decoding is not required or should be done separately (`ZydisDecoderDecodeOperands`).

This function is not available in MINIMAL_MODE.

Returns
  A zyan status code.

## ◆ ZydisDecoderDecodeInstruction()

ZYDIS_EXPORT ZyanStatus ZydisDecoderDecodeInstruction | ( | const ZydisDecoder * | decoder,
|  | ZydisDecoderContext * | context,
|  | const void * | buffer,
|  | ZyanUSize | length,
|  | ZydisDecodedInstruction * | instruction )

Decodes the instruction in the given input `buffer`.

Parameters

  decoder | A pointer to the `ZydisDecoder` instance.
  context | A pointer to a decoder context struct which is required for further decoding (e.g. operand decoding using `ZydisDecoderDecodeOperands`) or `ZYAN_NULL` if not needed.
  buffer | A pointer to the input buffer.
  length | The length of the input buffer. Note that this can be bigger than the actual size of the instruction – you don't have to know the size up front. This length is merely used to prevent Zydis from doing out-of-bounds reads on your buffer.
  instruction | A pointer to the `ZydisDecodedInstruction` struct, that receives the details about the decoded instruction.

Returns
  A zyan status code.

## ◆ ZydisDecoderDecodeOperands()

ZYDIS_EXPORT ZyanStatus ZydisDecoderDecodeOperands | ( | const ZydisDecoder * | decoder,
|  | const ZydisDecoderContext * | context,
|  | const ZydisDecodedInstruction * | instruction,
|  | ZydisDecodedOperand * | operands,
|  | ZyanU8 | operand_count )

Decodes the instruction operands.

Parameters

  decoder | A pointer to the `ZydisDecoder` instance.
  context | A pointer to the `ZydisDecoderContext` struct.
  instruction | A pointer to the `ZydisDecodedInstruction` struct.
  operands | The array that receives the decoded operands. Refer to `ZYDIS_MAX_OPERAND_COUNT` or `ZYDIS_MAX_OPERAND_COUNT_VISIBLE` when allocating space for the array to ensure that the buffer size is sufficient to always fit all instruction operands. Refer to `instruction.operand_count` or ‘instruction.operand_count_visible’ when allocating space for the array to ensure that the buffer size is sufficient to fit all operands of the given instruction.
  operand_count | The length of the `operands` array. This argument as well limits the maximum amount of operands to decode. If this value is `0`, no operands will be decoded and `ZYAN_NULL` will be accepted for the `operands` argument.

This function fails, if `operand_count` is larger than the total number of operands for the given instruction (`instruction.operand_count`).

This function is not available in MINIMAL_MODE.

Returns
  A zyan status code.

## ◆ ZydisDecoderEnableMode()

ZYDIS_EXPORT ZyanStatus ZydisDecoderEnableMode | ( | ZydisDecoder * | decoder,
|  | ZydisDecoderMode | mode,
|  | ZyanBool | enabled )

Enables or disables the specified decoder-mode.

Parameters

  decoder | A pointer to the `ZydisDecoder` instance.
  mode | The decoder mode.
  enabled | `ZYAN_TRUE` to enable, or `ZYAN_FALSE` to disable the specified decoder-mode.

Returns
  A zyan status code.

## ◆ ZydisDecoderInit()

ZYDIS_EXPORT ZyanStatus ZydisDecoderInit | ( | ZydisDecoder * | decoder,
|  | ZydisMachineMode | machine_mode,
|  | ZydisStackWidth | stack_width )

Initializes the given `ZydisDecoder` instance.

Parameters

  decoder | A pointer to the `ZydisDecoder` instance.
  machine_mode | The machine mode.
  stack_width | The stack width.

Returns
  A zyan status code.