Zydis  v4.1.0
Formatter.h File Reference

Functions for formatting instructions to human-readable text. More...

#include <Zycore/Defines.h>
#include <Zycore/String.h>
#include <Zycore/Types.h>
#include <Zydis/DecoderTypes.h>
#include <Zydis/FormatterBuffer.h>
Include dependency graph for Formatter.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  ZydisFormatterContext_
 Context structure that that is passed to all formatter. More...
 
struct  ZydisFormatter_
 Context structure keeping track of internal state of the formatter. More...
 

Macros

#define ZYDIS_RUNTIME_ADDRESS_NONE   (ZyanU64)(-1)
 Use this constant as value for runtime_address in ZydisFormatterFormatInstruction(Ex) or ZydisFormatterFormatOperand(Ex) to print relative values for all addresses. More...
 

Typedefs

typedef enum ZydisFormatterStyle_ ZydisFormatterStyle
 Enum selecting the syntax to format the disassembly in. More...
 
typedef enum ZydisFormatterProperty_ ZydisFormatterProperty
 Enum selecting a property of the formatter. More...
 
typedef enum ZydisNumericBase_ ZydisNumericBase
 Enum defining different mantissae to be used during formatting. More...
 
typedef enum ZydisSignedness_ ZydisSignedness
 Enum defining the signeness of integers to be used during formatting. More...
 
typedef enum ZydisPadding_ ZydisPadding
 Enum definining magic values that receive special treatment when used as padding properties of the formatter. More...
 
typedef enum ZydisFormatterFunction_ ZydisFormatterFunction
 Enum selecting a formatter function to be replaced with hooks. More...
 
typedef enum ZydisDecorator_ ZydisDecorator
 Enum of all decorator types. More...
 
typedef struct ZydisFormatter_ ZydisFormatter
 
typedef struct ZydisFormatterContext_ ZydisFormatterContext
 Context structure that that is passed to all formatter. More...
 
typedef ZyanStatus(* ZydisFormatterFunc) (const ZydisFormatter *formatter, ZydisFormatterBuffer *buffer, ZydisFormatterContext *context)
 Defines the ZydisFormatterFunc function prototype. More...
 
typedef ZyanStatus(* ZydisFormatterRegisterFunc) (const ZydisFormatter *formatter, ZydisFormatterBuffer *buffer, ZydisFormatterContext *context, ZydisRegister reg)
 Defines the ZydisFormatterRegisterFunc function prototype. More...
 
typedef ZyanStatus(* ZydisFormatterDecoratorFunc) (const ZydisFormatter *formatter, ZydisFormatterBuffer *buffer, ZydisFormatterContext *context, ZydisDecorator decorator)
 Defines the ZydisFormatterDecoratorFunc function prototype. More...
 

Enumerations

enum  ZydisFormatterStyle_ {
  ZYDIS_FORMATTER_STYLE_ATT , ZYDIS_FORMATTER_STYLE_INTEL , ZYDIS_FORMATTER_STYLE_INTEL_MASM , ZYDIS_FORMATTER_STYLE_MAX_VALUE = ZYDIS_FORMATTER_STYLE_INTEL_MASM ,
  ZYDIS_FORMATTER_STYLE_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_FORMATTER_STYLE_MAX_VALUE)
}
 Enum selecting the syntax to format the disassembly in. More...
 
