ZydisDecodedInstruction_ Struct Reference

Defines the ZydisDecodedInstruction struct. More...

#include <DecoderTypes.h>

Collaboration diagram for ZydisDecodedInstruction_:

Data Fields
ZydisMachineMode	machineMode
	The machine mode used to decode this instruction. More...
ZydisMnemonic	mnemonic
	The instruction-mnemonic. More...
uint8_t	length
	The length of the decoded instruction. More...
uint8_t	data [ZYDIS_MAX_INSTRUCTION_LENGTH]
	The raw bytes of the decoded instruction. More...
ZydisInstructionEncoding	encoding
	The instruction-encoding (default, 3DNow, VEX, EVEX, XOP). More...
ZydisOpcodeMap	opcodeMap
	The opcode-map. More...
uint8_t	opcode
	The instruction-opcode. More...
uint8_t	operandSize
	The effective operand size. More...
uint8_t	stackWidth
	The stack width. More...
uint8_t	addressWidth
	The effective address width. More...
uint8_t	operandCount
	The number of instruction-operands. More...
ZydisDecodedOperand	operands [ZYDIS_MAX_OPERAND_COUNT]
	Detailed info for all instruction operands. More...
ZydisInstructionAttributes	attributes
	Instruction attributes. More...
uint64_t	instrAddress
	The instruction address points at the current instruction (relative to the initial instruction pointer). More...
uint64_t	instrPointer
	The instruction pointer points at the address of the next instruction (relative to the initial instruction pointer). More...
struct {
ZydisCPUFlagAction   action
	The CPU-flag action. More...
}	flags [ZYDIS_CPUFLAG_ENUM_COUNT]
	Information about accessed CPU flags. More...
struct {
ZydisVectorLength   vectorLength
	The AVX vector-length. More...
struct {
ZydisMaskMode   mode
	The masking mode. More...
ZydisRegister   reg
	The mask register. More...
ZydisBool   isControlMask
	Signals, if the mask-register is used as a control mask. More...
}   mask
	Info about the embedded writemask-register. More...
struct {
ZydisBool   isStatic
	Signals, if the broadcast is a static broadcast. More...
ZydisBroadcastMode   mode
	The AVX broadcast-mode. More...
}   broadcast
	Contains info about the AVX broadcast-factor. More...
ZydisRoundingMode   roundingMode
	The AVX rounding-mode. More...
ZydisSwizzleMode   swizzleMode
	The AVX register-swizzle mode (MVEX only). More...
ZydisConversionMode   conversionMode
	The AVX data-conversion mode (MVEX only). More...
ZydisBool   hasSAE
	Signals, if the sae functionality is enabled for the instruction. More...
ZydisBool   hasEvictionHint
	Signals, if the instruction has a memory eviction-hint (MVEX only). More...
}	avx
	Extended info for AVX instructions. More...
struct {
struct {
uint8_t   data [ZYDIS_MAX_INSTRUCTION_LENGTH - 1]
uint8_t   count
uint8_t   hasF0
uint8_t   hasF3
uint8_t   hasF2
uint8_t   has2E
uint8_t   has36
uint8_t   has3E
uint8_t   has26
uint8_t   has64
uint8_t   has65
uint8_t   has66
uint8_t   has67
}   prefixes
	Detailed info about the legacy prefixes. More...
struct {
ZydisBool   isDecoded
	TRUE if the prefix got already decoded. More...
uint8_t   data [1]
	The raw bytes of the prefix. More...
uint8_t   W
	64-bit operand-size promotion. More...
uint8_t   R
	Extension of the ModRM.reg field. More...
uint8_t   X
	Extension of the SIB.index field. More...
uint8_t   B
	Extension of the ModRM.rm, SIB.base, or opcode.reg field. More...
}   rex
	Detailed info about the REX-prefix. More...
struct {
ZydisBool   isDecoded
	TRUE if the prefix got already decoded. More...
uint8_t   data [3]
	The raw bytes of the prefix. More...
uint8_t   R
	Extension of the ModRM.reg field (inverted). More...
uint8_t   X
	Extension of the SIB.index field (inverted). More...
uint8_t   B
	Extension of the ModRM.rm, SIB.base, or opcode.reg field (inverted). More...
uint8_t   m_mmmm
	Opcode-map specifier. More...
uint8_t   W
	64-bit operand-size promotion or opcode-extension. More...
uint8_t   vvvv
	NDS register specifier (inverted). More...
uint8_t   L
	Vector-length specifier. More...
uint8_t   pp
	Compressed legacy prefix. More...
}   xop
	Detailed info about the XOP-prefix. More...
