-
-
Notifications
You must be signed in to change notification settings - Fork 53
Instr
Instr class is a representation of a CPU instruction.
There are 2 ways of constructing objects.
-
Instr.FromAddr(addr)
Creates object using bytes extracted at address.
-
Instr.FromParts(data, code, oper)
Creates object using OpData object, OpCode & operation mode. Internal use mostly.
Property name | Description |
---|---|
Addr |
The Exe address from where this instruction was extracted. Set to -1 if created FromParts . |
Prefixes |
List of prefix bytes. |
Codes |
List of opcode bytes. |
MRM |
The extracted/calculated ModRM object. |
SIB |
The extracted/calculated SIBase object. |
Disp |
The displacement value used for any memory pointers. It can be undefined . |
BC_Disp |
The byte count of the displacement. The default is 0 for no displacement. |
Immd |
The immediate value used. It can be undefined . |
BC_Immd |
The byte count of the immediate value. The default is 0 for no immediates. |
SegNum |
Segment number for FAR type instructions. |
NestLvl |
Nesting level used for ENTER instruction. |
Size |
The total size of the instruction in bytes. |
NextAddr |
The address for the next instruction. |
-
<inst>.addPrefix(p)
Adds the prefix to the instruction. Can be IPrefix or the hex code itself.
-
<inst>.addOpCode(o)
Adds the opcode byte(s) to the instruction.
-
<inst>.needModRM()
Checks if the instruction requires a ModRM object.
-
<inst>.isReversed()
Checks if the instruction has to reverse its argument order.
-
<inst>.hasAddrOvrd()
Checks if the instruction has an address override prefix (AD16).
-
<inst>.hasOperOvrd()
Checks if the instruction has an operand override prefix (OPCH).
-
<inst>.calcImmSize()
Calculates the size of immediate value expected.BC_Immd
property is set to the calculated value.
-
<inst>.toString
Override for toString to construct and return the hex equivalent of the instruction.