enum  ZydisFormatterProperty_ {
  ZYDIS_FORMATTER_PROP_FORCE_SIZE , ZYDIS_FORMATTER_PROP_FORCE_SEGMENT , ZYDIS_FORMATTER_PROP_FORCE_SCALE_ONE , ZYDIS_FORMATTER_PROP_FORCE_RELATIVE_BRANCHES ,
  ZYDIS_FORMATTER_PROP_FORCE_RELATIVE_RIPREL , ZYDIS_FORMATTER_PROP_PRINT_BRANCH_SIZE , ZYDIS_FORMATTER_PROP_DETAILED_PREFIXES , ZYDIS_FORMATTER_PROP_ADDR_BASE ,
  ZYDIS_FORMATTER_PROP_ADDR_SIGNEDNESS , ZYDIS_FORMATTER_PROP_ADDR_PADDING_ABSOLUTE , ZYDIS_FORMATTER_PROP_ADDR_PADDING_RELATIVE , ZYDIS_FORMATTER_PROP_DISP_BASE ,
  ZYDIS_FORMATTER_PROP_DISP_SIGNEDNESS , ZYDIS_FORMATTER_PROP_DISP_PADDING , ZYDIS_FORMATTER_PROP_IMM_BASE , ZYDIS_FORMATTER_PROP_IMM_SIGNEDNESS ,
  ZYDIS_FORMATTER_PROP_IMM_PADDING , ZYDIS_FORMATTER_PROP_UPPERCASE_PREFIXES , ZYDIS_FORMATTER_PROP_UPPERCASE_MNEMONIC , ZYDIS_FORMATTER_PROP_UPPERCASE_REGISTERS ,
  ZYDIS_FORMATTER_PROP_UPPERCASE_TYPECASTS , ZYDIS_FORMATTER_PROP_UPPERCASE_DECORATORS , ZYDIS_FORMATTER_PROP_DEC_PREFIX , ZYDIS_FORMATTER_PROP_DEC_SUFFIX ,
  ZYDIS_FORMATTER_PROP_HEX_UPPERCASE , ZYDIS_FORMATTER_PROP_HEX_FORCE_LEADING_NUMBER , ZYDIS_FORMATTER_PROP_HEX_PREFIX , ZYDIS_FORMATTER_PROP_HEX_SUFFIX ,
  ZYDIS_FORMATTER_PROP_MAX_VALUE = ZYDIS_FORMATTER_PROP_HEX_SUFFIX , ZYDIS_FORMATTER_PROP_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_FORMATTER_PROP_MAX_VALUE)
}
 Enum selecting a property of the formatter. More...
 
enum  ZydisNumericBase_ { ZYDIS_NUMERIC_BASE_DEC , ZYDIS_NUMERIC_BASE_HEX , ZYDIS_NUMERIC_BASE_MAX_VALUE = ZYDIS_NUMERIC_BASE_HEX , ZYDIS_NUMERIC_BASE_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_NUMERIC_BASE_MAX_VALUE) }
 Enum defining different mantissae to be used during formatting. More...
 
enum  ZydisSignedness_ {
  ZYDIS_SIGNEDNESS_AUTO , ZYDIS_SIGNEDNESS_SIGNED , ZYDIS_SIGNEDNESS_UNSIGNED , ZYDIS_SIGNEDNESS_MAX_VALUE = ZYDIS_SIGNEDNESS_UNSIGNED ,
  ZYDIS_SIGNEDNESS_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_SIGNEDNESS_MAX_VALUE)
}
 Enum defining the signeness of integers to be used during formatting. More...
 
enum  ZydisPadding_ { ZYDIS_PADDING_DISABLED = 0 , ZYDIS_PADDING_AUTO = (-1) , ZYDIS_PADDING_MAX_VALUE = ZYDIS_PADDING_AUTO , ZYDIS_PADDING_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_PADDING_MAX_VALUE) }
 Enum definining magic values that receive special treatment when used as padding properties of the formatter. More...
 
enum  ZydisFormatterFunction_ {
  ZYDIS_FORMATTER_FUNC_PRE_INSTRUCTION , ZYDIS_FORMATTER_FUNC_POST_INSTRUCTION , ZYDIS_FORMATTER_FUNC_FORMAT_INSTRUCTION , ZYDIS_FORMATTER_FUNC_PRE_OPERAND ,
  ZYDIS_FORMATTER_FUNC_POST_OPERAND , ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_REG , ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_MEM , ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_PTR ,
  ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_IMM , ZYDIS_FORMATTER_FUNC_PRINT_MNEMONIC , ZYDIS_FORMATTER_FUNC_PRINT_REGISTER , ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS ,
  ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_REL , ZYDIS_FORMATTER_FUNC_PRINT_DISP , ZYDIS_FORMATTER_FUNC_PRINT_IMM , ZYDIS_FORMATTER_FUNC_PRINT_TYPECAST ,
  ZYDIS_FORMATTER_FUNC_PRINT_SEGMENT , ZYDIS_FORMATTER_FUNC_PRINT_PREFIXES , ZYDIS_FORMATTER_FUNC_PRINT_DECORATOR , ZYDIS_FORMATTER_FUNC_MAX_VALUE = ZYDIS_FORMATTER_FUNC_PRINT_DECORATOR ,
  ZYDIS_FORMATTER_FUNC_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_FORMATTER_FUNC_MAX_VALUE)
}
 Enum selecting a formatter function to be replaced with hooks. More...
 
