Zydis  v2.0
Data Structures | Typedefs | Enumerations | Functions
Formatter.h File Reference

Functions for formatting human-readable instructions. More...

#include <Zycore/Defines.h>
#include <Zydis/DecoderTypes.h>
#include <Zydis/Status.h>
#include <Zydis/String.h>

Go to the source code of this file.

Data Structures

struct  ZydisFormatterContext_
 Defines the ZydisFormatterContext struct. More...
 
struct  ZydisFormatter_
 Defines the ZydisFormatter struct. More...
 

Typedefs

typedef enum ZydisFormatterStyle_ ZydisFormatterStyle
 Defines the ZydisFormatterStyle enum.
 
typedef enum ZydisFormatterProperty_ ZydisFormatterProperty
 Defines the ZydisFormatterProperty enum.
 
typedef enum ZydisAddressFormat_ ZydisAddressFormat
 Defines the ZydisAddressFormat enum.
 
typedef enum ZydisDisplacementFormat_ ZydisDisplacementFormat
 Defines the ZydisDisplacementFormat enum.
 
typedef enum ZydisImmediateFormat_ ZydisImmediateFormat
 Defines the ZydisImmediateFormat enum.
 
typedef enum ZydisFormatterHookType_ ZydisFormatterHookType
 Defines the ZydisFormatterHookType enum.
 
typedef enum ZydisDecoratorTypes_ ZydisDecoratorType
 Defines the ZydisDecoratorType enum.
 
typedef struct ZydisFormatter_ ZydisFormatter
 
typedef struct ZydisFormatterContext_ ZydisFormatterContext
 Defines the ZydisFormatterContext struct.
 
typedef ZyanStatus(* ZydisFormatterFunc) (const ZydisFormatter *formatter, ZydisString *string, ZydisFormatterContext *context)
 Defines the ZydisFormatterFunc function pointer. More...
 
typedef ZyanStatus(* ZydisFormatterRegisterFunc) (const ZydisFormatter *formatter, ZydisString *string, ZydisFormatterContext *instruction, ZydisRegister reg)
 Defines the ZydisFormatterRegisterFunc function pointer. More...
 
typedef ZyanStatus(* ZydisFormatterAddressFunc) (const ZydisFormatter *formatter, ZydisString *string, ZydisFormatterContext *context, ZyanU64 address)
 Defines the ZydisFormatterAddressFunc function pointer. More...
 
typedef ZyanStatus(* ZydisFormatterDecoratorFunc) (const ZydisFormatter *formatter, ZydisString *string, ZydisFormatterContext *context, ZydisDecoratorType decorator)
 Defines the ZydisFormatterDecoratorFunc function pointer. More...
 

Enumerations

enum  ZydisFormatterStyle_ { ZYDIS_FORMATTER_STYLE_INTEL, ZYDIS_FORMATTER_STYLE_INTEL_MASM, ZYDIS_FORMATTER_STYLE_MAX_VALUE = ZYDIS_FORMATTER_STYLE_INTEL_MASM, ZYDIS_FORMATTER_STYLE_REQUIRED_BITS = 1 }
 Defines the ZydisFormatterStyle enum. More...
 
enum  ZydisFormatterProperty_ {
  ZYDIS_FORMATTER_PROP_UPPERCASE, ZYDIS_FORMATTER_PROP_FORCE_MEMSEG, ZYDIS_FORMATTER_PROP_FORCE_MEMSIZE, ZYDIS_FORMATTER_PROP_ADDR_FORMAT,
  ZYDIS_FORMATTER_PROP_DISP_FORMAT, ZYDIS_FORMATTER_PROP_IMM_FORMAT, ZYDIS_FORMATTER_PROP_HEX_UPPERCASE, ZYDIS_FORMATTER_PROP_HEX_PREFIX,
  ZYDIS_FORMATTER_PROP_HEX_SUFFIX, ZYDIS_FORMATTER_PROP_HEX_PADDING_ADDR, ZYDIS_FORMATTER_PROP_HEX_PADDING_DISP, ZYDIS_FORMATTER_PROP_HEX_PADDING_IMM,
  ZYDIS_FORMATTER_PROP_MAX_VALUE = ZYDIS_FORMATTER_PROP_HEX_PADDING_IMM, ZYDIS_FORMATTER_PROP_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_FORMATTER_PROP_MAX_VALUE)
}
 Defines the ZydisFormatterProperty enum. More...
 
