All-in-one convenience function providing the simplest possible way to use Zydis. More...

#include <Zydis/Decoder.h>
#include <Zydis/Formatter.h>

Include dependency graph for Disassembler.h:

This graph shows which files directly or indirectly include this file:

Data Structures
struct	ZydisDisassembledInstruction_
	All commonly used information about a decoded instruction that Zydis can provide. More...

Typedefs
typedef struct ZydisDisassembledInstruction_	ZydisDisassembledInstruction
	All commonly used information about a decoded instruction that Zydis can provide. More...

Functions
ZYDIS_EXPORT ZyanStatus	ZydisDisassembleIntel (ZydisMachineMode machine_mode, ZyanU64 runtime_address, const void buffer, ZyanUSize length, ZydisDisassembledInstruction instruction)
	Disassemble an instruction and format it to human-readable text in a single step (Intel syntax). More...

ZYDIS_EXPORT ZyanStatus	ZydisDisassembleATT (ZydisMachineMode machine_mode, ZyanU64 runtime_address, const void buffer, ZyanUSize length, ZydisDisassembledInstruction instruction)
	Disassemble an instruction and format it to human-readable text in a single step (AT&T syntax). More...

Detailed Description

All-in-one convenience function providing the simplest possible way to use Zydis.

Typedef Documentation

◆ ZydisDisassembledInstruction

typedef struct ZydisDisassembledInstruction_ ZydisDisassembledInstruction

All commonly used information about a decoded instruction that Zydis can provide.

This structure is filled in by calling ZydisDisassembleIntel or ZydisDisassembleATT.

Function Documentation

◆ ZydisDisassembleATT()

ZYDIS_EXPORT ZyanStatus ZydisDisassembleATT	(	ZydisMachineMode	machine_mode,
		ZyanU64	runtime_address,
		const void *	buffer,
		ZyanUSize	length,
		ZydisDisassembledInstruction *	instruction
	)

Disassemble an instruction and format it to human-readable text in a single step (AT&T syntax).

Parameters

machine_mode	The machine mode to assume when disassembling. When in doubt, pass `ZYDIS_MACHINE_MODE_LONG_64` for what is typically referred to as "64-bit mode" or `ZYDIS_MACHINE_MODE_LEGACY_32` for "32-bit mode".
runtime_address	The program counter (`eip` / `rip`) to assume when formatting the instruction. Many instructions behave differently depending on the address they are located at.
buffer	A pointer to the raw instruction bytes that you wish to decode.
length	The length of the input buffer. Note that this can be bigger than the actual size of the instruction – you don't have to know the size up front. This length is merely used to prevent Zydis from doing out-of-bounds reads on your buffer.
instruction	A pointer to receive the decoded instruction information. Can be uninitialized and reused on later calls.

This is a convenience function intended as a quick path for getting started with using Zydis. It internally calls a range of other more advanced functions to obtain all commonly needed information about the instruction. It is likely that you won't need most of this information in practice, so it is advisable to instead call these more advanced functions directly if you're concerned about performance.

This function essentially combines the following more advanced functions into a single call:

ZydisDecoderInit
ZydisDecoderDecodeInstruction
ZydisDecoderDecodeOperands
ZydisFormatterInit
ZydisFormatterFormatInstruction

Returns: A zyan status code.

◆ ZydisDisassembleIntel()

ZYDIS_EXPORT ZyanStatus ZydisDisassembleIntel	(	ZydisMachineMode	machine_mode,
		ZyanU64	runtime_address,
		const void *	buffer,
		ZyanUSize	length,
		ZydisDisassembledInstruction *	instruction
	)

Disassemble an instruction and format it to human-readable text in a single step (Intel syntax).