### Specific ZydisISAExt Enumerator Example Source: https://doc.zydis.re/master/html/EnumISAExt_8h_source.html Example of a specific enumerator value within the ZydisISAExt enum. This particular enumerator represents the WAITPKG instruction set extension. ```c ZYDIS_ISA_EXT_WAITPKG ``` -------------------------------- ### Encode MOV Instruction with Zydis Source: https://doc.zydis.re/master/html/index.html This C example demonstrates how to use Zydis to encode a MOV instruction. It requires the Zydis library to be included. ```c #include #include int main(int argc, char **argv) { // Initialize Zydis encoder ZydisEncoder encoder; ZydisEncoderInit(&encoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64); // Initialize instruction ZydisDecodedInstruction instruction; ZydisDecoderDecodeBuffer(&decoder, "\x48\xC7\xC0\x37\x13\x00\x00", 7, &instruction); // Encode instruction ZyanU8 buffer[16]; ZyanUSize encodedLen = 0; if (ZYAN_SUCCESS(ZydisEncoderEncodeInstruction(&encoder, &instruction, buffer, sizeof(buffer), &encodedLen))) { // Print encoded instruction for (ZyanUSize i = 0; i < encodedLen; i++) { printf("%02X ", buffer[i]); } printf("\n"); } return 0; } ``` -------------------------------- ### Disassemble Memory Buffer with Zydis Source: https://doc.zydis.re/master/html/index.html This C example demonstrates how to use Zydis to disassemble a memory buffer and print the output. It requires the Zydis library to be included. ```c #include #include int main(int argc, char **argv) { // Initialize Zydis decoder ZydisDecoder decoder; ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64); // Initialize runtime data ZydisDecodedInstruction instruction; ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT]; // Example machine code (e.g. push rcx; lea eax, [rbp-0x01]; push rax; push qword ptr [rbp+0x0C]; push qword ptr [rbp+0x08]; call [0x008000007588A5B1]; test eax, eax; js 0x007FFFFFFF42DB15) const ZyanU8 machineCode[] = { 0x51, 0x8D, 0x45, 0xFF, 0x50, 0xFF, 0x75, 0x0C, 0xFF, 0x75, 0x08, 0xFF, 0x15, 0xB1, 0xA5, 0x88, 0x00, 0x00, 0x00, 0x00, 0x85, 0xC0, 0x79, 0x15, 0x42, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; const ZyanUSize machineCodeLen = sizeof(machineCode) / sizeof(machineCode[0]); // Disassemble machine code if (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, machineCode, machineCodeLen, &instruction, operands))) { // Format instruction char buffer[256]; ZydisFormatter formatter; ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL); ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, buffer, sizeof(buffer), 0, ZYDIS_FORMATTER_PRINT_OPERAND_COUNT_VISIBLE); // Print instruction printf("%016llX %s\n", instruction.address, buffer); } return 0; } ``` -------------------------------- ### Get Instruction Definition Function Source: https://doc.zydis.re/master/html/SharedData_8h_source.html Retrieves the instruction definition based on encoding and ID. This function is for internal use. ```c ZYDIS_NO_EXPORT void ZydisGetInstructionDefinition(ZydisInstructionEncoding encoding, ZyanU16 id, const ZydisInstructionDefinition** definition); ``` -------------------------------- ### Clone Zydis Repository with Git Source: https://doc.zydis.re/master/html/index.html This command clones the Zydis repository and its submodules. Ensure Git is installed and accessible in your terminal. ```bash git clone --recursive 'https://github.com/zyantific/zydis.git' cd zydis ``` -------------------------------- ### Get Operand Details Function (Non-Minimal Mode) Source: https://doc.zydis.re/master/html/SharedData_8h_source.html Retrieves detailed information about instruction operands. Requires ZYDIS_MINIMAL_MODE to be undefined. ```c #ifndef ZYDIS_MINIMAL_MODE const ZydisOperandDetails* ZydisGetOperandDetails( const ZydisOperandDefinition *definition); #endif ``` -------------------------------- ### Get Zydis Library Version Source: https://doc.zydis.re/master/html/group__version Returns the current Zydis library version. Use version extraction macros to parse the returned value. ```c ZYDIS_EXPORT ZyanU64 ZydisGetVersion | ( | void | | ) ``` -------------------------------- ### Get Element Info Function (Non-Minimal Mode) Source: https://doc.zydis.re/master/html/SharedData_8h_source.html Retrieves type and size information for an internal element. Requires ZYDIS_MINIMAL_MODE to be undefined. ```c #ifndef ZYDIS_MINIMAL_MODE void ZydisGetElementInfo(ZydisInternalElementType element, ZydisElementType* type, ZydisElementSize* size); #endif ``` -------------------------------- ### Another ZydisISAExt Enumerator Example Source: https://doc.zydis.re/master/html/EnumISAExt_8h_source.html Example of another specific enumerator value within the ZydisISAExt enum. This enumerator represents the RAO_INT instruction set extension. ```c ZYDIS_ISA_EXT_RAO_INT ``` -------------------------------- ### ZydisFormatterInit Source: https://doc.zydis.re/master/html/Formatter_8h Initializes the given ZydisFormatter instance with a specified style. ```APIDOC ## ZydisFormatterInit ### Description Initializes the given `ZydisFormatter` instance. ### Parameters - **formatter** (`ZydisFormatter *`) - Required - A pointer to the `ZydisFormatter` instance to initialize. - **style** (`ZydisFormatterStyle`) - Required - The desired formatting style for the formatter. ``` -------------------------------- ### Register Class Width Source: https://doc.zydis.re/master/html/Register_8h_source.html Function to get the width of a register class. ```APIDOC ## ZydisRegisterClassGetWidth ### Description Retrieves the width of a register class for a given machine mode. ### Signature ```c ZYDIS_EXPORT ZydisRegisterWidth ZydisRegisterClassGetWidth(ZydisMachineMode mode, ZydisRegisterClass register_class); ``` ``` -------------------------------- ### Fill Buffer with NOP Instructions Source: https://doc.zydis.re/master/html/Encoder_8h Fills the provided buffer with NOP instructions. It uses the longest possible multi-byte NOP instructions for efficient filling. ```c ZYDIS_EXPORT ZyanStatus | ZydisEncoderNopFill (void *buffer, ZyanUSize length) ``` -------------------------------- ### ZYDIS_DT_GET_VALUE Source: https://doc.zydis.re/master/html/DecoderData_8h Gets the value at a specific index from a decoder tree node. ```APIDOC ## ZYDIS_DT_GET_VALUE ### Description Gets the value at index `index` of the given decoder tree node. ### Macro Definition ```c #define ZYDIS_DT_GET_VALUE(node, index) ((ZyanU16)(*((node) + 1 + (index)))) ``` ### Parameters * **node** - The decoder tree node. * **index** - The index of the value to retrieve. ``` -------------------------------- ### Get Operand Sizes Function (Non-Minimal Mode) Source: https://doc.zydis.re/master/html/SharedData_8h_source.html Retrieves the sizes of operands for an instruction. Requires ZYDIS_MINIMAL_MODE to be undefined. ```c #ifndef ZYDIS_MINIMAL_MODE const ZyanU16* ZydisGetOperandSizes(const ZydisOperandDefinition *definition); #endif ``` -------------------------------- ### Get Operand Definitions Function (Non-Minimal Mode) Source: https://doc.zydis.re/master/html/SharedData_8h_source.html Retrieves operand definitions for an instruction. Requires ZYDIS_MINIMAL_MODE to be undefined. ```c #ifndef ZYDIS_MINIMAL_MODE const ZydisOperandDefinition* ZydisGetOperandDefinitions( const ZydisInstructionDefinition* definition); #endif ``` -------------------------------- ### Default Intel Formatter Preset Source: https://doc.zydis.re/master/html/FormatterIntel_8h_source.html Defines the default configuration for the Intel formatter. This preset is used for standard Intel syntax output. ```c static const ZydisFormatter FORMATTER_INTEL = { /* style */ ZYDIS_FORMATTER_STYLE_INTEL, /* force_memory_size */ ZYAN_FALSE, /* force_memory_seg */ ZYAN_FALSE, /* force_memory_scale */ ZYAN_TRUE, /* force_relative_branches */ ZYAN_FALSE, /* force_relative_riprel */ ZYAN_FALSE, /* print_branch_size */ ZYAN_FALSE, /* detailed_prefixes */ ZYAN_FALSE, /* addr_base */ ZYDIS_NUMERIC_BASE_HEX, /* addr_signedness */ ZYDIS_SIGNEDNESS_SIGNED, /* addr_padding_absolute */ ZYDIS_PADDING_AUTO, /* addr_padding_relative */ 2, /* disp_base */ ZYDIS_NUMERIC_BASE_HEX, /* disp_signedness */ ZYDIS_SIGNEDNESS_SIGNED, /* disp_padding */ 2, /* imm_base */ ZYDIS_NUMERIC_BASE_HEX, /* imm_signedness */ ZYDIS_SIGNEDNESS_UNSIGNED, /* imm_padding */ 2, /* case_prefixes */ ZYDIS_LETTER_CASE_DEFAULT, /* case_mnemonic */ ZYDIS_LETTER_CASE_DEFAULT, /* case_registers */ ZYDIS_LETTER_CASE_DEFAULT, /* case_typecasts */ ZYDIS_LETTER_CASE_DEFAULT, /* case_decorators */ ZYDIS_LETTER_CASE_DEFAULT, /* hex_uppercase */ ZYAN_TRUE, /* hex_force_leading_number */ ZYAN_FALSE, /* number_format */ { // ZYDIS_NUMERIC_BASE_DEC { // Prefix { /* string */ ZYAN_NULL, /* string_data */ ZYAN_DEFINE_STRING_VIEW(""), /* buffer */ { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, }, // Suffix { /* string */ ZYAN_NULL, /* string_data */ ZYAN_DEFINE_STRING_VIEW(""), /* buffer */ { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, } }, // ZYDIS_NUMERIC_BASE_HEX { // Prefix { /* string */ &FORMATTER_INTEL.number_format[ ZYDIS_NUMERIC_BASE_HEX][0].string_data, /* string_data */ ZYAN_DEFINE_STRING_VIEW("0x"), /* buffer */ { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, }, // Suffix { /* string */ ZYAN_NULL, /* string_data */ ZYAN_DEFINE_STRING_VIEW(""), /* buffer */ { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, } } }, /* deco_apx_nf_use_suffix */ ZYAN_FALSE, /* deco_apx_dfv_use_immediate */ ZYAN_FALSE, /* func_pre_instruction */ ZYAN_NULL, /* func_post_instruction */ ZYAN_NULL, /* func_format_instruction */ &ZydisFormatterIntelFormatInstruction, /* func_pre_operand */ ZYAN_NULL, /* func_post_operand */ ZYAN_NULL, /* func_format_operand_reg */ &ZydisFormatterBaseFormatOperandREG, /* func_format_operand_mem */ &ZydisFormatterIntelFormatOperandMEM, /* func_format_operand_ptr */ &ZydisFormatterBaseFormatOperandPTR, /* func_format_operand_imm */ &ZydisFormatterBaseFormatOperandIMM, /* func_print_mnemonic */ &ZydisFormatterIntelPrintMnemonic, /* func_print_register */ &ZydisFormatterIntelPrintRegister, /* func_print_address_abs */ &ZydisFormatterBasePrintAddressABS, /* func_print_address_rel */ &ZydisFormatterBasePrintAddressREL, /* func_print_disp */ &ZydisFormatterIntelPrintDISP, /* func_print_imm */ &ZydisFormatterBasePrintIMM, /* func_print_typecast */ &ZydisFormatterIntelPrintTypecast, /* func_print_segment */ &ZydisFormatterBasePrintSegment, /* func_print_prefixes */ &ZydisFormatterBasePrintPrefixes, /* func_print_decorator */ &ZydisFormatterBasePrintDecorator }; ``` -------------------------------- ### ZydisFormatterTokenizeInstruction Source: https://doc.zydis.re/master/html/Formatter_8h Tokenizes a decoded instruction and writes it to an output buffer. ```APIDOC ## ZydisFormatterTokenizeInstruction ### Description Tokenizes the given instruction and writes it into the output buffer. ### Parameters - **formatter** (`const ZydisFormatter *`) - Required - A pointer to the `ZydisFormatter` instance. - **instruction** (`const ZydisDecodedInstruction *`) - Required - A pointer to the decoded instruction. - **operands** (`const ZydisDecodedOperand *`) - Required - A pointer to an array of decoded operands. - **operand_count** (`ZyanU8`) - Required - The number of operands. - **buffer** (`void *`) - Required - The output buffer to write the tokenized instruction to. - **length** (`ZyanUSize`) - Required - The size of the output buffer. - **runtime_address** (`ZyanU64`) - Required - The runtime address of the instruction. - **token** (`ZydisFormatterTokenConst **`) - Required - A pointer to a pointer that will receive the tokenized instruction. - **user_data** (`void *`) - Optional - User-defined data to be passed to callbacks. ``` -------------------------------- ### ZydisGetInstructionDefinition Source: https://doc.zydis.re/master/html/SharedData_8h_source.html Retrieves the instruction definition based on encoding and ID. ```APIDOC ## ZydisGetInstructionDefinition ### Description Returns the instruction-definition with the given encoding and id. ### Function Signature ```c void ZydisGetInstructionDefinition(ZydisInstructionEncoding encoding, ZyanU16 id, const ZydisInstructionDefinition **definition) ``` ### Parameters * **encoding** (ZydisInstructionEncoding) - The instruction encoding. * **id** (ZyanU16) - The instruction identifier. * **definition** (const ZydisInstructionDefinition **) - A pointer to a pointer where the instruction definition will be stored. ### Returns This function does not return a value directly, but populates the `definition` pointer. ``` -------------------------------- ### Macro for Appending Strings or Token Lists Source: https://doc.zydis.re/master/html/FormatterBase_8h Use this macro to append a string (STR_-prefix) or a predefined token-list (TOK_-prefix) to the buffer. It handles both token lists and direct string appending. ```c #define ZYDIS_BUFFER_APPEND(buffer, name) \ if ((buffer)->is_token_list) \ { \ ZYAN_CHECK(ZydisFormatterBufferAppendPredefined(buffer, TOK_ ## name)); \ } else \ { \ ZYAN_CHECK(ZydisStringAppendShort(&buffer->string, &STR_ ## name)); \ } ``` -------------------------------- ### ZydisDecodedOperandImm_ Source: https://doc.zydis.re/master/html/DecoderTypes_8h_source.html Extended info for immediate-operands. ```APIDOC ## ZydisDecodedOperandImm_ ### Description Extended info for immediate-operands. ### Fields - **is_address** (ZyanBool) - Signals, if the immediate value contains an address. - **size** (ZyanU8) - The physical immediate size, in bits. - **is_relative** (ZyanBool) - Signals, if the immediate value contains a relative offset. - **is_signed** (ZyanBool) - Signals, if the immediate value is signed. - **offset** (ZyanU8) - The offset of the immediate data, relative to the beginning of the instruction, in bytes. - **value** (union ZydisDecodedOperandImm_::ZydisDecodedOperandImmValue_) - The immediate value. ``` -------------------------------- ### Calculate Absolute Address with Register Context (ZydisCalcAbsoluteAddressEx) Source: https://doc.zydis.re/master/html/group__utils Similar to ZydisCalcAbsoluteAddress, but includes a register context for calculating addresses dependent on runtime register values. IP/EIP/RIP from the context are ignored in favor of the provided runtime_address. ```c ZYDIS_EXPORT ZyanStatus ZydisCalcAbsoluteAddressEx | ( | const ZydisDecodedInstruction * | _instruction_ , | | const ZydisDecodedOperand * | _operand_ , | | ZyanU64 | _runtime_address_ , | | const ZydisRegisterContext * | _register_context_ , | | ZyanU64 * | _result_address_ | ) | | ``` -------------------------------- ### ZydisFormatterIntelPrintDISP Source: https://doc.zydis.re/master/html/FormatterIntel_8h Prints a displacement in Intel syntax. ```APIDOC ## ZydisFormatterIntelPrintDISP() ### Description Prints a displacement in Intel syntax. ### Signature ZyanStatus ZydisFormatterIntelPrintDISP(const ZydisFormatter * _formatter_, ZydisFormatterBuffer * _buffer_, ZydisFormatterContext * _context_) ``` -------------------------------- ### Get Accessed Flags Function (Non-Minimal Mode) Source: https://doc.zydis.re/master/html/SharedData_8h_source.html Retrieves the CPU and FPU flags accessed by an instruction definition. Requires ZYDIS_MINIMAL_MODE to be undefined. ```c #ifndef ZYDIS_MINIMAL_MODE ZyanBool ZydisGetAccessedFlags(const ZydisInstructionDefinition* definition, const ZydisDefinitionAccessedFlags** flags); #endif ``` -------------------------------- ### ZydisAddressSizeHint Enumeration Source: https://doc.zydis.re/master/html/Encoder_8h Defines possible values for address size hints. The MAX_VALUE is explicitly set to 64 bits. ```c enum | ZydisAddressSizeHint_ { ZYDIS_ADDRESS_SIZE_HINT_NONE , ZYDIS_ADDRESS_SIZE_HINT_16 , ZYDIS_ADDRESS_SIZE_HINT_32 , ZYDIS_ADDRESS_SIZE_HINT_64 , ZYDIS_ADDRESS_SIZE_HINT_MAX_VALUE = ZYDIS_ADDRESS_SIZE_HINT_64 , ZYDIS_ADDRESS_SIZE_HINT_REQUIRED_BITS = } ``` -------------------------------- ### ZydisFormatterATTPrintIMM Source: https://doc.zydis.re/master/html/FormatterATT_8h Prints an immediate value for AT&T syntax. ```APIDOC ## ZydisFormatterATTPrintIMM ### Description Prints an immediate value for AT&T syntax. ### Signature ```c ZyanStatus ZydisFormatterATTPrintIMM( const ZydisFormatter* _formatter, ZydisFormatterBuffer* _buffer, ZydisFormatterContext* _context ); ``` ``` -------------------------------- ### Zydis Decoder Tree Node Macros Source: https://doc.zydis.re/master/html/DecoderData_8h Macros for manipulating Zydis decoder tree nodes, including getting the node type, arguments, and values. ```APIDOC #define ZYDIS_DT_GET_TYPE(node) ((ZydisDecoderTreeNodeType)((*(node)) & 0xFF)) // Gets the type of the given decoder tree node. #define ZYDIS_DT_GET_ARG0(node) ((ZyanU8)(((*(node)) >> 8) & 0xFF)) // Gets the first argument of the given decoder tree node. #define ZYDIS_DT_GET_VALUE(node, index) ((ZyanU16)(*((node) + 1 + (index)))) // Gets the value at index `index` of the given decoder tree node. ``` -------------------------------- ### ZydisFormatterIntelPrintRegister Source: https://doc.zydis.re/master/html/FormatterIntel_8h Prints a register in Intel syntax. ```APIDOC ## ZydisFormatterIntelPrintRegister() ### Description Prints a register in Intel syntax. ### Signature ZyanStatus ZydisFormatterIntelPrintRegister(const ZydisFormatter * _formatter_, ZydisFormatterBuffer * _buffer_, ZydisFormatterContext * _context_, ZydisRegister _reg_) ``` -------------------------------- ### Example Class Definitions for Doxygen Graph Source: https://doc.zydis.re/master/html/graph_legend.html These C++ class definitions are used to demonstrate how doxygen generates inheritance and containment graphs. They showcase different inheritance types (public, protected, private) and template usage. ```cpp /*! Invisible class because of truncation */ class Invisible { }; /*! Truncated class, inheritance relation is hidden */ class Truncated : public Invisible { }; /* Class not documented with doxygen comments */ class Undocumented { }; /*! Class that is inherited using public inheritance */ class PublicBase : public Truncated { }; /*! A template class */ template class Templ { }; /*! Class that is inherited using protected inheritance */ class ProtectedBase { }; /*! Class that is inherited using private inheritance */ class PrivateBase { }; /*! Class that is used by the Inherited class */ class Used { }; /*! Super class that inherits a number of other classes */ class Inherited : public PublicBase, protected ProtectedBase, private PrivateBase, public Undocumented, public Templ { private: Used *m_usedClass; }; ``` -------------------------------- ### ZydisFormatterIntelPrintMnemonic Source: https://doc.zydis.re/master/html/FormatterIntel_8h Prints a mnemonic in Intel syntax. ```APIDOC ## ZydisFormatterIntelPrintMnemonic() ### Description Prints a mnemonic in Intel syntax. ### Signature ZyanStatus ZydisFormatterIntelPrintMnemonic(const ZydisFormatter * _formatter_, ZydisFormatterBuffer * _buffer_, ZydisFormatterContext * _context_) ``` -------------------------------- ### ZYDIS_ATTRIB_ACCEPTS_REPZ Source: https://doc.zydis.re/master/html/group__instruction__attributes Indicates that the instruction accepts the REPE/REPZ prefix (0xF3). ```c #define ZYDIS_ATTRIB_ACCEPTS_REPZ ZYDIS_ATTRIB_ACCEPTS_REPE ``` -------------------------------- ### ZYDIS_ATTRIB_ACCEPTS_XACQUIRE Source: https://doc.zydis.re/master/html/group__instruction__attributes Indicates that the instruction accepts the XACQUIRE prefix (0xF2). ```c #define ZYDIS_ATTRIB_ACCEPTS_XACQUIRE (1ULL << 