Skip to content

Commit 7037a47

Browse files
committed
update docs
1 parent cda24fc commit 7037a47

2 files changed

Lines changed: 85 additions & 94 deletions

File tree

doc/beaengine.md

Lines changed: 35 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,20 @@
1-
![beaengine](./beaengine-logo.png)
2-
1+
![beaengine](./beaengine-logo.png){ width=50px }
32
**BeaEngine documentation**
4-
- BEAENGINE_VERSION : 5.0
5-
- DOC_RELEASE : 1.0
6-
7-
# 0. Summary
83

9-
1. [Disasm function](#1-disasm-function)
10-
2. [Disasm structure explained](#2-disasm-infos)
11-
3. [get global informations on the instruction](#3-instruction-infos)
12-
4. [get informations about operands](#4-operand-infos)
13-
5. [get informations about prefixes used](#5-prefixes-infos)
14-
6. [flags of eflags register](#6-eflags-infos)
15-
7. [Memory type explained](#7-memory-infos)
16-
8. [Registers type explained](#8-registers-infos)
17-
9. [Constants used by BeaEngine](#9-constants)
4+
- BEAENGINE_VERSION : 5.1
5+
- DOC_RELEASE : 1.1
186

197
# 1. Disasm function
208

219
The Disasm function allows to decode all instructions coded according to the rules of IA-32 and Intel 64 architectures. It makes a precise analysis of the focused instruction and sends back a complete structure that is usable to make data-flow and control-flow studies.
2210

2311
**Syntax**
2412

25-
```
13+
~~~~ {.c}
2614
int Disasm(
2715
PDISASM &infos
2816
);
29-
```
17+
~~~~
3018

3119
**Parameters**
3220

@@ -42,7 +30,7 @@ The function may sends you back 3 values. if it has analyzed an invalid opcode,
4230

4331
This structure is used to store the mnemonic, source and destination operands. You just have to specify the address where the engine has to make the analysis.
4432

45-
```
33+
~~~~ {.c}
4634
struct PDISASM {
4735
UIntPtr EIP;
4836
UInt64 VirtualAddr;
@@ -59,7 +47,7 @@ struct PDISASM {
5947
Int32 Error;
6048
UInt32 Reserved_[48];
6149
};
62-
```
50+
~~~~
6351

6452
**Members**
6553

@@ -90,7 +78,7 @@ struct PDISASM {
9078
# 3. Instruction infos
9179
this structure gives informations on the analyzed instruction.
9280

93-
```
81+
~~~~ {.c}
9482
struct INSTRTYPE {
9583
Int32 Category;
9684
Int32 Opcode;
@@ -101,7 +89,7 @@ struct INSTRTYPE {
10189
Int64 Immediat;
10290
UInt32 ImplicitModifiedRegs;
10391
};
104-
```
92+
~~~~
10593

10694
**Members**
10795

@@ -119,7 +107,7 @@ struct INSTRTYPE {
119107

120108
This structure gives informations about the operand analyzed.
121109

122-
```
110+
~~~~ {.c}
123111
struct OPTYPE {
124112
char OpMnemonic[24];
125113
UInt64 OpType;
@@ -130,7 +118,7 @@ struct OPTYPE {
130118
REGISTERTYPE Registers;
131119
UInt32 SegmentReg;
132120
} ;
133-
```
121+
~~~~
134122

135123
**Members**
136124

@@ -156,7 +144,7 @@ struct OPTYPE {
156144

157145
This structure gives informations on used prefixes. When can know if some prefixes are used properly or not.
158146

159-
```
147+
~~~~ {.c}
160148
struct PREFIXINFO {
161149
int Number;
162150
int NbUndefined;
@@ -176,7 +164,7 @@ struct PREFIXINFO {
176164
REX_Struct REX;
177165
char alignment[2];
178166
};
179-
```
167+
~~~~
180168

181169
**Membres**
182170

@@ -202,15 +190,15 @@ struct PREFIXINFO {
202190
- **BranchNotTaken** : *[out]* Concerns branch hint prefix 0x2E (not taken).
203191
- **REX** : *[out]* Concerns the prefix used to define the REX in 64 bits mode. The structure sended back is :
204192

205-
```
193+
~~~~ {.c}
206194
struct REX_Struct {
207195
BYTE W_;
208196
BYTE R_;
209197
BYTE X_;
210198
BYTE B_;
211199
BYTE state;
212200
};
213-
```
201+
~~~~
214202

215203
Fields W_, R_, X_, B_ are set to 1 if the field is used. The field state is set to *InUsePrefix* if a REX prefix is used.
216204

@@ -219,7 +207,7 @@ Fields W_, R_, X_, B_ are set to 1 if the field is used. The field state is set
219207