enum  ZydisAddressFormat_ {
  ZYDIS_ADDR_FORMAT_ABSOLUTE, ZYDIS_ADDR_FORMAT_RELATIVE_UNSIGNED, ZYDIS_ADDR_FORMAT_RELATIVE_SIGNED, ZYDIS_ADDR_FORMAT_RELATIVE_ASSEMBLER,
  ZYDIS_ADDR_FORMAT_MAX_VALUE = ZYDIS_ADDR_FORMAT_RELATIVE_ASSEMBLER, ZYDIS_ADDR_FORMAT_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_ADDR_FORMAT_MAX_VALUE)
}
 Defines the ZydisAddressFormat enum. More...
 
enum  ZydisDisplacementFormat_ { ZYDIS_DISP_FORMAT_HEX_SIGNED, ZYDIS_DISP_FORMAT_HEX_UNSIGNED, ZYDIS_DISP_FORMAT_MAX_VALUE = ZYDIS_DISP_FORMAT_HEX_UNSIGNED, ZYDIS_DISP_FORMAT_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_DISP_FORMAT_MAX_VALUE) }
 Defines the ZydisDisplacementFormat enum. More...
 
enum  ZydisImmediateFormat_ {
  ZYDIS_IMM_FORMAT_HEX_AUTO, ZYDIS_IMM_FORMAT_HEX_SIGNED, ZYDIS_IMM_FORMAT_HEX_UNSIGNED, ZYDIS_IMM_FORMAT_MAX_VALUE = ZYDIS_IMM_FORMAT_HEX_UNSIGNED,
  ZYDIS_IMM_FORMAT_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_IMM_FORMAT_MAX_VALUE)
}
 Defines the ZydisImmediateFormat enum. More...
 
enum  ZydisFormatterHookType_ {
  ZYDIS_FORMATTER_HOOK_PRE_INSTRUCTION, ZYDIS_FORMATTER_HOOK_POST_INSTRUCTION, ZYDIS_FORMATTER_HOOK_PRE_OPERAND, ZYDIS_FORMATTER_HOOK_POST_OPERAND,
  ZYDIS_FORMATTER_HOOK_FORMAT_INSTRUCTION, ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_REG, ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_MEM, ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_PTR,
  ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_IMM, ZYDIS_FORMATTER_HOOK_PRINT_MNEMONIC, ZYDIS_FORMATTER_HOOK_PRINT_REGISTER, ZYDIS_FORMATTER_HOOK_PRINT_ADDRESS,
  ZYDIS_FORMATTER_HOOK_PRINT_DISP, ZYDIS_FORMATTER_HOOK_PRINT_IMM, ZYDIS_FORMATTER_HOOK_PRINT_MEMSIZE, ZYDIS_FORMATTER_HOOK_PRINT_PREFIXES,
  ZYDIS_FORMATTER_HOOK_PRINT_DECORATOR, ZYDIS_FORMATTER_HOOK_MAX_VALUE = ZYDIS_FORMATTER_HOOK_PRINT_DECORATOR, ZYDIS_FORMATTER_HOOK_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_FORMATTER_HOOK_MAX_VALUE)
}
 Defines the ZydisFormatterHookType enum. More...
 
enum  ZydisDecoratorTypes_ {
  ZYDIS_DECORATOR_TYPE_INVALID, ZYDIS_DECORATOR_TYPE_MASK, ZYDIS_DECORATOR_TYPE_BC, ZYDIS_DECORATOR_TYPE_RC,
  ZYDIS_DECORATOR_TYPE_SAE, ZYDIS_DECORATOR_TYPE_SWIZZLE, ZYDIS_DECORATOR_TYPE_CONVERSION, ZYDIS_DECORATOR_TYPE_EH,
  ZYDIS_DECORATOR_MAX_VALUE = ZYDIS_DECORATOR_TYPE_EH, ZYDIS_DECORATOR_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_DECORATOR_MAX_VALUE)
}
 Defines the ZydisDecoratorType enum. More...
 

