ZydisDecodedInstruction_ Struct Reference

Defines the ZydisDecodedInstruction struct. More...

#include <DecoderTypes.h>

Collaboration diagram for ZydisDecodedInstruction_:

Data Fields
ZydisMachineMode	machineMode
	The machine mode used to decode this instruction.
ZydisMnemonic	mnemonic
	The instruction-mnemonic.
uint8_t	length
	The length of the decoded instruction.
uint8_t	data [ZYDIS_MAX_INSTRUCTION_LENGTH]
	The raw bytes of the decoded instruction. More...
ZydisInstructionEncoding	encoding
	The instruction-encoding (default, 3DNow, VEX, EVEX, XOP).
ZydisOpcodeMap	opcodeMap
	The opcode-map.
uint8_t	opcode
	The instruction-opcode.
uint8_t	stackWidth
	The stack width.
uint8_t	operandWidth
	The effective operand width.
uint8_t	addressWidth
	The effective address width.
uint8_t	operandCount
	The number of instruction-operands.
ZydisDecodedOperand	operands [ZYDIS_MAX_OPERAND_COUNT]
	Detailed info for all instruction operands.
ZydisInstructionAttributes	attributes
	Instruction attributes.
uint64_t	instrAddress
	The instruction address points at the current instruction (relative to the initial instruction pointer).
uint64_t	instrPointer
	The instruction pointer points at the address of the next instruction (relative to the initial instruction pointer). More...
struct {
ZydisCPUFlagAction   action
	The CPU-flag action. More...
}	accessedFlags [ZYDIS_CPUFLAG_MAX_VALUE+1]
	Information about accessed CPU flags.
struct {
ZydisVectorLength   vectorLength
	The AVX vector-length.
struct {
ZydisMaskMode   mode
	The masking mode.
ZydisRegister   reg
	The mask register.
ZydisBool   isControlMask
	Signals, if the mask-register is used as a control mask.
}   mask
	Info about the embedded writemask-register.
struct {
ZydisBool   isStatic
	Signals, if the broadcast is a static broadcast. More...
ZydisBroadcastMode   mode
	The AVX broadcast-mode.
}   broadcast
	Contains info about the AVX broadcast.
struct {
ZydisRoundingMode   mode
	The AVX rounding-mode.
}   rounding
	Contains info about the AVX rounding.
struct {
ZydisSwizzleMode   mode
	The AVX register-swizzle mode (MVEX only).
}   swizzle
	Contains info about the AVX register-swizzle (MVEX only).
struct {
ZydisConversionMode   mode
	The AVX data-conversion mode (MVEX only).
}   conversion
	Contains info about the AVX data-conversion (MVEX only).
ZydisBool   hasSAE
	Signals, if the sae functionality is enabled for the instruction.
ZydisBool   hasEvictionHint
	Signals, if the instruction has a memory eviction-hint (MVEX only).
}	avx
	Extended info for AVX instructions.
struct {
ZydisInstructionCategory   category
	The instruction category.
ZydisISASet   isaSet
	The ISA-set.
ZydisISAExt   isaExt
	The ISA-set extension.
ZydisExceptionClass   exceptionClass
	The exception class.
}	meta
	Meta info.
struct {
struct {
uint8_t   data [ZYDIS_MAX_INSTRUCTION_LENGTH - 1]
uint8_t   count
uint8_t   hasF0
uint8_t   hasF3
uint8_t   hasF2
uint8_t   has2E
uint8_t   has36
uint8_t   has3E
uint8_t   has26
uint8_t   has64
uint8_t   has65
uint8_t   has66
uint8_t   has67
}   prefixes
	Detailed info about the legacy prefixes.
struct {
ZydisBool   isDecoded
	TRUE if the prefix got already decoded.
uint8_t   data [1]
	The raw bytes of the prefix.
uint8_t   W
	64-bit operand-size promotion.
uint8_t   R
	Extension of the ModRM.reg field.
uint8_t   X
	Extension of the SIB.index field.
uint8_t   B
	Extension of the ModRM.rm, SIB.base, or opcode.reg field.
}   rex
	Detailed info about the REX-prefix.
struct {
ZydisBool   isDecoded
	TRUE if the prefix got already decoded.
uint8_t   data [3]
	The raw bytes of the prefix.
uint8_t   R
	Extension of the ModRM.reg field (inverted).
uint8_t   X
	Extension of the SIB.index field (inverted).
uint8_t   B
	Extension of the ModRM.rm, SIB.base, or opcode.reg field (inverted).
uint8_t   m_mmmm
	Opcode-map specifier.
uint8_t   W
	64-bit operand-size promotion or opcode-extension.
uint8_t   vvvv
	NDS register specifier (inverted).
uint8_t   L
	Vector-length specifier.
uint8_t   pp
	Compressed legacy prefix.
}   xop
	Detailed info about the XOP-prefix.
struct {
ZydisBool   isDecoded
	TRUE if the prefix got already decoded.
uint8_t   data [3]
	The raw bytes of the prefix.
uint8_t   R
	Extension of the ModRM.reg field (inverted).
uint8_t   X
	Extension of the SIB.index field (inverted).
uint8_t   B
	Extension of the ModRM.rm, SIB.base, or opcode.reg field (inverted).
uint8_t   m_mmmm
	Opcode-map specifier.
uint8_t   W
	64-bit operand-size promotion or opcode-extension.
uint8_t   vvvv
	NDS register specifier (inverted).
uint8_t   L
	Vector-length specifier.
uint8_t   pp
	Compressed legacy prefix.
}   vex
	Detailed info about the VEX-prefix.
struct {
ZydisBool   isDecoded
	TRUE if the prefix got already decoded.
uint8_t   data [4]
	The raw bytes of the prefix.
uint8_t   R
	Extension of the ModRM.reg field (inverted).
uint8_t   X
	Extension of the SIB.index/vidx field (inverted).
uint8_t   B
	Extension of the ModRM.rm or SIB.base field (inverted).
uint8_t   R2
	High-16 register specifier modifier (inverted).
uint8_t   mm
	Opcode-map specifier.
uint8_t   W
	64-bit operand-size promotion or opcode-extension.
uint8_t   vvvv
	NDS register specifier (inverted).
uint8_t   pp
	Compressed legacy prefix.
uint8_t   z
	Zeroing/Merging.
uint8_t   L2
	Vector-length specifier or rounding-control (most significant bit).
uint8_t   L
	Vector-length specifier or rounding-control (least significant bit).
uint8_t   b
	Broadcast/RC/SAE Context.
uint8_t   V2
	High-16 NDS/VIDX register specifier.
uint8_t   aaa
	Embedded opmask register specifier.
}   evex
	Detailed info about the EVEX-prefix.
struct {
ZydisBool   isDecoded
	TRUE if the prefix got already decoded.
uint8_t   data [4]
	The raw bytes of the prefix.
uint8_t   R
	Extension of the ModRM.reg field (inverted).
uint8_t   X
	Extension of the SIB.index/vidx field (inverted).
uint8_t   B
	Extension of the ModRM.rm or SIB.base field (inverted).
uint8_t   R2
	High-16 register specifier modifier (inverted).
uint8_t   mmmm
	Opcode-map specifier.
uint8_t   W
	64-bit operand-size promotion or opcode-extension.
uint8_t   vvvv
	NDS register specifier (inverted).
uint8_t   pp
	Compressed legacy prefix.
uint8_t   E
	Non-temporal/eviction hint.
uint8_t   SSS
	Swizzle/broadcast/up-convert/down-convert/static-rounding controls.
uint8_t   V2
	High-16 NDS/VIDX register specifier.
uint8_t   kkk
	Embedded opmask register specifier.
}   mvex
	Detailed info about the MVEX-prefix.
struct {
ZydisBool   isDecoded
uint8_t   data [1]
uint8_t   mod
uint8_t   reg
uint8_t   rm
}   modrm
	Detailed info about the ModRM-byte.
struct {
ZydisBool   isDecoded
uint8_t   data [1]
uint8_t   scale
uint8_t   index
uint8_t   base
}   sib
	Detailed info about the SIB-byte.
struct {
int64_t   value
	The displacement value.
uint8_t   size
	The physical displacement size, in bits.
uint8_t   offset
	The offset of the displacement data, relative to the beginning of the instruction, in bytes.
}   disp
	Detailed info about displacement-bytes.
struct {
ZydisBool   isSigned
	Signals, if the immediate value is signed.
ZydisBool   isRelative
	Signals, if the immediate value contains a relative offset. More...
union {
uint64_t   u
int64_t   s
}   value
	The immediate value.
uint8_t   size
	The physical immediate size, in bits.
uint8_t   offset
	The offset of the immediate data, relative to the beginning of the instruction, in bytes.
}   imm [2]
	Detailed info about immediate-bytes.
}	raw
	Extended info about different instruction-parts like ModRM, SIB or encoding-prefixes.

