class FFI::UDis86::UD
Public Class Methods
Creates a new disassembler object.
@param [Hash] options
Additional options.
@option options [Integer] :mode (32)
The mode of disassembly, can either 16, 32 or 64.
@option options [Integer] :syntax (:intel)
The assembly syntax the disassembler will emit, can be either `:att` or `:intel`.
@option options [String] :buffer
A buffer to disassemble.
@option options [Symbol] :vendor
Sets the vendor of whose instructions to choose from. Can be either `:amd` or `:intel`.
@option options [Integer] :pc
Initial value of the Program Counter (PC).
@yield [ud]
If a block is given, it will be used as an input callback to return the next byte to disassemble. When the block returns -1, the disassembler will stop processing input.
@yieldparam [UD] ud
The disassembler.
@return [UD]
The newly created disassembler.
# File lib/ffi/udis86/ud.rb, line 89 def self.create(options={},&block) ud = self.new ud.init ud.mode = (options[:mode] || 32) if options[:buffer] ud.input_buffer = options[:buffer] end ud.syntax = (options[:syntax] || :intel) if options[:vendor] ud.vendor = options[:vendor] end if options[:pc] ud.pc = options[:pc] end ud.input_callback(&block) if block return ud end
Opens a file and disassembles it.
@param [String] path
The path to the file.
@param [Hash] options
Additional options for the disassembler.
@option options [Integer] :mode (32)
The mode of disassembly, can either 16, 32 or 64.
@option options [Integer] :syntax (:intel)
The assembly syntax the disassembler will emit, can be either `:att` or `:intel`.
@option options [String] :buffer
A buffer to disassemble.
@option options [Symbol] :vendor
Sets the vendor of whose instructions to choose from. Can be either `:amd` or `:intel`.
@option options [Integer] :pc
Initial value of the Program Counter (PC).
@yield [ud]
If a block is given, it will be passed the newly created UD object, configured to disassembler the file.
@yieldparam [UD] ud
The newly created disassembler.
# File lib/ffi/udis86/ud.rb, line 147 def self.open(path,options={}) File.open(path,'rb') do |file| ud = self.create(options) do |ud| if (b = file.getc) b.ord else -1 end end yield ud if block_given? end return nil end
Public Instance Methods
The address-size prefix (67h) of the last disassembled instruction.
@return [Integer]
The address-size prefix.
# File lib/ffi/udis86/ud.rb, line 409 def address_prefix self[:pfx_adr] end
Reads each byte, disassembling each instruction.
@yield [ud]
If a block is given, it will be passed the disassembler after each instruction has been disassembled.
@yieldparam [UD] ud
The disassembler.
@return [UD]
The disassembler.
# File lib/ffi/udis86/ud.rb, line 543 def disassemble until UDis86.ud_disassemble(self) == 0 yield self if block_given? end return self end
Initializes the disassembler.
@return [UD]
The initialized disassembler.
# File lib/ffi/udis86/ud.rb, line 169 def init UDis86.ud_init(self) return self end
Returns the input buffer used by the disassembler.
@return [String]
The current contents of the input buffer.
# File lib/ffi/udis86/ud.rb, line 180 def input_buffer if @input_buffer @input_buffer.get_bytes(0,@input_buffer.total) else '' end end
Sets the contents of the input buffer for the disassembler.
@param [Array<Integer>, String] data
The new contents to use for the input buffer.
@return [String]
The new contents of the input buffer.
@raise [RuntimeError]
The given input buffer was neither a String or an Array of bytes.
# File lib/ffi/udis86/ud.rb, line 200 def input_buffer=(data) data = data.to_s @input_buffer = FFI::MemoryPointer.new(data.length) if data.kind_of?(Array) @input_buffer.put_array_of_uint8(0,data) elsif data.kind_of?(String) @input_buffer.put_bytes(0,data) else raise(RuntimeError,"input buffer must be either a String or an Array of bytes",caller) end UDis86.ud_set_input_buffer(self,@input_buffer,@input_buffer.total) return data end
Sets the input callback for the disassembler.
@yield [ud]
If a block is given, it will be used to get the next byte of input to disassemble. When the block returns -1, the disassembler will stop processing input.
@yieldparam [UD]
The disassembler.
# File lib/ffi/udis86/ud.rb, line 228 def input_callback(&block) if block @input_callback = Proc.new { |ptr| block.call(self) } UDis86.ud_set_input_hook(self,@input_callback) end return @input_callback end
Returns the number of bytes that were disassembled.
@return [Integer]
The number of bytes disassembled.
# File lib/ffi/udis86/ud.rb, line 504 def insn_length UDis86.ud_insn_len(self) end
Returns the starting offset of the disassembled instruction relative to the initial value of the Program Counter (PC).
@return [Integer]
The offset of the instruction.
# File lib/ffi/udis86/ud.rb, line 515 def insn_offset UDis86.ud_insn_off(self) end
Returns the pointer to the buffer holding the disassembled instruction bytes.
@return [FFI::Pointer]
The pointer to the instruction buffer.
# File lib/ffi/udis86/ud.rb, line 526 def insn_ptr UDis86.ud_insn_ptr(self) end
The lock prefix of the last disassembled instruction.
@return [Integer]
The lock prefix.