Functions

ZYDIS_EXPORT ZyanStatus ZydisFormatterInit (ZydisFormatter *formatter, ZydisFormatterStyle style)
 Initializes the given ZydisFormatter instance. More...
 
ZYDIS_EXPORT ZyanStatus ZydisFormatterSetProperty (ZydisFormatter *formatter, ZydisFormatterProperty property, ZyanUPointer value)
 Sets the value of the specified formatter attribute. More...
 
ZYDIS_EXPORT ZyanStatus ZydisFormatterSetHook (ZydisFormatter *formatter, ZydisFormatterHookType hook, const void **callback)
 Replaces a formatter function with a custom callback and/or retrieves the currently used function. More...
 
ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatInstruction (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, char *buffer, ZyanUSize length, ZyanU64 address)
 Formats the given instruction and writes it into the output buffer. More...
 
ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatInstructionEx (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, char *buffer, ZyanUSize length, ZyanU64 address, void *user_data)
 Formats the given instruction and writes it into the output buffer. More...
 
ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatOperand (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, ZyanU8 index, char *buffer, ZyanUSize length, ZyanU64 address)
 Formats the given operand and writes it into the output buffer. More...
 
ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatOperandEx (const ZydisFormatter *formatter, const ZydisDecodedInstruction *instruction, ZyanU8 index, char *buffer, ZyanUSize length, ZyanU64 address, void *user_data)
 Formats the given operand and writes it into the output buffer. More...
 

Detailed Description

Functions for formatting human-readable instructions.

Typedef Documentation

◆ ZydisFormatterAddressFunc

typedef ZyanStatus(* ZydisFormatterAddressFunc) (const ZydisFormatter *formatter, ZydisString *string, ZydisFormatterContext *context, ZyanU64 address)

Defines the ZydisFormatterAddressFunc function pointer.

Parameters
formatterA pointer to the ZydisFormatter instance.
stringA pointer to the string.
contextA pointer to the ZydisFormatterContext struct.
addressThe address.
Returns
Returning a status code other than ZYAN_STATUS_SUCCESS will immediately cause the formatting process to fail.

This function type is used for:

  • ZYDIS_FORMATTER_HOOK_PRINT_ADDRESS

◆ ZydisFormatterDecoratorFunc

typedef ZyanStatus(* ZydisFormatterDecoratorFunc) (const ZydisFormatter *formatter, ZydisString *string, ZydisFormatterContext *context, ZydisDecoratorType decorator)

Defines the ZydisFormatterDecoratorFunc function pointer.

Parameters
formatterA pointer to the ZydisFormatter instance.
stringA pointer to the string.
contextA pointer to the ZydisFormatterContext struct.
decoratorThe decorator type.
Returns
Returning a status code other than ZYAN_STATUS_SUCCESS will immediately cause the formatting process to fail.

This function type is used for:

  • ZYDIS_FORMATTER_HOOK_PRINT_DECORATOR

◆ ZydisFormatterFunc

typedef ZyanStatus(* ZydisFormatterFunc) (const ZydisFormatter *formatter, ZydisString *string, ZydisFormatterContext *context)

Defines the ZydisFormatterFunc function pointer.

Parameters
formatterA pointer to the ZydisFormatter instance.
stringA pointer to the string.
contextA pointer to the ZydisFormatterContext struct.
Returns
A zyan status code.

Returning a status code other than ZYAN_STATUS_SUCCESS will immediately cause the formatting process to fail (see exceptions below).

Returning ZYDIS_STATUS_SKIP_TOKEN is valid for ZYDIS_FORMATTER_HOOK_PRE_OPERAND, ZYDIS_FORMATTER_HOOK_POST_OPERAND, all of the ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_XXX callbacks and ZYDIS_FORMATTER_HOOK_PRINT_MEMSIZE.