21) ``` -------------------------------- ### ZydisMnemonicGetStringWrapped Source: https://doc.zydis.re/master/html/Mnemonic_8h Retrieves the specified instruction mnemonic as a ZydisShortString. This provides a wrapped string format for the mnemonic. ```APIDOC ## ZydisMnemonicGetStringWrapped ### Description Returns the specified instruction mnemonic as `ZydisShortString`. ### Signature `const ZydisShortString * ZydisMnemonicGetStringWrapped(ZydisMnemonic mnemonic)` ### Parameters * **mnemonic** (ZydisMnemonic) - The mnemonic to retrieve the wrapped string for. ### Returns * `const ZydisShortString *` - A pointer to a `ZydisShortString` structure representing the mnemonic. ``` -------------------------------- ### ZydisDecoderDecodeInstruction Source: https://doc.zydis.re/master/html/Decoder_8h_source.html Decodes an instruction from a buffer, returning only the instruction details. ```APIDOC ## ZydisDecoderDecodeInstruction ### Description Decodes the instruction in the given input buffer. ### Signature ```c ZYDIS_EXPORT ZyanStatus ZydisDecoderDecodeInstruction(const ZydisDecoder* decoder, ZydisDecoderContext* context, const void* buffer, ZyanUSize length, ZydisDecodedInstruction* instruction); ``` ### Parameters - **decoder** (*const ZydisDecoder*): A pointer to the initialized ZydisDecoder instance. - **context** (*ZydisDecoderContext*): A pointer to the decoder context. - **buffer** (*const void*): A pointer to the buffer containing the instruction to decode. - **length** (*ZyanUSize*): The length of the instruction buffer. - **instruction** (*ZydisDecodedInstruction*): A pointer to a structure that will be populated with the decoded instruction information. ``` -------------------------------- ### ZYDIS_ATTRIB_ACCEPTS_XRELEASE Source: https://doc.zydis.re/master/html/group__instruction__attributes Indicates that the instruction accepts the XRELEASE prefix (0xF3). ```c #define ZYDIS_ATTRIB_ACCEPTS_XRELEASE (1ULL << 22) ``` -------------------------------- ### ZydisFormatterIntel Configuration Source: https://doc.zydis.re/master/html/FormatterIntel_8h_source.html Defines the configuration for the Zydis Intel formatter, including number formatting styles, letter casing for different elements, and function pointers for custom formatting logic. This structure allows for extensive customization of disassembly output. ```c /* addr_base */ ZYDIS_NUMERIC_BASE_HEX, /* addr_signedness */ ZYDIS_SIGNEDNESS_SIGNED, /* addr_padding_absolute */ ZYDIS_PADDING_DISABLED, /* addr_padding_relative */ ZYDIS_PADDING_DISABLED, /* disp_base */ ZYDIS_NUMERIC_BASE_HEX, /* disp_signedness */ ZYDIS_SIGNEDNESS_SIGNED, /* disp_padding */ ZYDIS_PADDING_DISABLED, /* imm_base */ ZYDIS_NUMERIC_BASE_HEX, /* imm_signedness */ ZYDIS_SIGNEDNESS_AUTO, /* imm_padding */ ZYDIS_PADDING_DISABLED, /* case_prefixes */ ZYDIS_LETTER_CASE_DEFAULT, /* case_mnemonic */ ZYDIS_LETTER_CASE_DEFAULT, /* case_registers */ ZYDIS_LETTER_CASE_DEFAULT, /* case_typecasts */ ZYDIS_LETTER_CASE_DEFAULT, /* case_decorators */ ZYDIS_LETTER_CASE_DEFAULT, /* hex_uppercase */ ZYAN_TRUE, /* hex_force_leading_number */ ZYAN_TRUE, /* number_format */ { // ZYDIS_NUMERIC_BASE_DEC { // Prefix { /* string */ ZYAN_NULL, /* string_data */ ZYAN_DEFINE_STRING_VIEW(""), /* buffer */ { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, }, // Suffix { /* string */ ZYAN_NULL, /* string_data */ ZYAN_DEFINE_STRING_VIEW(""), /* buffer */ { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, } }, // ZYDIS_NUMERIC_BASE_HEX { // Prefix { /* string */ ZYAN_NULL, /* string_data */ ZYAN_DEFINE_STRING_VIEW(""), /* buffer */ { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, }, // Suffix { /* string */ &FORMATTER_INTEL_MASM.number_format[ ZYDIS_NUMERIC_BASE_HEX][1].string_data, /* string_data */ ZYAN_DEFINE_STRING_VIEW("h"), /* buffer */ { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, } } }, /* deco_apx_nf_use_suffix */ ZYAN_FALSE, /* deco_apx_dfv_use_immediate */ ZYAN_FALSE, /* func_pre_instruction */ ZYAN_NULL, /* func_post_instruction */ ZYAN_NULL, /* func_format_instruction */ &ZydisFormatterIntelFormatInstructionMASM, /* func_pre_operand */ ZYAN_NULL, /* func_post_operand */ ZYAN_NULL, /* func_format_operand_reg */ &ZydisFormatterBaseFormatOperandREG, /* func_format_operand_mem */ &ZydisFormatterIntelFormatOperandMEM, /* func_format_operand_ptr */ &ZydisFormatterBaseFormatOperandPTR, /* func_format_operand_imm */ &ZydisFormatterBaseFormatOperandIMM, /* func_print_mnemonic */ &ZydisFormatterIntelPrintMnemonic, /* func_print_register */ &ZydisFormatterIntelPrintRegister, /* func_print_address_abs */ &ZydisFormatterIntelPrintAddressMASM, /* func_print_address_rel */ &ZydisFormatterIntelPrintAddressMASM, /* func_print_disp */ &ZydisFormatterIntelPrintDISP, /* func_print_imm */ &ZydisFormatterBasePrintIMM, /* func_print_typecast */ &ZydisFormatterIntelPrintTypecast, /* func_print_segment */ &ZydisFormatterBasePrintSegment, /* func_print_prefixes */ &ZydisFormatterBasePrintPrefixes, /* func_print_decorator */ &ZydisFormatterBasePrintDecorator }; ``` -------------------------------- ### ZydisAddressSizeHint Source: https://doc.zydis.re/master/html/Encoder_8h Defines possible values for address size hints used in encoding. ```APIDOC ## ZydisAddressSizeHint ### Description Defines possible values for address size hints. See `ZydisEncoderRequest` for more information about address size hints. ### Enum Values - **ZYDIS_ADDRESS_SIZE_HINT_NONE** - **ZYDIS_ADDRESS_SIZE_HINT_16** - **ZYDIS_ADDRESS_SIZE_HINT_32** - **ZYDIS_ADDRESS_SIZE_HINT_64** - **ZYDIS_ADDRESS_SIZE_HINT_MAX_VALUE** - **ZYDIS_ADDRESS_SIZE_HINT_REQUIRED_BITS** ``` -------------------------------- ### ZydisFormatterBasePrintPrefixes Source: https://doc.zydis.re/master/html/FormatterBase_8h_source.html Prints instruction prefixes to the formatter buffer. This function handles the formatting and output of various instruction prefixes. ```APIDOC ## ZydisFormatterBasePrintPrefixes ### Description Prints instruction prefixes to the formatter buffer. This function handles the formatting and output of various instruction prefixes. ### Method `ZyanStatus ZydisFormatterBasePrintPrefixes(const ZydisFormatter* formatter, ZydisFormatterBuffer* buffer, ZydisFormatterContext* context)` ### Parameters - `formatter` (const ZydisFormatter*): Pointer to the formatter instance. - `buffer` (ZydisFormatterBuffer*): Pointer to the buffer where the formatted output will be written. - `context` (ZydisFormatterContext*): Pointer to the context structure containing decoding information. ``` -------------------------------- ### CPUID Instruction Enable (ID) Source: https://doc.zydis.re/master/html/group__decoder__cpu__flags Defines the CPUID Instruction Enable (ID) flag. Indicates whether the CPUID instruction is available and can be used. ```c #define ZYDIS_CPUFLAG_ID (1ul << 21) ``` -------------------------------- ### ZydisGetInstructionEncodingInfo Source: https://doc.zydis.re/master/html/DecoderData_8h_source.html Retrieves detailed information about optional instruction encoding parts, such as ModR/M, displacement, and immediate values, for a given decoder tree node. ```APIDOC ## ZydisGetInstructionEncodingInfo ### Description Returns information about optional instruction parts (like modrm, displacement or immediates) for the given decoder tree node. This function helps in understanding the structure and size of various components within an instruction's encoding. ### Prototype ```c void ZydisGetInstructionEncodingInfo(const ZydisDecoderTreeNode* node, const ZydisInstructionEncodingInfo** info); ``` ### Parameters #### Path Parameters - **node** (const ZydisDecoderTreeNode*) - A pointer to the decoder tree node for which to get encoding information. - **info** (const ZydisInstructionEncodingInfo**) - A pointer to a pointer that will be updated to point to the instruction encoding information. ### Returns This function does not return a value directly but populates the `info` parameter with a pointer to `ZydisInstructionEncodingInfo`. ``` -------------------------------- ### Zydis Instruction Definition Base (Full Mode) Source: https://doc.zydis.re/master/html/SharedData_8h_source.html Defines the base structure for instruction definitions when ZYDIS_MINIMAL_MODE is not enabled. Includes detailed fields for instruction properties. ```c # define ZYDIS_INSTRUCTION_DEFINITION_BASE \ ZyanU16 mnemonic ZYAN_BITFIELD(ZYDIS_MNEMONIC_REQUIRED_BITS); \ ZyanU8 operand_count ZYAN_BITFIELD( 4); \ ZyanU8 operand_count_visible ZYAN_BITFIELD( 3); \ ZyanU16 operand_reference ZYAN_BITFIELD(15); \ ZyanU8 operand_size_map ZYAN_BITFIELD( 3); \ ZyanU8 address_size_map ZYAN_BITFIELD( 2); \ ZyanU8 flags_reference ZYAN_BITFIELD( 7); \ ZyanBool requires_protected_mode ZYAN_BITFIELD( 1); \ ZyanBool no_compat_mode ZYAN_BITFIELD( 1); \ ZyanU8 category ZYAN_BITFIELD(ZYDIS_CATEGORY_REQUIRED_BITS); \ ZyanU8 isa_set ZYAN_BITFIELD(ZYDIS_ISA_SET_REQUIRED_BITS); \ ZyanU8 isa_ext ZYAN_BITFIELD(ZYDIS_ISA_EXT_REQUIRED_BITS); \ ZyanU8 branch_type ZYAN_BITFIELD(ZYDIS_BRANCH_TYPE_REQUIRED_BITS); \ ZyanU8 exception_class ZYAN_BITFIELD(ZYDIS_EXCEPTION_CLASS_REQUIRED_BITS); \ ZyanU8 op_reg ZYAN_BITFIELD(ZYDIS_OPDEF_REQUIRED_BITS); \ ZyanU8 op_rm ZYAN_BITFIELD(ZYDIS_OPDEF_REQUIRED_BITS); \ ZyanU8 cpu_state ZYAN_BITFIELD(ZYDIS_RW_ACTION_REQUIRED_BITS); \ ZyanU8 fpu_state ZYAN_BITFIELD(ZYDIS_RW_ACTION_REQUIRED_BITS); \ ZyanU8 xmm_state ZYAN_BITFIELD(ZYDIS_RW_ACTION_REQUIRED_BITS); \ ZyanBool accepts_segment ZYAN_BITFIELD( 1) ``` -------------------------------- ### 3DNow! Instruction Definition Structure Source: https://doc.zydis.re/master/html/SharedData_8h_source.html Defines properties specific to 3DNow! instructions. ```c typedef struct ZydisInstructionDefinition3DNOW_ { ZYDIS_INSTRUCTION_DEFINITION_BASE; } ZydisInstructionDefinition3DNOW; ``` -------------------------------- ### ZYDIS_ATTRIB_HAS_REPE