enum  ZydisDecorator_ {
  ZYDIS_DECORATOR_INVALID , ZYDIS_DECORATOR_MASK , ZYDIS_DECORATOR_BC , ZYDIS_DECORATOR_RC ,
  ZYDIS_DECORATOR_SAE , ZYDIS_DECORATOR_SWIZZLE , ZYDIS_DECORATOR_CONVERSION , ZYDIS_DECORATOR_EH ,
  ZYDIS_DECORATOR_MAX_VALUE = ZYDIS_DECORATOR_EH , ZYDIS_DECORATOR_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_DECORATOR_MAX_VALUE)
}
 Enum of all decorator types. More...
 

Functions

ZYDIS_EXPORT ZyanStatus ZydisFormatterInit (ZydisFormatter *formatter, ZydisFormatterStyle style)
 Initializes the given ZydisFormatter instance. More...
 
ZYDIS_EXPORT ZyanStatus ZydisFormatterSetProperty (ZydisFormatter *formatter, ZydisFormatterProperty property, ZyanUPointer value)
 Changes the value of the specified formatter property. More...
 
ZYDIS_EXPORT ZyanStatus ZydisFormatterSetHook (ZydisFormatter *formatter, ZydisFormatterFunction type, const void **callback)
 Replaces a formatter function with a custom callback and/or retrieves the currently used function. More...
 
ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatInstruction (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operands, ZyanU8 operand_count, char *buffer, ZyanUSize length, ZyanU64 runtime_address, void *user_data)
 Formats the given instruction and writes it into the output buffer. More...
 
ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatOperand (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operand, char *buffer, ZyanUSize length, ZyanU64 runtime_address, void *user_data)
 Formats the given operand and writes it into the output buffer. More...
 
ZYDIS_EXPORT ZyanStatus ZydisFormatterTokenizeInstruction (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operands, ZyanU8 operand_count, void *buffer, ZyanUSize length, ZyanU64 runtime_address, ZydisFormatterTokenConst **token, void *user_data)
 Tokenizes the given instruction and writes it into the output buffer. More...
 
ZYDIS_EXPORT ZyanStatus ZydisFormatterTokenizeOperand (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, const ZydisDecodedOperand *operand, void *buffer, ZyanUSize length, ZyanU64 runtime_address, ZydisFormatterTokenConst **token, void *user_data)
 Tokenizes the given operand and writes it into the output buffer. More...
 

Detailed Description

Functions for formatting instructions to human-readable text.

Macro Definition Documentation

◆ ZYDIS_RUNTIME_ADDRESS_NONE

#define ZYDIS_RUNTIME_ADDRESS_NONE   (ZyanU64)(-1)

Use this constant as value for runtime_address in ZydisFormatterFormatInstruction(Ex) or ZydisFormatterFormatOperand(Ex) to print relative values for all addresses.

Typedef Documentation

◆ ZydisDecorator

Enum of all decorator types.

◆ ZydisFormatter

◆ ZydisFormatterContext

Context structure that that is passed to all formatter.

◆ ZydisFormatterDecoratorFunc

typedef ZyanStatus(* ZydisFormatterDecoratorFunc) (const ZydisFormatter *formatter, ZydisFormatterBuffer *buffer, ZydisFormatterContext *context, ZydisDecorator decorator)

Defines the ZydisFormatterDecoratorFunc function prototype.

Parameters
formatterA pointer to the ZydisFormatter instance.
bufferA pointer to the ZydisFormatterBuffer struct.
contextA pointer to the ZydisFormatterContext struct.
decoratorThe decorator type.
Returns
Returning a status code other than ZYAN_STATUS_SUCCESS will immediately cause the formatting process to fail.

This function type is used for:

  • ZYDIS_FORMATTER_FUNC_PRINT_DECORATOR

◆ ZydisFormatterFunc

typedef ZyanStatus(* ZydisFormatterFunc) (const ZydisFormatter *formatter, ZydisFormatterBuffer *buffer, ZydisFormatterContext *context)

Defines the ZydisFormatterFunc function prototype.

Parameters
formatterA pointer to the ZydisFormatter instance.
bufferA pointer to the ZydisFormatterBuffer struct.
contextA pointer to the ZydisFormatterContext struct.
Returns
A zyan status code.