This function type is used for:

  • ZYDIS_FORMATTER_HOOK_PRE_INSTRUCTION
  • ZYDIS_FORMATTER_HOOK_POST_INSTRUCTION
  • ZYDIS_FORMATTER_HOOK_PRE_OPERAND
  • ZYDIS_FORMATTER_HOOK_POST_OPERAND
  • ZYDIS_FORMATTER_HOOK_FORMAT_INSTRUCTION
  • ZYDIS_FORMATTER_HOOK_PRINT_MNEMONIC
  • ZYDIS_FORMATTER_HOOK_PRINT_PREFIXES
  • ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_REG
  • ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_MEM
  • ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_PTR
  • ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_IMM
  • ZYDIS_FORMATTER_HOOK_PRINT_DISP
  • ZYDIS_FORMATTER_HOOK_PRINT_IMM
  • ZYDIS_FORMATTER_HOOK_PRINT_MEMSIZE

◆ ZydisFormatterRegisterFunc

typedef ZyanStatus(* ZydisFormatterRegisterFunc) (const ZydisFormatter *formatter, ZydisString *string, ZydisFormatterContext *instruction, ZydisRegister reg)

Defines the ZydisFormatterRegisterFunc function pointer.

Parameters
formatterA pointer to the ZydisFormatter instance.
stringA pointer to the string.
contextA pointer to the ZydisFormatterContext struct.
regThe register.
Returns
Returning a status code other than ZYAN_STATUS_SUCCESS will immediately cause the formatting process to fail.

This function type is used for:

  • ZYDIS_FORMATTER_HOOK_PRINT_REGISTER.

Enumeration Type Documentation

◆ ZydisAddressFormat_

Defines the ZydisAddressFormat enum.

Enumerator
ZYDIS_ADDR_FORMAT_ABSOLUTE 

Displays absolute addresses instead of relative ones.

Using this value will cause the formatter to invoke ZYDIS_FORMATTER_HOOK_PRINT_ADDRESS for every address.

ZYDIS_ADDR_FORMAT_RELATIVE_UNSIGNED 

Uses unsigned hexadecimal values to display relative addresses.

The offset is relative to the address of the NEXT instruction (instruction-pointer). The two byte infinity loop (EB FE) instruction is printed as JMP 0xFE for example.

Examples:

  • "JMP 0x20"
  • "JMP 0xE0"
ZYDIS_ADDR_FORMAT_RELATIVE_SIGNED 

Uses signed hexadecimal values to display relative addresses.

The offset is relative to the address of the NEXT instruction (instruction-pointer). The two byte infinity loop (EB FE) instruction is printed as JMP -0x02 for example.

Examples:

  • "JMP 0x20"
  • "JMP -0x20"
ZYDIS_ADDR_FORMAT_RELATIVE_ASSEMBLER 

Uses signed hexadecimal values to display relative addresses that are accepted as direct input by most assemblers (using the $ marker).

The offset is relative to the address of the CURRENT instruction (instruction-address). The two byte infinity loop (EB FE) instruction is printed as JMP $+0x00 for example.

Explicit printing of the EIP/RIP register is disabled for EIP/RIP-relative memory operands in this mode.

ZYDIS_ADDR_FORMAT_MAX_VALUE 

Maximum value of this enum.

ZYDIS_ADDR_FORMAT_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

◆ ZydisDecoratorTypes_

Defines the ZydisDecoratorType enum.

Enumerator
ZYDIS_DECORATOR_TYPE_MASK 

The embedded-mask decorator.

ZYDIS_DECORATOR_TYPE_BC 

The broadcast decorator.

ZYDIS_DECORATOR_TYPE_RC 

The rounding-control decorator.

ZYDIS_DECORATOR_TYPE_SAE 

The suppress-all-exceptions decorator.

ZYDIS_DECORATOR_TYPE_SWIZZLE 

The register-swizzle decorator.

ZYDIS_DECORATOR_TYPE_CONVERSION 

The conversion decorator.

ZYDIS_DECORATOR_TYPE_EH 

The eviction-hint decorator.

ZYDIS_DECORATOR_MAX_VALUE 

Maximum value of this enum.