Source: https://doc.zydis.re/master/html/group__instruction__attributes Indicates the instruction has the REPE/REPZ prefix (0xF3). ```c #define ZYDIS_ATTRIB_HAS_REPE (1ULL << 29) ``` -------------------------------- ### ZydisFormatterBasePrintIMM Source: https://doc.zydis.re/master/html/FormatterBase_8h_source.html Prints an immediate value to the formatter buffer. This is a general-purpose function for outputting immediate tokens. ```APIDOC ## ZydisFormatterBasePrintIMM ### Description Prints an immediate value to the formatter buffer. This is a general-purpose function for outputting immediate tokens. ### Method `ZyanStatus ZydisFormatterBasePrintIMM(const ZydisFormatter* formatter, ZydisFormatterBuffer* buffer, ZydisFormatterContext* context)` ### Parameters - `formatter` (const ZydisFormatter*): Pointer to the formatter instance. - `buffer` (ZydisFormatterBuffer*): Pointer to the buffer where the formatted output will be written. - `context` (ZydisFormatterContext*): Pointer to the context structure containing decoding information. ``` -------------------------------- ### ZydisGetCcInfo Source: https://doc.zydis.re/master/html/EncoderData_8h Fetches information about APX conditional instructions. This function helps in understanding the properties of conditional instructions. ```APIDOC ## ZydisGetCcInfo ### Description Fetches information about APX conditional instructions. ### Signature ZyanBool | ZydisGetCcInfo (ZydisMnemonic mnemonic, ZydisSourceConditionCode *scc) ### Parameters * **mnemonic** (ZydisMnemonic) - The mnemonic of the conditional instruction. * **scc** (ZydisSourceConditionCode *) - Output pointer to a `ZydisSourceConditionCode` structure containing information about the condition code. ### Return Value Returns ZYAN_TRUE if information is available, ZYAN_FALSE otherwise. ``` -------------------------------- ### ZydisGetInstructionDefinition Source: https://doc.zydis.re/master/html/SharedData_8h_source.html Retrieves the instruction definition for a given encoding and ID. This is crucial for understanding the properties of a specific instruction. ```APIDOC ## ZydisGetInstructionDefinition ### Description Retrieves the instruction definition for a given encoding and ID. ### Signature ```c void ZydisGetInstructionDefinition(ZydisInstructionEncoding encoding, ZyanU16 id, const ZydisInstructionDefinition** definition); ``` ### Parameters - **encoding** (ZydisInstructionEncoding) - The instruction encoding. - **id** (ZyanU16) - The instruction identifier. - **definition** (const ZydisInstructionDefinition**) - Output pointer to the instruction definition. ``` -------------------------------- ### ZydisDecoderInit Source: https://doc.zydis.re/master/html/Decoder_8h_source.html Initializes the given ZydisDecoder instance with the specified machine mode and stack width. ```APIDOC ## ZydisDecoderInit ### Description Initializes the given ZydisDecoder instance. ### Signature ```c ZYDIS_EXPORT ZyanStatus ZydisDecoderInit(ZydisDecoder* decoder, ZydisMachineMode machine_mode, ZydisStackWidth stack_width); ``` ### Parameters - **decoder** (*ZydisDecoder*): A pointer to the ZydisDecoder instance to initialize. - **machine_mode** (*ZydisMachineMode*): The machine mode (e.g., 64-bit, 32-bit, 16-bit). - **stack_width** (*ZydisStackWidth*): The stack width (e.g., 64-bit, 32-bit, 16-bit). ``` -------------------------------- ### ZYDIS_ATTRIB_ACCEPTS_REPNZ Source: https://doc.zydis.re/master/html/group__instruction__attributes Indicates that the instruction accepts the REPNE/REPNZ prefix (0xF2). ```c #define ZYDIS_ATTRIB_ACCEPTS_REPNZ ZYDIS_ATTRIB_ACCEPTS_REPNE ``` -------------------------------- ### ZYDIS_ATTRIB_HAS_REPNE Source: https://doc.zydis.re/master/html/group__instruction__attributes Indicates the instruction has the REPNE/REPNZ prefix (0xF2). ```c #define ZYDIS_ATTRIB_HAS_REPNE (1ULL << 30) ``` -------------------------------- ### ZydisGetVersion() Source: https://doc.zydis.re/master/html/group__version Retrieves the current Zydis library version. The returned value is a 64-bit integer that can be parsed using version macros. ```APIDOC ## ◆ ZydisGetVersion() ZYDIS_EXPORT ZyanU64 ZydisGetVersion | ( | void | | ) Returns The zydis version. Use the macros provided in this file to extract the major, minor, patch and build part from the returned version value. ``` -------------------------------- ### Macro for Appending Strings with Letter Case Source: https://doc.zydis.re/master/html/FormatterBase_8h Use this macro to append a string (STR_-prefix) or a predefined token-list (TOK_-prefix) to the buffer, with control over the letter case. It handles both token lists and direct string appending with casing. ```c #define ZYDIS_BUFFER_APPEND_CASE(buffer, name, letter_case) \ if ((buffer)->is_token_list) \ { \ ZYAN_CHECK(ZydisFormatterBufferAppendPredefined(buffer, TOK_ ## name)); \ } else \ { \ ZYAN_CHECK(ZydisStringAppendShortCase(&buffer->string, &STR_ ## name, letter_case)); \ } ``` -------------------------------- ### ZydisDecodedInstructionRaw_ Source: https://doc.zydis.re/master/html/DecoderTypes_8h_source.html Detailed info about different instruction-parts like ModRM, SIB or encoding-prefixes. ```APIDOC ## ZydisDecodedInstructionRaw_ ### Description Detailed info about different instruction-parts like ModRM, SIB or encoding-prefixes. ### Members - **rex** (ZydisDecodedInstructionRawRex) - REX prefix info. - **prefix_count** (ZyanU8) - The number of legacy prefixes. - **prefixes** (struct ZydisDecodedInstructionRaw_::ZydisDecodedInstructionRawPrefixes_ prefixes[ZYDIS_MAX_INSTRUCTION_LENGTH]) - Array of legacy prefixes. - **imm** (struct ZydisDecodedInstructionRaw_::ZydisDecodedInstructionRawImm_ imm[2]) - Immediate values. - **mvex** (ZydisDecodedInstructionRawMvex) - MVEX prefix info. - **xop** (ZydisDecodedInstructionRawXop) - XOP prefix info. - **modrm** (struct ZydisDecodedInstructionRaw_::ZydisDecodedInstructionModRm_) - ModRM byte info. - **encoding2** (ZydisInstructionEncoding) - The instruction encoding (e.g., LEGACY, VEX, EVEX, XOP). - **evex** (ZydisDecodedInstructionRawEvex) - EVEX prefix info. - **rex2** (ZydisDecodedInstructionRawRex2) - REX2 prefix info. - **disp** (struct ZydisDecodedInstructionRaw_::ZydisDecodedInstructionRawDisp_) - Displacement info. - **sib** (struct ZydisDecodedInstructionRaw_::ZydisDecodedInstructionRawSib_) - SIB byte info. - **vex** (ZydisDecodedInstructionRawVex) - VEX prefix info. ``` -------------------------------- ### ZYDIS_FORMATTER_FUNC_PRE_INSTRUCTION Source: https://doc.zydis.re/master/html/Formatter_8h_source.html The ZYDIS_FORMATTER_FUNC_PRE_INSTRUCTION function is called before an instruction is formatted, allowing for pre-processing. ```APIDOC ## ZydisFormatter_::func_pre_instruction ### Description The ZYDIS_FORMATTER_FUNC_PRE_INSTRUCTION function. ### Definition Formatter.h:941 ``` -------------------------------- ### ZydisFormatterBaseFormatOperandIMM Source: https://doc.zydis.re/master/html/FormatterBase_8h Formats an immediate operand. ```APIDOC ## ZydisFormatterBaseFormatOperandIMM ### Description Formats an immediate operand. ### Signature ```c ZyanStatus ZydisFormatterBaseFormatOperandIMM (const ZydisFormatter *formatter, ZydisFormatterBuffer *buffer, ZydisFormatterContext *context) ``` ### Parameters - **formatter** (*const ZydisFormatter*): Pointer to the formatter instance. - **buffer** (*ZydisFormatterBuffer*): Pointer to the formatter buffer. - **context** (*ZydisFormatterContext*): Pointer to the formatter context. ``` -------------------------------- ### Build Zydis with CMake Source: https://doc.zydis.re/master/html/index.html These CMake commands build the Zydis library using a parallel build process. This is a common method for cross-platform C/C++ projects. ```bash cmake -B build cmake --build build -j4 ``` -------------------------------- ### ZydisGetOperandDetails Source: https://doc.zydis.re/master/html/SharedData_8h_source.html Retrieves detailed information about the operands associated with an instruction definition. ```APIDOC ## ZydisGetOperandDetails ### Description Retrieves detailed information about the operands associated with an instruction definition. ### Signature ```c const ZydisOperandDetails* ZydisGetOperandDetails(const ZydisOperandDefinition *definition); ``` ### Parameters - **definition** (const ZydisOperandDefinition*) - The operand definition. ### Returns - (const ZydisOperandDetails*) A pointer to the operand details. ``` -------------------------------- ### ZydisGetEncodableInstructions Source: https://doc.zydis.re/master/html/EncoderData_8h_source.html Fetches an array of `ZydisEncodableInstruction` structures and their size for a given instruction mnemonic. This function is crucial for understanding the possible encodings of an instruction. ```APIDOC ## ZydisGetEncodableInstructions ### Description Fetches an array of `ZydisEncodableInstruction` structures and its size for a given instruction mnemonic. ### Function Signature `ZyanU8 ZydisGetEncodableInstructions(ZydisMnemonic mnemonic, const ZydisEncodableInstruction **instruction)` ### Parameters #### Path Parameters - **mnemonic** (`ZydisMnemonic`) - The mnemonic of the instruction to retrieve encodable information for. - **instruction** (`const ZydisEncodableInstruction **`) - A pointer to a pointer that will be populated with the array of encodable instruction structures. ### Return Value - **ZyanU8** - The number of encodable instruction definitions found for the given mnemonic. ``` -------------------------------- ### Define No Default Flags (NONE) Source: https://doc.zydis.re/master/html/group__decoder__apx__default__flags Represents the state where no default flags are set. This is the initial or cleared state. ```c #define ZYDIS_DFV_NONE 0 ```