Returning a status code other than ZYAN_STATUS_SUCCESS will immediately cause the formatting process to fail (see exceptions below).

Returning ZYDIS_STATUS_SKIP_TOKEN is valid for functions of the following types and will instruct the formatter to omit the whole operand:

  • ZYDIS_FORMATTER_FUNC_PRE_OPERAND
  • ZYDIS_FORMATTER_FUNC_POST_OPERAND
  • ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_REG
  • ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_MEM
  • ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_PTR
  • ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_IMM

This function prototype is used by functions of the following types:

  • ZYDIS_FORMATTER_FUNC_PRE_INSTRUCTION
  • ZYDIS_FORMATTER_FUNC_POST_INSTRUCTION
  • ZYDIS_FORMATTER_FUNC_PRE_OPERAND
  • ZYDIS_FORMATTER_FUNC_POST_OPERAND
  • ZYDIS_FORMATTER_FUNC_FORMAT_INSTRUCTION
  • ZYDIS_FORMATTER_FUNC_PRINT_MNEMONIC
  • ZYDIS_FORMATTER_FUNC_PRINT_PREFIXES
  • ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_REG
  • ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_MEM
  • ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_PTR
  • ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_IMM
  • ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS
  • ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_REL
  • ZYDIS_FORMATTER_FUNC_PRINT_DISP
  • ZYDIS_FORMATTER_FUNC_PRINT_IMM
  • ZYDIS_FORMATTER_FUNC_PRINT_TYPECAST
  • ZYDIS_FORMATTER_FUNC_PRINT_SEGMENT

◆ ZydisFormatterFunction

Enum selecting a formatter function to be replaced with hooks.

Do NOT change the order of the values this enum or the function fields inside the ZydisFormatter struct.

◆ ZydisFormatterProperty

Enum selecting a property of the formatter.

◆ ZydisFormatterRegisterFunc

typedef ZyanStatus(* ZydisFormatterRegisterFunc) (const ZydisFormatter *formatter, ZydisFormatterBuffer *buffer, ZydisFormatterContext *context, ZydisRegister reg)

Defines the ZydisFormatterRegisterFunc function prototype.

Parameters
formatterA pointer to the ZydisFormatter instance.
bufferA pointer to the ZydisFormatterBuffer struct.
contextA pointer to the ZydisFormatterContext struct.
regThe register.
Returns
Returning a status code other than ZYAN_STATUS_SUCCESS will immediately cause the formatting process to fail.

This function prototype is used by functions of the following types:

  • ZYDIS_FORMATTER_FUNC_PRINT_REGISTER.

◆ ZydisFormatterStyle

Enum selecting the syntax to format the disassembly in.

◆ ZydisNumericBase

Enum defining different mantissae to be used during formatting.

◆ ZydisPadding

Enum definining magic values that receive special treatment when used as padding properties of the formatter.

◆ ZydisSignedness

Enum defining the signeness of integers to be used during formatting.

Enumeration Type Documentation

◆ ZydisDecorator_

Enum of all decorator types.

Enumerator
ZYDIS_DECORATOR_INVALID 
ZYDIS_DECORATOR_MASK 

The embedded-mask decorator.

ZYDIS_DECORATOR_BC 

The broadcast decorator.

ZYDIS_DECORATOR_RC 

The rounding-control decorator.

ZYDIS_DECORATOR_SAE 

The suppress-all-exceptions decorator.

ZYDIS_DECORATOR_SWIZZLE 

The register-swizzle decorator.

ZYDIS_DECORATOR_CONVERSION 

The conversion decorator.

ZYDIS_DECORATOR_EH 

The eviction-hint decorator.

ZYDIS_DECORATOR_MAX_VALUE 

Maximum value of this enum.

ZYDIS_DECORATOR_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

◆ ZydisFormatterFunction_

Enum selecting a formatter function to be replaced with hooks.

Do NOT change the order of the values this enum or the function fields inside the ZydisFormatter struct.

Enumerator
ZYDIS_FORMATTER_FUNC_PRE_INSTRUCTION 

This function is invoked before the formatter formats an instruction.

ZYDIS_FORMATTER_FUNC_POST_INSTRUCTION 

This function is invoked after the formatter formatted an instruction.