ZYDIS_DECORATOR_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

◆ ZydisDisplacementFormat_

Defines the ZydisDisplacementFormat enum.

Enumerator
ZYDIS_DISP_FORMAT_HEX_SIGNED 

Formats displacements as signed hexadecimal values.

Examples:

  • "MOV EAX, DWORD PTR SS:[ESP+0x400]"
  • "MOV EAX, DWORD PTR SS:[ESP-0x400]"
ZYDIS_DISP_FORMAT_HEX_UNSIGNED 

Formats displacements as unsigned hexadecimal values.

Examples:

  • "MOV EAX, DWORD PTR SS:[ESP+0x400]"
  • "MOV EAX, DWORD PTR SS:[ESP+0xFFFFFC00]"
ZYDIS_DISP_FORMAT_MAX_VALUE 

Maximum value of this enum.

ZYDIS_DISP_FORMAT_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

◆ ZydisFormatterHookType_

Defines the ZydisFormatterHookType enum.

Enumerator
ZYDIS_FORMATTER_HOOK_PRE_INSTRUCTION 

This function is invoked before the formatter formats an instruction.

ZYDIS_FORMATTER_HOOK_POST_INSTRUCTION 

This function is invoked after the formatter formatted an instruction.

ZYDIS_FORMATTER_HOOK_PRE_OPERAND 

This function is invoked before the formatter formats an operand.

ZYDIS_FORMATTER_HOOK_POST_OPERAND 

This function is invoked after the formatter formatted an operand.

ZYDIS_FORMATTER_HOOK_FORMAT_INSTRUCTION 

This function refers to the main formatting function.

Replacing this function allows for complete custom formatting, but indirectly disables all other hooks except for ZYDIS_FORMATTER_HOOK_PRE_INSTRUCTION and ZYDIS_FORMATTER_HOOK_POST_INSTRUCTION.

ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_REG 

This function is invoked to format a register operand.

ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_MEM 

This function is invoked to format a memory operand.

Replacing this function might indirectly disable some specific calls to the ZYDIS_FORMATTER_HOOK_PRINT_MEMSIZE, ZYDIS_FORMATTER_HOOK_PRINT_ADDRESS and ZYDIS_FORMATTER_HOOK_PRINT_DISP functions.

ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_PTR 

This function is invoked to format a pointer operand.

ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_IMM 

This function is invoked to format an immediate operand.

Replacing this function might indirectly disable some specific calls to the ZYDIS_FORMATTER_HOOK_PRINT_ADDRESS and ZYDIS_FORMATTER_HOOK_PRINT_IMM functions.

ZYDIS_FORMATTER_HOOK_PRINT_MNEMONIC 

This function is invoked to print the instruction mnemonic.

ZYDIS_FORMATTER_HOOK_PRINT_REGISTER 

This function is invoked to print a register.

ZYDIS_FORMATTER_HOOK_PRINT_ADDRESS 

This function is invoked to print an absolute address.

ZYDIS_FORMATTER_HOOK_PRINT_DISP 

This function is invoked to print a memory displacement value.

ZYDIS_FORMATTER_HOOK_PRINT_IMM 

This function is invoked to print an immediate value.

ZYDIS_FORMATTER_HOOK_PRINT_MEMSIZE 

This function is invoked to print the size of a memory operand.

ZYDIS_FORMATTER_HOOK_PRINT_PREFIXES 

This function is invoked to print the instruction prefixes.

ZYDIS_FORMATTER_HOOK_PRINT_DECORATOR 

This function is invoked after formatting an operand to print a EVEX/MVEX decorator.

ZYDIS_FORMATTER_HOOK_MAX_VALUE 

Maximum value of this enum.

ZYDIS_FORMATTER_HOOK_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

◆ ZydisFormatterProperty_

Defines the ZydisFormatterProperty enum.

Enumerator
ZYDIS_FORMATTER_PROP_UPPERCASE 

Controls the letter-case.

Pass ZYAN_TRUE as value to format in uppercase and ZYAN_FALSE to format in lowercase.

The default value is ZYAN_FALSE.