220208
This structure gives informations on the register EFLAGS.
221209

222-
```
210+
~~~~ {.c}
223211
struct EFLStruct {
224212
BYTE OF_;
225213
BYTE SF_;
@@ -234,7 +222,7 @@ struct EFLStruct {
234222
BYTE RF_;
235223
BYTE alignment;
236224
};
237-
```
225+
~~~~
238226

239227
**Members**
240228

@@ -251,14 +239,14 @@ Except for the field "alignment" that is only present for alignment purpose, all
251239

252240
This structure gives informations if `infos.Operandxx.OpType == MEMORY_TYPE`.
253241

254-
```
242+
~~~~ {.c}
255243
struct MEMORYTYPE {
256244
Int64 BaseRegister;
257245
Int64 IndexRegister;
258246
Int32 Scale;
259247
Int64 Displacement;
260248
};
261-
```
249+
~~~~
262250

263251
**Members**
264252

@@ -272,7 +260,7 @@ struct MEMORYTYPE {
272260
This structure gives informations on operands if `infos.Operandxx.OpType == REGISTER_TYPE` or on `infos.Instruction.ImplicitModifiedRegs`.
273261

274262

275-
```
263+
~~~~ {.c}
276264
struct REGISTERTYPE{
277265
Int64 type;
278266
Int64 gpr;
@@ -289,7 +277,7 @@ struct REGISTERTYPE{
289277
Int64 segment;
290278
Int64 fpu;
291279
};
292-
```
280+
~~~~
293281

294282
**Members**
295283

@@ -329,7 +317,7 @@ Here is an exhaustive list of constants used by fields sends back by BeaEngine.
329317

330318
Values taken by (infos.Instruction.Category & 0xFFFF0000)
331319

332-
```
320+
~~~~ {.c}
333321
GENERAL_PURPOSE_INSTRUCTION = 0x10000,
334322
FPU_INSTRUCTION = 0x20000,
335323
MMX_INSTRUCTION = 0x30000,
@@ -363,11 +351,11 @@ XSAVE_INSTRUCTION = 0x1e0000,
363351
SGX_INSTRUCTION = 0x1f0000,
364352
PCONFIG_INSTRUCTION = 0x200000,
365353
366-
```
354+
~~~~
367355

368356
Values taken by LOWORD(infos.Instruction.Category)
369357

370-
```
358+
~~~~ {.c}
371359
DATA_TRANSFER = 0x1
372360
ARITHMETIC_INSTRUCTION = 2
373361
LOGICAL_INSTRUCTION = 3
@@ -411,11 +399,11 @@ DOT_PRODUCT = 40
411399
SAD_INSTRUCTION = 41
412400
ACCELERATOR_INSTRUCTION = 42
413401
ROUND_INSTRUCTION = 43
414-
```
402+
~~~~
415403

416404
Values taken by infos.Instruction.BranchType
417405

418-
```
406+
~~~~ {.c}
419407
JO = 1,
420408
JC = 2,
421409
JE = 3,
@@ -438,21 +426,21 @@ Values taken by infos.Instruction.BranchType
438426
JNL = -7,
439427
JNG = -8,
440428
JNB = -9
441-
```
429+
~~~~
442430

443431
Values taken by infos.Operandxx.OpType
444432

445-
```
433+
~~~~ {.c}
446434
NO_ARGUMENT = 0x10000,
447435
REGISTER_TYPE = 0x20000,
448436
MEMORY_TYPE = 0x30000,
449437
CONSTANT_TYPE + RELATIVE_ = 0x4040000,
450438
CONSTANT_TYPE + ABSOLUTE_ = 0x8040000
451-
```
439+
~~~~
452440

453441
Values taken by infos.Options
454442

455-
```
443+
~~~~ {.c}
456444
NoTabulation = 0x0,
457445
Tabulation = 0x1,
458446
@@ -465,26 +453,26 @@ Values taken by infos.Options
465453
466454
ShowSegmentRegs = 0x01000000,
467455
ShowEVEXMasking = 0x02000000,
468-
```
456+
~~~~
469457

470458
Values taken by infos.Operandxx.SegmentReg
471459

472-
```
460+
~~~~ {.c}
473461
ESReg 1
474462
DSReg 2
475463
FSReg 3
476464
GSReg 4
477465
CSReg 5
478466
SSReg 6
479-
```
467+
~~~~
480468

481469
Values taken by infos.Instruction.Flags.OF_ , .SF_ ...
482470

483-
```
471+
~~~~ {.c}
484472
TE_ = 1 ; test
485473
MO_ = 2 ; modify
486474
RE_ = 4 ; reset
487475
SE_ = 8 ; set
488476
UN_ = 10h ; undefined
489477
PR_ = 20h ; restore prior value
490-
```
478+
~~~~

0 commit comments

Comments
 (0)