Detailed Description

Defines the ZydisDecodedInstruction struct.

Field Documentation

action

ZydisCPUFlagAction action

The CPU-flag action.

You can call ZydisGetAccessedFlagsByAction to get a mask with all flags matching a specific action.

B

uint8_t B

Extension of the ModRM.rm, SIB.base, or opcode.reg field.

Extension of the ModRM.rm or SIB.base field (inverted).

Extension of the ModRM.rm, SIB.base, or opcode.reg field (inverted).

data

uint8_t data[1]

The raw bytes of the decoded instruction.

The raw bytes of the prefix.

instrPointer

uint64_t instrPointer

The instruction pointer points at the address of the next instruction (relative to the initial instruction pointer).

This field is used to properly format relative instructions.

isRelative

ZydisBool isRelative

Signals, if the immediate value contains a relative offset.

You can use ZydisCalcAbsoluteAddress to determine the absolute address value.

isStatic

ZydisBool isStatic

Signals, if the broadcast is a static broadcast.

This is the case for instructions with inbuild broadcast functionality, that is always active and not be controlled by a flag in the XOP/VEX/EVEX/MVEX-prefix.

L

uint8_t L

Vector-length specifier.

Vector-length specifier or rounding-control (least significant bit).

offset

uint8_t offset

The offset of the displacement data, relative to the beginning of the instruction, in bytes.

The offset of the immediate data, relative to the beginning of the instruction, in bytes.

R

uint8_t R

Extension of the ModRM.reg field.

Extension of the ModRM.reg field (inverted).

size

uint8_t size

The physical displacement size, in bits.

The physical immediate size, in bits.

W

uint8_t W

64-bit operand-size promotion.

64-bit operand-size promotion or opcode-extension.

X

uint8_t X

Extension of the SIB.index field.

Extension of the SIB.index/vidx field (inverted).

Extension of the SIB.index field (inverted).

---

The documentation for this struct was generated from the following file:

• include/Zydis/DecoderTypes.h