ZYDIS_FORMATTER_PROP_FORCE_MEMSEG 

Controls the printing of segment prefixes.

Pass ZYAN_TRUE as value to force the formatter to always print the segment register of memory-operands or ZYAN_FALSE to ommit implicit DS/SS segments.

The default value is ZYAN_FALSE.

ZYDIS_FORMATTER_PROP_FORCE_MEMSIZE 

Controls the printing of memory-operand sizes.

Pass ZYAN_TRUE as value to force the formatter to always print the size of memory-operands or ZYAN_FALSE to only print it on demand.

The default value is ZYAN_FALSE.

ZYDIS_FORMATTER_PROP_ADDR_FORMAT 

Controls the printing of instruction prefixes.

Pass ZYAN_TRUE as value to print all instruction-prefixes (even ignored or duplicate ones) or ZYAN_FALSE to only print prefixes that are effectively used by the instruction.

The default value is ZYAN_FALSE. Controls the format of addresses.

The default value is ZYDIS_ADDR_FORMAT_ABSOLUTE.

ZYDIS_FORMATTER_PROP_DISP_FORMAT 

Controls the format of displacement values.

The default value is ZYDIS_DISP_FORMAT_HEX_SIGNED.

ZYDIS_FORMATTER_PROP_IMM_FORMAT 

Controls the format of immediate values.

The default value is ZYDIS_IMM_FORMAT_HEX_UNSIGNED.

ZYDIS_FORMATTER_PROP_HEX_UPPERCASE 

Controls the letter-case of hexadecimal values.

Pass ZYAN_TRUE as value to format in uppercase and ZYAN_FALSE to format in lowercase.

The default value is ZYAN_TRUE.

ZYDIS_FORMATTER_PROP_HEX_PREFIX 

Sets the prefix for hexadecimal values.

The default value is "0x".

ZYDIS_FORMATTER_PROP_HEX_SUFFIX 

Sets the suffix for hexadecimal values.

The default value is NULL.

ZYDIS_FORMATTER_PROP_HEX_PADDING_ADDR 

Controls the padding (minimum number of chars) of hexadecimal address values.

The default value is 2.

ZYDIS_FORMATTER_PROP_HEX_PADDING_DISP 

Controls the padding (minimum number of chars) of hexadecimal displacement values.

The default value is 2.

ZYDIS_FORMATTER_PROP_HEX_PADDING_IMM 

Controls the padding (minimum number of chars) of hexadecimal immediate values.

The default value is 2.

ZYDIS_FORMATTER_PROP_MAX_VALUE 

Maximum value of this enum.

ZYDIS_FORMATTER_PROP_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

◆ ZydisFormatterStyle_

Defines the ZydisFormatterStyle enum.

Enumerator
ZYDIS_FORMATTER_STYLE_INTEL 

Generates intel-style disassembly.

ZYDIS_FORMATTER_STYLE_INTEL_MASM 

Generates MASM-style disassembly that is directly accepted as input for the MASM assembler.

ZYDIS_FORMATTER_STYLE_MAX_VALUE 

Maximum value of this enum.

ZYDIS_FORMATTER_STYLE_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

◆ ZydisImmediateFormat_

Defines the ZydisImmediateFormat enum.

Enumerator
ZYDIS_IMM_FORMAT_HEX_AUTO 

Automatically chooses the most suitable formatting-mode based on the operands ZydisOperandInfo.imm.is_signed attribute.

ZYDIS_IMM_FORMAT_HEX_SIGNED 

Formats immediates as signed hexadecimal values.

Examples:

  • "MOV EAX, 0x400"
  • "MOV EAX, -0x400"
ZYDIS_IMM_FORMAT_HEX_UNSIGNED 

Formats immediates as unsigned hexadecimal values.

Examples:

  • "MOV EAX, 0x400"
  • "MOV EAX, 0xFFFFFC00"
ZYDIS_IMM_FORMAT_MAX_VALUE 

Maximum value of this enum.

ZYDIS_IMM_FORMAT_REQUIRED_BITS 

The minimum number of bits required to represent all values of this enum.