struct {
ZydisBool   isDecoded
	TRUE if the prefix got already decoded. More...
uint8_t   data [3]
	The raw bytes of the prefix. More...
uint8_t   R
	Extension of the ModRM.reg field (inverted). More...
uint8_t   X
	Extension of the SIB.index field (inverted). More...
uint8_t   B
	Extension of the ModRM.rm, SIB.base, or opcode.reg field (inverted). More...
uint8_t   m_mmmm
	Opcode-map specifier. More...
uint8_t   W
	64-bit operand-size promotion or opcode-extension. More...
uint8_t   vvvv
	NDS register specifier (inverted). More...
uint8_t   L
	Vector-length specifier. More...
uint8_t   pp
	Compressed legacy prefix. More...
}   vex
	Detailed info about the VEX-prefix. More...
struct {
ZydisBool   isDecoded
	TRUE if the prefix got already decoded. More...
uint8_t   data [4]
	The raw bytes of the prefix. More...
uint8_t   R
	Extension of the ModRM.reg field (inverted). More...
uint8_t   X
	Extension of the SIB.index/vidx field (inverted). More...
uint8_t   B
	Extension of the ModRM.rm or SIB.base field (inverted). More...
uint8_t   R2
	High-16 register specifier modifier (inverted). More...
uint8_t   mm
	Opcode-map specifier. More...
uint8_t   W
	64-bit operand-size promotion or opcode-extension. More...
uint8_t   vvvv
	NDS register specifier (inverted). More...
uint8_t   pp
	Compressed legacy prefix. More...
uint8_t   z
	Zeroing/Merging. More...
uint8_t   L2
	Vector-length specifier or rounding-control (most significant bit). More...
uint8_t   L
	Vector-length specifier or rounding-control (least significant bit). More...
uint8_t   b
	Broadcast/RC/SAE Context. More...
uint8_t   V2
	High-16 NDS/VIDX register specifier. More...
uint8_t   aaa
	Embedded opmask register specifier. More...
}   evex
	Detailed info about the EVEX-prefix. More...
struct {
ZydisBool   isDecoded
	TRUE if the prefix got already decoded. More...
uint8_t   data [4]
	The raw bytes of the prefix. More...
uint8_t   R
	Extension of the ModRM.reg field (inverted). More...
uint8_t   X
	Extension of the SIB.index/vidx field (inverted). More...
uint8_t   B
	Extension of the ModRM.rm or SIB.base field (inverted). More...
uint8_t   R2
	High-16 register specifier modifier (inverted). More...
uint8_t   mmmm
	Opcode-map specifier. More...
uint8_t   W
	64-bit operand-size promotion or opcode-extension. More...
uint8_t   vvvv
	NDS register specifier (inverted). More...
uint8_t   pp
	Compressed legacy prefix. More...
uint8_t   E
	Non-temporal/eviction hint. More...
uint8_t   SSS
	Swizzle/broadcast/up-convert/down-convert/static-rounding controls. More...
uint8_t   V2
	High-16 NDS/VIDX register specifier. More...
uint8_t   kkk
	Embedded opmask register specifier. More...
}   mvex
	Detailed info about the MVEX-prefix. More...
struct {
ZydisBool   isDecoded
uint8_t   data [1]
uint8_t   mod
uint8_t   reg
uint8_t   rm
}   modrm
	Detailed info about the ModRM-byte. More...
struct {
ZydisBool   isDecoded
uint8_t   data [1]
uint8_t   scale
uint8_t   index
uint8_t   base
}   sib
	Detailed info about the SIB-byte. More...
struct {
int64_t   value
	The displacement value. More...
uint8_t   size
	The physical displacement size, in bits. More...
uint8_t   offset
	The offset of the displacement data, relative to the beginning of the instruction, in bytes. More...
}   disp
	Detailed info about displacement-bytes. More...
struct {
ZydisBool   isSigned
	Signals, if the immediate value is signed. More...
ZydisBool   isRelative
	Signals, if the immediate value contains a relative offset. More...
union {
uint64_t   u
int64_t   s
}   value
	The immediate value. More...
uint8_t   size
	The physical immediate size, in bits. More...
uint8_t   offset
	The offset of the immediate data, relative to the beginning of the instruction, in bytes. More...
}   imm [2]
	Detailed info about immediate-bytes. More...
}	raw
	Extended info about different instruction-parts like ModRM, SIB or encoding-prefixes. More...
void *	userData
	This field is intended for custom data and may be freely set by the user. More...

