You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: doc/beaengine.md
+35-47Lines changed: 35 additions & 47 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,32 +1,20 @@
1
-

2
-
1
+
{ width=50px }
3
2
**BeaEngine documentation**
4
-
- BEAENGINE_VERSION : 5.0
5
-
- DOC_RELEASE : 1.0
6
-
7
-
# 0. Summary
8
3
9
-
1.[Disasm function](#1-disasm-function)
10
-
2.[Disasm structure explained](#2-disasm-infos)
11
-
3.[get global informations on the instruction](#3-instruction-infos)
12
-
4.[get informations about operands](#4-operand-infos)
13
-
5.[get informations about prefixes used](#5-prefixes-infos)
14
-
6.[flags of eflags register](#6-eflags-infos)
15
-
7.[Memory type explained](#7-memory-infos)
16
-
8.[Registers type explained](#8-registers-infos)
17
-
9.[Constants used by BeaEngine](#9-constants)
4
+
- BEAENGINE_VERSION : 5.1
5
+
- DOC_RELEASE : 1.1
18
6
19
7
# 1. Disasm function
20
8
21
9
The Disasm function allows to decode all instructions coded according to the rules of IA-32 and Intel 64 architectures. It makes a precise analysis of the focused instruction and sends back a complete structure that is usable to make data-flow and control-flow studies.
22
10
23
11
**Syntax**
24
12
25
-
```
13
+
~~~~{.c}
26
14
int Disasm(
27
15
PDISASM &infos
28
16
);
29
-
```
17
+
~~~~
30
18
31
19
**Parameters**
32
20
@@ -42,7 +30,7 @@ The function may sends you back 3 values. if it has analyzed an invalid opcode,
42
30
43
31
This structure is used to store the mnemonic, source and destination operands. You just have to specify the address where the engine has to make the analysis.
44
32
45
-
```
33
+
~~~~{.c}
46
34
struct PDISASM {
47
35
UIntPtr EIP;
48
36
UInt64 VirtualAddr;
@@ -59,7 +47,7 @@ struct PDISASM {
59
47
Int32 Error;
60
48
UInt32 Reserved_[48];
61
49
};
62
-
```
50
+
~~~~
63
51
64
52
**Members**
65
53
@@ -90,7 +78,7 @@ struct PDISASM {
90
78
# 3. Instruction infos
91
79
this structure gives informations on the analyzed instruction.
92
80
93
-
```
81
+
~~~~{.c}
94
82
struct INSTRTYPE {
95
83
Int32 Category;
96
84
Int32 Opcode;
@@ -101,7 +89,7 @@ struct INSTRTYPE {
101
89
Int64 Immediat;
102
90
UInt32 ImplicitModifiedRegs;
103
91
};
104
-
```
92
+
~~~~
105
93
106
94
**Members**
107
95
@@ -119,7 +107,7 @@ struct INSTRTYPE {
119
107
120
108
This structure gives informations about the operand analyzed.
121
109
122
-
```
110
+
~~~~{.c}
123
111
struct OPTYPE {
124
112
char OpMnemonic[24];
125
113
UInt64 OpType;
@@ -130,7 +118,7 @@ struct OPTYPE {
130
118
REGISTERTYPE Registers;
131
119
UInt32 SegmentReg;
132
120
} ;
133
-
```
121
+
~~~~
134
122
135
123
**Members**
136
124
@@ -156,7 +144,7 @@ struct OPTYPE {
156
144
157
145
This structure gives informations on used prefixes. When can know if some prefixes are used properly or not.
158
146
159
-
```
147
+
~~~~{.c}
160
148
struct PREFIXINFO {
161
149
int Number;
162
150
int NbUndefined;
@@ -176,7 +164,7 @@ struct PREFIXINFO {
176
164
REX_Struct REX;
177
165
char alignment[2];
178
166
};
179
-
```
167
+
~~~~
180
168
181
169
**Membres**
182
170
@@ -202,15 +190,15 @@ struct PREFIXINFO {
202
190
-**BranchNotTaken** : *[out]* Concerns branch hint prefix 0x2E (not taken).
203
191
-**REX** : *[out]* Concerns the prefix used to define the REX in 64 bits mode. The structure sended back is :
204
192
205
-
```
193
+
~~~~{.c}
206
194
struct REX_Struct {
207
195
BYTE W_;
208
196
BYTE R_;
209
197
BYTE X_;
210
198
BYTE B_;
211
199
BYTE state;
212
200
};
213
-
```
201
+
~~~~
214
202
215
203
Fields W_, R_, X_, B_ are set to 1 if the field is used. The field state is set to *InUsePrefix* if a REX prefix is used.
216
204
@@ -219,7 +207,7 @@ Fields W_, R_, X_, B_ are set to 1 if the field is used. The field state is set
219
207
220
208
This structure gives informations on the register EFLAGS.
221
209
222
-
```
210
+
~~~~{.c}
223
211
struct EFLStruct {
224
212
BYTE OF_;
225
213
BYTE SF_;
@@ -234,7 +222,7 @@ struct EFLStruct {
234
222
BYTE RF_;
235
223
BYTE alignment;
236
224
};
237
-
```
225
+
~~~~
238
226
239
227
**Members**
240
228
@@ -251,14 +239,14 @@ Except for the field "alignment" that is only present for alignment purpose, all
251
239
252
240
This structure gives informations if `infos.Operandxx.OpType == MEMORY_TYPE`.
253
241
254
-
```
242
+
~~~~{.c}
255
243
struct MEMORYTYPE {
256
244
Int64 BaseRegister;
257
245
Int64 IndexRegister;
258
246
Int32 Scale;
259
247
Int64 Displacement;
260
248
};
261
-
```
249
+
~~~~
262
250
263
251
**Members**
264
252
@@ -272,7 +260,7 @@ struct MEMORYTYPE {
272
260
This structure gives informations on operands if `infos.Operandxx.OpType == REGISTER_TYPE` or on `infos.Instruction.ImplicitModifiedRegs`.
273
261
274
262
275
-
```
263
+
~~~~{.c}
276
264
struct REGISTERTYPE{
277
265
Int64 type;
278
266
Int64 gpr;
@@ -289,7 +277,7 @@ struct REGISTERTYPE{
289
277
Int64 segment;
290
278
Int64 fpu;
291
279
};
292
-
```
280
+
~~~~
293
281
294
282
**Members**
295
283
@@ -329,7 +317,7 @@ Here is an exhaustive list of constants used by fields sends back by BeaEngine.
329
317
330
318
Values taken by (infos.Instruction.Category & 0xFFFF0000)
0 commit comments