Function Documentation

◆ ZydisFormatterFormatInstruction()

ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatInstruction ( const ZydisFormatter formatter,
const ZydisDecodedInstruction instruction,
char *  buffer,
ZyanUSize  length,
ZyanU64  address 
)

Formats the given instruction and writes it into the output buffer.

Parameters
formatterA pointer to the ZydisFormatter instance.
instructionA pointer to the ZydisDecodedInstruction struct.
bufferA pointer to the output buffer.
lengthThe length of the output buffer.
addressThe runtime address of the instruction.
Returns
A zyan status code.

◆ ZydisFormatterFormatInstructionEx()

ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatInstructionEx ( const ZydisFormatter formatter,
const ZydisDecodedInstruction instruction,
char *  buffer,
ZyanUSize  length,
ZyanU64  address,
void *  user_data 
)

Formats the given instruction and writes it into the output buffer.

Parameters
formatterA pointer to the ZydisFormatter instance.
instructionA pointer to the ZydisDecodedInstruction struct.
bufferA pointer to the output buffer.
lengthThe length of the output buffer.
addressThe runtime address of the instruction.
user_dataA pointer to user-defined data which can be used in custom formatter callbacks.
Returns
A zyan status code.

◆ ZydisFormatterFormatOperand()

ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatOperand ( const ZydisFormatter formatter,
const ZydisDecodedInstruction instruction,
ZyanU8  index,
char *  buffer,
ZyanUSize  length,
ZyanU64  address 
)

Formats the given operand and writes it into the output buffer.

Parameters
formatterA pointer to the ZydisFormatter instance.
instructionA pointer to the ZydisDecodedInstruction struct.
indexThe index of the operand to format.
bufferA pointer to the output buffer.
lengthThe length of the output buffer.
addressThe runtime address of the instruction.
Returns
A zyan status code.

Use ZydisFormatterFormatInstruction or ZydisFormatterFormatInstructionEx to format a complete instruction.

◆ ZydisFormatterFormatOperandEx()

ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatOperandEx ( const ZydisFormatter formatter,
const ZydisDecodedInstruction instruction,
ZyanU8  index,
char *  buffer,
ZyanUSize  length,
ZyanU64  address,
void *  user_data 
)

Formats the given operand and writes it into the output buffer.

Parameters
formatterA pointer to the ZydisFormatter instance.
instructionA pointer to the ZydisDecodedInstruction struct.
indexThe index of the operand to format.
bufferA pointer to the output buffer.
lengthThe length of the output buffer.
addressThe runtime address of the instruction.
user_dataA pointer to user-defined data which can be used in custom formatter callbacks.
Returns
A zyan status code.

Use ZydisFormatterFormatInstruction or ZydisFormatterFormatInstructionEx to format a complete instruction.

◆ ZydisFormatterInit()

ZYDIS_EXPORT ZyanStatus ZydisFormatterInit ( ZydisFormatter formatter,
ZydisFormatterStyle  style 
)

Initializes the given ZydisFormatter instance.

Parameters
formatterA pointer to the ZydisFormatter instance.
styleThe formatter style.
Returns
A zyan status code.

◆ ZydisFormatterSetHook()

ZYDIS_EXPORT ZyanStatus ZydisFormatterSetHook ( ZydisFormatter formatter,
ZydisFormatterHookType  hook,
const void **  callback 
)

Replaces a formatter function with a custom callback and/or retrieves the currently used function.

Parameters
formatterA pointer to the ZydisFormatter instance.
hookThe formatter hook-type.
callbackA pointer to a variable that contains the pointer of the callback function and receives the pointer of the currently used function.
Returns
A zyan status code.

Call this function with callback pointing to a NULL value to retrieve the currently used function without replacing it.

◆ ZydisFormatterSetProperty()

ZYDIS_EXPORT ZyanStatus ZydisFormatterSetProperty ( ZydisFormatter formatter,
ZydisFormatterProperty  property,
ZyanUPointer  value 
)

Sets the value of the specified formatter attribute.

Parameters
formatterA pointer to the ZydisFormatter instance.
propertyThe id of the formatter-property.
valueThe new value.
Returns
A zyan status code.