ZYDIS_FORMATTER_FUNC_FORMAT_INSTRUCTION 

This function refers to the main formatting function.

Replacing this function allows for complete custom formatting, but indirectly disables all other hooks except for ZYDIS_FORMATTER_FUNC_PRE_INSTRUCTION and ZYDIS_FORMATTER_FUNC_POST_INSTRUCTION.

ZYDIS_FORMATTER_FUNC_PRE_OPERAND 

This function is invoked before the formatter formats an operand.

ZYDIS_FORMATTER_FUNC_POST_OPERAND 

This function is invoked after the formatter formatted an operand.

ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_REG 

This function is invoked to format a register operand.

ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_MEM 

This function is invoked to format a memory operand.

Replacing this function might indirectly disable some specific calls to the ZYDIS_FORMATTER_FUNC_PRINT_TYPECAST, ZYDIS_FORMATTER_FUNC_PRINT_SEGMENT, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS and ZYDIS_FORMATTER_FUNC_PRINT_DISP functions.

ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_PTR 

This function is invoked to format a pointer operand.

ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_IMM 

This function is invoked to format an immediate operand.

Replacing this function might indirectly disable some specific calls to the ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_REL and ZYDIS_FORMATTER_FUNC_PRINT_IMM functions.

ZYDIS_FORMATTER_FUNC_PRINT_MNEMONIC 

This function is invoked to print the instruction mnemonic.

ZYDIS_FORMATTER_FUNC_PRINT_REGISTER 

This function is invoked to print a register.

ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS 

This function is invoked to print absolute addresses.

Conditionally invoked, if a runtime-address different to ZYDIS_RUNTIME_ADDRESS_NONE was passed:

  • IMM operands with relative address (e.g. JMP, CALL, ...)
  • MEM operands with EIP/RIP-relative address (e.g. MOV RAX, [RIP+0x12345678])

Always invoked for:

  • MEM operands with absolute address (e.g. MOV RAX, [0x12345678])
ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_REL 

This function is invoked to print relative addresses.

Conditionally invoked, if ZYDIS_RUNTIME_ADDRESS_NONE was passed as runtime-address:

  • IMM operands with relative address (e.g. JMP, CALL, ...)
ZYDIS_FORMATTER_FUNC_PRINT_DISP 

This function is invoked to print a memory displacement value.

If the memory displacement contains an address and a runtime-address different to ZYDIS_RUNTIME_ADDRESS_NONE was passed, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS is called instead.

ZYDIS_FORMATTER_FUNC_PRINT_IMM 

This function is invoked to print an immediate value.

If the immediate contains an address and a runtime-address different to ZYDIS_RUNTIME_ADDRESS_NONE was passed, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS is called instead.

If the immediate contains an address and ZYDIS_RUNTIME_ADDRESS_NONE was passed as runtime-address, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_REL is called instead.

ZYDIS_FORMATTER_FUNC_PRINT_TYPECAST 

This function is invoked to print the size of a memory operand (INTEL only).

ZYDIS_FORMATTER_FUNC_PRINT_SEGMENT 

This function is invoked to print the segment-register of a memory operand.

ZYDIS_FORMATTER_FUNC_PRINT_PREFIXES 

This function is invoked to print the instruction prefixes.

ZYDIS_FORMATTER_FUNC_PRINT_DECORATOR 

This function is invoked after formatting an operand to print a EVEX/MVEX decorator.

ZYDIS_FORMATTER_FUNC_MAX_VALUE 

Maximum value of this enum.

ZYDIS_FORMATTER_FUNC_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

◆ ZydisFormatterProperty_

Enum selecting a property of the formatter.

Enumerator
ZYDIS_FORMATTER_PROP_FORCE_SIZE 

Controls the printing of effective operand-size suffixes (AT&T) or operand-sizes of memory operands (INTEL).

Pass ZYAN_TRUE as value to force the formatter to always print the size, or ZYAN_FALSE to only print it if needed.

ZYDIS_FORMATTER_PROP_FORCE_SEGMENT 

Controls the printing of segment prefixes.

Pass ZYAN_TRUE as value to force the formatter to always print the segment register of memory-operands or ZYAN_FALSE to omit implicit DS/SS segments.

ZYDIS_FORMATTER_PROP_FORCE_SCALE_ONE 

Controls the printing of the scale-factor component for memory operands.