Detailed Description

Defines the ZydisDecodedInstruction struct.

Field Documentation

aaa

uint8_t aaa

Embedded opmask register specifier.

action

ZydisCPUFlagAction action

The CPU-flag action.

You can call ZydisGetCPUFlagsByAction to get a mask with all flags matching a specific action.

addressWidth

uint8_t addressWidth

The effective address width.

attributes

ZydisInstructionAttributes attributes

Instruction attributes.

struct { ... } avx

Extended info for AVX instructions.

B

uint8_t B

Extension of the ModRM.rm, SIB.base, or opcode.reg field.

Extension of the ModRM.rm or SIB.base field (inverted).

Extension of the ModRM.rm, SIB.base, or opcode.reg field (inverted).

b

uint8_t b

Broadcast/RC/SAE Context.

base

uint8_t base

struct { ... } broadcast

Contains info about the AVX broadcast-factor.

conversionMode

ZydisConversionMode conversionMode

The AVX data-conversion mode (MVEX only).

count

uint8_t count

data

uint8_t data[1]

The raw bytes of the decoded instruction.

The raw bytes of the prefix.

struct { ... } disp

Detailed info about displacement-bytes.

E

uint8_t E

Non-temporal/eviction hint.

encoding

ZydisInstructionEncoding encoding

The instruction-encoding (default, 3DNow, VEX, EVEX, XOP).

struct { ... } evex

Detailed info about the EVEX-prefix.

struct { ... } flags[ZYDIS_CPUFLAG_ENUM_COUNT]

Information about accessed CPU flags.

has26

uint8_t has26

has2E

uint8_t has2E

has36

uint8_t has36

has3E

uint8_t has3E

has64

uint8_t has64

has65

uint8_t has65

has66

uint8_t has66

has67

uint8_t has67

hasEvictionHint

ZydisBool hasEvictionHint

Signals, if the instruction has a memory eviction-hint (MVEX only).

hasF0

uint8_t hasF0

hasF2

uint8_t hasF2

hasF3

uint8_t hasF3

hasSAE

ZydisBool hasSAE

Signals, if the sae functionality is enabled for the instruction.

struct { ... } imm[2]

Detailed info about immediate-bytes.

index

uint8_t index

instrAddress

uint64_t instrAddress

The instruction address points at the current instruction (relative to the initial instruction pointer).

instrPointer

uint64_t instrPointer

The instruction pointer points at the address of the next instruction (relative to the initial instruction pointer).

This field is used to properly format relative instructions.

isControlMask

ZydisBool isControlMask

Signals, if the mask-register is used as a control mask.

isDecoded

ZydisBool isDecoded

TRUE if the prefix got already decoded.

isRelative

ZydisBool isRelative

Signals, if the immediate value contains a relative offset.