# File lib/ffi/udis86/ud.rb, line 419 def lock_prefix self[:pfx_lock] end
The mnemonic string of the last disassembled instruction.
@return [Symbol]
The mnemonic string.
# File lib/ffi/udis86/ud.rb, line 369 def mnemonic UDis86.ud_lookup_mnemonic(self[:mnemonic]).to_sym end
The mnemonic code of the last disassembled instruction.
@return [Symbol]
The mnemonic code.
# File lib/ffi/udis86/ud.rb, line 359 def mnemonic_code self[:mnemonic] end
Returns the mode the disassembler is running in.
@return [Integer]
Returns either 16, 32 or 64
# File lib/ffi/udis86/ud.rb, line 244 def mode self[:dis_mode] end
Sets the mode the disassembler will run in.
@param [Integer] new_mode
The mode the disassembler will run in. Can be either 16, 32 or 64.
@return [Integer]
The new mode of the disassembler.
# File lib/ffi/udis86/ud.rb, line 257 def mode=(new_mode) unless MODES.include?(new_mode) raise(RuntimeError,"invalid disassembly mode #{new_mode}",caller) end UDis86.ud_set_mode(self,new_mode) return new_mode end
Disassembles the next instruction in the input stream.
@return [UD]
The disassembler.
# File lib/ffi/udis86/ud.rb, line 494 def next_insn UDis86.ud_disassemble(self) end
The operand-size prefix (66h) of the last disassembled instruction.
@return [Integer]
The operand-size prefix.
# File lib/ffi/udis86/ud.rb, line 399 def operand_prefix self[:pfx_opr] end
Returns the operands for the last disassembled instruction.
@return [Array<Operand>]
The operands of the instruction.
# File lib/ffi/udis86/ud.rb, line 482 def operands self[:operand].entries.select do |operand| OPERAND_TYPES.include?(operand.type) end end
Returns the current value of the Program Counter (PC).
@return [Integer]
The value of the PC.
# File lib/ffi/udis86/ud.rb, line 320 def pc self[:pc] end
Sets the value of the Program Counter (PC).
@param [Integer] new_pc
The new value to use for the PC.
@return [Integer]
The new value of the PC.
# File lib/ffi/udis86/ud.rb, line 333 def pc=(new_pc) UDis86.ud_set_pc(self,new_pc) return new_pc end
The rep prefix of the last disassembled instruction.
@return [Integer]
The rep prefix.
# File lib/ffi/udis86/ud.rb, line 429 def rep_prefix self[:pfx_rep] end
The repe prefix of the last disassembled instruction.
@return [Integer]
The repe prefix.
# File lib/ffi/udis86/ud.rb, line 439 def repe_prefix self[:pfx_repe] end
The repne prefix of the last disassembled instruction.
@return [Integer]
The repne prefix.
# File lib/ffi/udis86/ud.rb, line 449 def repne_prefix self[:pfx_repne] end
The 64-bit mode REX prefix of the last disassembled instruction.
@return [Integer]
The 64-bit REX prefix.
# File lib/ffi/udis86/ud.rb, line 379 def rex_prefix self[:pfx_rex] end
The segment register prefix of the last disassembled instruction.
@return [Integer]
The segment register prefix.
# File lib/ffi/udis86/ud.rb, line 389 def segment_prefix self[:pfx_seg] end
Causes the disassembler to skip a certain number of bytes in the input stream.
@param [Integer] n
The number of bytes to skip.
@return [UD]
The disassembler.
# File lib/ffi/udis86/ud.rb, line 348 def skip(n) UDis86.ud_input_skip(self,n) return self end
Sets the assembly syntax that the disassembler will emit.
@param [Symbol, String] new_syntax
The new assembler syntax the disassembler will emit. Can be either `:att` or `:intel`.
@return [Symbol]
The new assembly syntax being used.
# File lib/ffi/udis86/ud.rb, line 276 def syntax=(new_syntax) new_syntax = new_syntax.to_s.downcase.to_sym func_name = UDis86::SYNTAX[new_syntax] unless func_name raise(ArgumentError,"unknown syntax name #{new_syntax}",caller) end UDis86.ud_set_syntax(self,UDis86.method(func_name)) return new_syntax end
Returns the assembly syntax for the last disassembled instruction.
@return [String]
The assembly syntax for the instruction.
# File lib/ffi/udis86/ud.rb, line 459 def to_asm UDis86.ud_insn_asm(self) end
Returns the hexadecimal representation of the disassembled instruction.
@return [String]
The hexadecimal form of the disassembled instruction.
# File lib/ffi/udis86/ud.rb, line 470 def to_hex UDis86.ud_insn_hex(self) end
The vendor of whose instructions are to be chosen from during disassembly.
@return [Symbol]
The vendor name, may be either `:amd` or `:intel`.
# File lib/ffi/udis86/ud.rb, line 295 def vendor VENDORS[self[:vendor]] end
Sets the vendor, of whose instructions are to be chosen from during disassembly.
@param [Symbol] new_vendor
The new vendor to use, can be either `:amd` or `:intel`.
@return [Symbol]
The new vendor to use.
# File lib/ffi/udis86/ud.rb, line 309 def vendor=(new_vendor) UDis86.ud_set_vendor(self,VENDORS.index(new_vendor)) return new_vendor end