Pass ZYAN_TRUE as value to force the formatter to always print the scale-factor component of memory operands or ZYAN_FALSE to omit the scale factor for values of 1.

ZYDIS_FORMATTER_PROP_FORCE_RELATIVE_BRANCHES 

Controls the printing of branch addresses.

Pass ZYAN_TRUE as value to force the formatter to always print relative branch addresses or ZYAN_FALSE to use absolute addresses, if a runtime-address different to ZYDIS_RUNTIME_ADDRESS_NONE was passed.

ZYDIS_FORMATTER_PROP_FORCE_RELATIVE_RIPREL 

Controls the printing of EIP/RIP-relative addresses.

Pass ZYAN_TRUE as value to force the formatter to always print relative addresses for EIP/RIP-relative operands or ZYAN_FALSE to use absolute addresses, if a runtime- address different to ZYDIS_RUNTIME_ADDRESS_NONE was passed.

ZYDIS_FORMATTER_PROP_PRINT_BRANCH_SIZE 

Controls the printing of branch-instructions sizes.

Pass ZYAN_TRUE as value to print the size (short, near) of branch instructions or ZYAN_FALSE to hide it.

Note that the far/l modifier is always printed.

ZYDIS_FORMATTER_PROP_DETAILED_PREFIXES 

Controls the printing of instruction prefixes.

Pass ZYAN_TRUE as value to print all instruction-prefixes (even ignored or duplicate ones) or ZYAN_FALSE to only print prefixes that are effectively used by the instruction.

ZYDIS_FORMATTER_PROP_ADDR_BASE 

Controls the base of address values.

ZYDIS_FORMATTER_PROP_ADDR_SIGNEDNESS 

Controls the signedness of relative addresses.

Absolute addresses are always unsigned.

ZYDIS_FORMATTER_PROP_ADDR_PADDING_ABSOLUTE 

Controls the padding of absolute address values.

Pass ZYDIS_PADDING_DISABLED to disable padding, ZYDIS_PADDING_AUTO to pad all addresses to the current address width (hexadecimal only), or any other integer value for custom padding.

ZYDIS_FORMATTER_PROP_ADDR_PADDING_RELATIVE 

Controls the padding of relative address values.

Pass ZYDIS_PADDING_DISABLED to disable padding, ZYDIS_PADDING_AUTO to pad all addresses to the current address width (hexadecimal only), or any other integer value for custom padding.

ZYDIS_FORMATTER_PROP_DISP_BASE 

Controls the base of displacement values.

ZYDIS_FORMATTER_PROP_DISP_SIGNEDNESS 

Controls the signedness of displacement values.

ZYDIS_FORMATTER_PROP_DISP_PADDING 

Controls the padding of displacement values.

Pass ZYDIS_PADDING_DISABLED to disable padding, or any other integer value for custom padding.

ZYDIS_FORMATTER_PROP_IMM_BASE 

Controls the base of immediate values.

ZYDIS_FORMATTER_PROP_IMM_SIGNEDNESS 

Controls the signedness of immediate values.

Pass ZYDIS_SIGNEDNESS_AUTO to automatically choose the most suitable mode based on the operands ZydisDecodedOperand.imm.is_signed attribute.

ZYDIS_FORMATTER_PROP_IMM_PADDING 

Controls the padding of immediate values.

Pass ZYDIS_PADDING_DISABLED to disable padding, ZYDIS_PADDING_AUTO to padd all immediates to the operand-width (hexadecimal only), or any other integer value for custom padding.

ZYDIS_FORMATTER_PROP_UPPERCASE_PREFIXES 

Controls the letter-case for prefixes.

Pass ZYAN_TRUE as value to format in uppercase or ZYAN_FALSE to format in lowercase.

ZYDIS_FORMATTER_PROP_UPPERCASE_MNEMONIC 

Controls the letter-case for the mnemonic.

Pass ZYAN_TRUE as value to format in uppercase or ZYAN_FALSE to format in lowercase.

ZYDIS_FORMATTER_PROP_UPPERCASE_REGISTERS 

Controls the letter-case for registers.

Pass ZYAN_TRUE as value to format in uppercase or ZYAN_FALSE to format in lowercase.

ZYDIS_FORMATTER_PROP_UPPERCASE_TYPECASTS 

Controls the letter-case for typecasts.

Pass ZYAN_TRUE as value to format in uppercase or ZYAN_FALSE to format in lowercase.