You can use ZydisUtilsCalcAbsoluteTargetAddress to determine the absolute address value.

isSigned

ZydisBool isSigned

Signals, if the immediate value is signed.

isStatic

ZydisBool isStatic

Signals, if the broadcast is a static broadcast.

This is the case for instructions with inbuild broadcast functionality, that is always active and not be controlled by a flag in the XOP/VEX/EVEX/MVEX-prefix.

kkk

uint8_t kkk

Embedded opmask register specifier.

L

uint8_t L

Vector-length specifier.

Vector-length specifier or rounding-control (least significant bit).

L2

uint8_t L2

Vector-length specifier or rounding-control (most significant bit).

length

uint8_t length

The length of the decoded instruction.

m_mmmm

uint8_t m_mmmm

Opcode-map specifier.

machineMode

ZydisMachineMode machineMode

The machine mode used to decode this instruction.

struct { ... } mask

Info about the embedded writemask-register.

mm

uint8_t mm

Opcode-map specifier.

mmmm

uint8_t mmmm

Opcode-map specifier.

mnemonic

ZydisMnemonic mnemonic

The instruction-mnemonic.

mod

uint8_t mod

mode [1/2]

ZydisMaskMode mode

The masking mode.

mode [2/2]

ZydisBroadcastMode mode

The AVX broadcast-mode.

struct { ... } modrm

Detailed info about the ModRM-byte.

struct { ... } mvex

Detailed info about the MVEX-prefix.

offset

uint8_t offset

The offset of the displacement data, relative to the beginning of the instruction, in bytes.

The offset of the immediate data, relative to the beginning of the instruction, in bytes.

opcode

uint8_t opcode

The instruction-opcode.

opcodeMap

ZydisOpcodeMap opcodeMap

The opcode-map.

operandCount

uint8_t operandCount

The number of instruction-operands.

operands

ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT]

Detailed info for all instruction operands.

operandSize

uint8_t operandSize

The effective operand size.

pp

uint8_t pp

Compressed legacy prefix.

struct { ... } prefixes

Detailed info about the legacy prefixes.

R

uint8_t R

Extension of the ModRM.reg field.

Extension of the ModRM.reg field (inverted).

R2

uint8_t R2

High-16 register specifier modifier (inverted).

struct { ... } raw

Extended info about different instruction-parts like ModRM, SIB or encoding-prefixes.

reg [1/2]

ZydisRegister reg

The mask register.

reg [2/2]

uint8_t reg

struct { ... } rex

Detailed info about the REX-prefix.

rm

uint8_t rm

roundingMode

ZydisRoundingMode roundingMode

The AVX rounding-mode.

s

int64_t s

scale

uint8_t scale

struct { ... } sib

Detailed info about the SIB-byte.

size

uint8_t size

The physical displacement size, in bits.

The physical immediate size, in bits.

SSS

uint8_t SSS

Swizzle/broadcast/up-convert/down-convert/static-rounding controls.

stackWidth

uint8_t stackWidth

The stack width.

swizzleMode

ZydisSwizzleMode swizzleMode

The AVX register-swizzle mode (MVEX only).

u

uint64_t u

userData

void* userData

This field is intended for custom data and may be freely set by the user.

V2

uint8_t V2

High-16 NDS/VIDX register specifier.

value [1/2]

int64_t value

The displacement value.

[2/2]

union { ... } value

The immediate value.

vectorLength

ZydisVectorLength vectorLength

The AVX vector-length.

struct { ... } vex

Detailed info about the VEX-prefix.

vvvv

uint8_t vvvv

NDS register specifier (inverted).

W

uint8_t W

64-bit operand-size promotion.

64-bit operand-size promotion or opcode-extension.

X

uint8_t X

Extension of the SIB.index field.

Extension of the SIB.index/vidx field (inverted).

Extension of the SIB.index field (inverted).

struct { ... } xop

Detailed info about the XOP-prefix.

z

uint8_t z

Zeroing/Merging.

---

The documentation for this struct was generated from the following file:

• include/Zydis/DecoderTypes.h