Scripted API

Scripted API

Table of Contents

• Strings & Error Messages
• Hex Codes
• Common Instructions
• Misc Items
• Classes
• Functions
• Addons
• Generators

Strings & Error Messages

Name	Description
YMLFILTER	Filter string for YAML files. Used with user inputs of D_InFile [DataType]
TAB	4 blank spaces used in console object methods
NO_ALLOC	Error message to use when Exe.FindSpace returns -1
NO_EXE	Error message to use in extensions after testing Exe.FileSize == 0
NO_OUTPUT	Error message to use when TextFile's Open & BinFile's Open functions fail

Hex Codes

Name	Description
WC	Wild Card byte ??
WCp	Positive Wild Card byte
WCn	Negative Wild Card byte
ALLWC	DWORD with all Wild Cards
ALLWCp	DWORD with all Wild Cards having +ve sign bit
ALLWCn	DWORD with all Wild Cards having -ve sign bit
ALL00	DWORD with all zeroes
POS1WC	Positive DWORD with 1 Lower Wild Card bytes
POS2WC	Positive DWORD with 2 Lower Wild Card bytes
POS3WC	Positive DWORD with 3 Lower Wild Card bytes
POS4WC	Positive DWORD with 3 Lower Wild Card bytes & partial Wild Card MSB
ALLFF	DWORD for -1
NEG1WC	Negative DWORD with 1 Lower Wild Card bytes
NEG2WC	Negative DWORD with 2 Lower Wild Card bytes
NEG3WC	Negative DWORD with 3 Lower Wild Card bytes
NEG4WC	Negative DWORD with 3 Lower Wild Card bytes & partial Wild Card MSB

Common Instructions

• PUSH_0
• PUSH_1
• PUSH_2
• PUSH_R (PUSH Reg32)
• PUSH_EAX
• POP_R (POP Reg32)

Misc Items

• OpCodeList
  Mapping of various opcodes. Used internally by Instr class.

• OpTypes Collection of Operand types. It has the following keys. Used by Instr class & Generators

  Key	Description
  OpTypes.ERR	Illegal operation
  OpTypes.A	Acc <, Imm>
  OpTypes.R	Reg <, Imm>
  OpTypes.I	<Imm>
  OpTypes.R_R	Reg, Reg <, Imm>
  OpTypes.D_A	Ptr [Disp], Acc <, Imm>
  OpTypes.P_R	Ptr [...], Reg <, Imm>
  OpTypes.A_D	Acc, Ptr [Disp] <, Imm>
  OpTypes.R_P	Reg, Ptr [...] <, Imm>

  Legend

  • Imm = Immediate value (Number or Hex) which is optional and depends on the instruction whether they will be present or not.
  • Reg = Any Register object.
  • Acc = Any primary Register object. For general purpose registers this would be the Accumulator (hence the name).
  • Ptr [...] = Memory Pointer which takes the generic form [scale*reg + reg + displacement], all parts of which are optional, but atleast 1 should be there.
  • Ptr [Disp] = Memory Pointer with only Displacement.

Classes

Following classes are available. Only Instr is usually used for the creation of new objects in code.

• Register - Represents various CPU registers.
• PtrSize - Represents data size of Memory Pointers.
• IPrefix - Represents instruction prefixes
• ModRM - Represents ModRM byte
• SIBase - Represents SIB byte
• Instr - Represents a CPU instruction

Register, PtrSize & IPrefix classes already have pre-made objects covering all known values, so ideally we would be using those instead of creating new objects from these classes. Click the links to know more.

There is also an OpData class used for parsing Instruction arguments internally, but it is of no use in regular code.

Functions

Addons

Generators