ZYDIS_FORMATTER_PROP_UPPERCASE_DECORATORS 

Controls the letter-case for decorators.

Pass ZYAN_TRUE as value to format in uppercase or ZYAN_FALSE to format in lowercase.

WARNING: this is currently not implemented (ignored).

ZYDIS_FORMATTER_PROP_DEC_PREFIX 

Controls the prefix for decimal values.

Pass a pointer to a null-terminated C-style string with a maximum length of 10 characters to set a custom prefix, or ZYAN_NULL to disable it.

The string is deep-copied into an internal buffer.

ZYDIS_FORMATTER_PROP_DEC_SUFFIX 

Controls the suffix for decimal values.

Pass a pointer to a null-terminated C-style string with a maximum length of 10 characters to set a custom suffix, or ZYAN_NULL to disable it.

The string is deep-copied into an internal buffer.

ZYDIS_FORMATTER_PROP_HEX_UPPERCASE 

Controls the letter-case of hexadecimal values.

Pass ZYAN_TRUE as value to format in uppercase and ZYAN_FALSE to format in lowercase.

The default value is ZYAN_TRUE.

ZYDIS_FORMATTER_PROP_HEX_FORCE_LEADING_NUMBER 

Controls whether to prepend hexadecimal values with a leading zero if the first character is non-numeric.

Pass ZYAN_TRUE to prepend a leading zero if the first character is non-numeric or ZYAN_FALSE to disable this functionality.

The default value is ZYAN_FALSE.

ZYDIS_FORMATTER_PROP_HEX_PREFIX 

Controls the prefix for hexadecimal values.

Pass a pointer to a null-terminated C-style string with a maximum length of 10 characters to set a custom prefix, or ZYAN_NULL to disable it.

The string is deep-copied into an internal buffer.

ZYDIS_FORMATTER_PROP_HEX_SUFFIX 

Controls the suffix for hexadecimal values.

Pass a pointer to a null-terminated C-style string with a maximum length of 10 characters to set a custom suffix, or ZYAN_NULL to disable it.

The string is deep-copied into an internal buffer.

ZYDIS_FORMATTER_PROP_MAX_VALUE 

Maximum value of this enum.

ZYDIS_FORMATTER_PROP_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

◆ ZydisFormatterStyle_

Enum selecting the syntax to format the disassembly in.

Enumerator
ZYDIS_FORMATTER_STYLE_ATT 

Generates AT&T-style disassembly.

ZYDIS_FORMATTER_STYLE_INTEL 

Generates Intel-style disassembly.

ZYDIS_FORMATTER_STYLE_INTEL_MASM 

Generates MASM-style disassembly that is directly accepted as input for the MASM assembler.

The runtime-address is ignored in this mode.

ZYDIS_FORMATTER_STYLE_MAX_VALUE 

Maximum value of this enum.

ZYDIS_FORMATTER_STYLE_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

◆ ZydisNumericBase_

Enum defining different mantissae to be used during formatting.

Enumerator
ZYDIS_NUMERIC_BASE_DEC 

Decimal system.

ZYDIS_NUMERIC_BASE_HEX 

Hexadecimal system.

ZYDIS_NUMERIC_BASE_MAX_VALUE 

Maximum value of this enum.

ZYDIS_NUMERIC_BASE_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

◆ ZydisPadding_

Enum definining magic values that receive special treatment when used as padding properties of the formatter.

Enumerator
ZYDIS_PADDING_DISABLED 

Disables padding.

ZYDIS_PADDING_AUTO 

Padds the value to the current stack-width for addresses, or to the operand-width for immediate values (hexadecimal only).

ZYDIS_PADDING_MAX_VALUE 

Maximum value of this enum.

ZYDIS_PADDING_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

◆ ZydisSignedness_

Enum defining the signeness of integers to be used during formatting.

Enumerator
ZYDIS_SIGNEDNESS_AUTO 

Automatically choose the most suitable mode based on the operands ZydisDecodedOperand.imm.is_signed` attribute.

ZYDIS_SIGNEDNESS_SIGNED 

Force signed values.

ZYDIS_SIGNEDNESS_UNSIGNED 

Force unsigned values.

ZYDIS_SIGNEDNESS_MAX_VALUE 

Maximum value of this enum.

ZYDIS_SIGNEDNESS_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.