class FFI::UDis86::UD

Public Class Methods

create(options={},&block) click to toggle source

Creates a new disassembler object.

@param [Hash] options

Additional options.

@option options [Integer] :mode (32)

The mode of disassembly, can either 16, 32 or 64.

@option options [Integer] :syntax (:intel)

The assembly syntax the disassembler will emit, can be either
`:att` or `:intel`.

@option options [String] :buffer

A buffer to disassemble.

@option options [Symbol] :vendor

Sets the vendor of whose instructions to choose from. Can be
either `:amd` or `:intel`.

@option options [Integer] :pc

Initial value of the Program Counter (PC).

@yield [ud]

If a block is given, it will be used as an input callback to
return the next byte to disassemble. When the block returns
-1, the disassembler will stop processing input.

@yieldparam [UD] ud

The disassembler.

@return [UD]

The newly created disassembler.
# File lib/ffi/udis86/ud.rb, line 89
def self.create(options={},&block)
  ud = self.new
  ud.init

  ud.mode = (options[:mode] || 32)

  if options[:buffer]
    ud.input_buffer = options[:buffer]
  end

  ud.syntax = (options[:syntax] || :intel)

  if options[:vendor]
    ud.vendor = options[:vendor]
  end

  if options[:pc]
    ud.pc = options[:pc]
  end

  ud.input_callback(&block) if block

  return ud
end
open(path,options={}) { |ud| ... } click to toggle source

Opens a file and disassembles it.

@param [String] path

The path to the file.

@param [Hash] options

Additional options for the disassembler.

@option options [Integer] :mode (32)

The mode of disassembly, can either 16, 32 or 64.

@option options [Integer] :syntax (:intel)

The assembly syntax the disassembler will emit, can be either
`:att` or `:intel`.

@option options [String] :buffer

A buffer to disassemble.

@option options [Symbol] :vendor

Sets the vendor of whose instructions to choose from. Can be
either `:amd` or `:intel`.

@option options [Integer] :pc

Initial value of the Program Counter (PC).

@yield [ud]

If a block is given, it will be passed the newly created
UD object, configured to disassembler the file.

@yieldparam [UD] ud

The newly created disassembler.
# File lib/ffi/udis86/ud.rb, line 147
def self.open(path,options={})
  File.open(path,'rb') do |file|
    ud = self.create(options) do |ud|
      if (b = file.getc)
        b.ord
      else
        -1
      end
    end

    yield ud if block_given?
  end

  return nil
end

Public Instance Methods

address_prefix() click to toggle source

The address-size prefix (67h) of the last disassembled instruction.

@return [Integer]

The address-size prefix.
# File lib/ffi/udis86/ud.rb, line 409
def address_prefix
  self[:pfx_adr]
end
disas()
Alias for: disassemble
disassemble() { |self| ... } click to toggle source

Reads each byte, disassembling each instruction.

@yield [ud]

If a block is given, it will be passed the disassembler after
each instruction has been disassembled.

@yieldparam [UD] ud

The disassembler.

@return [UD]

The disassembler.
# File lib/ffi/udis86/ud.rb, line 543
def disassemble
  until UDis86.ud_disassemble(self) == 0
    yield self if block_given?
  end

  return self
end
Also aliased as: disas, each
each()
Alias for: disassemble
init() click to toggle source

Initializes the disassembler.

@return [UD]

The initialized disassembler.
# File lib/ffi/udis86/ud.rb, line 169
def init
  UDis86.ud_init(self)
  return self
end
input_buffer() click to toggle source

Returns the input buffer used by the disassembler.

@return [String]

The current contents of the input buffer.
# File lib/ffi/udis86/ud.rb, line 180
def input_buffer
  if @input_buffer
    @input_buffer.get_bytes(0,@input_buffer.total)
  else
    ''
  end
end
input_buffer=(data) click to toggle source

Sets the contents of the input buffer for the disassembler.

@param [Array<Integer>, String] data

The new contents to use for the input buffer.

@return [String]

The new contents of the input buffer.

@raise [RuntimeError]

The given input buffer was neither a String or an Array of bytes.
# File lib/ffi/udis86/ud.rb, line 200
def input_buffer=(data)
  data = data.to_s

  @input_buffer = FFI::MemoryPointer.new(data.length)

  if data.kind_of?(Array)
    @input_buffer.put_array_of_uint8(0,data)
  elsif data.kind_of?(String)
    @input_buffer.put_bytes(0,data)
  else
    raise(RuntimeError,"input buffer must be either a String or an Array of bytes",caller)
  end

  UDis86.ud_set_input_buffer(self,@input_buffer,@input_buffer.total)
  return data
end
input_callback(&block) click to toggle source

Sets the input callback for the disassembler.

@yield [ud]

If a block is given, it will be used to get the next byte of
input to disassemble. When the block returns -1, the disassembler
will stop processing input.

@yieldparam [UD]

The disassembler.
# File lib/ffi/udis86/ud.rb, line 228
def input_callback(&block)
  if block
    @input_callback = Proc.new { |ptr| block.call(self) }

    UDis86.ud_set_input_hook(self,@input_callback)
  end

  return @input_callback
end
insn_length() click to toggle source

Returns the number of bytes that were disassembled.

@return [Integer]

The number of bytes disassembled.
# File lib/ffi/udis86/ud.rb, line 504
def insn_length
  UDis86.ud_insn_len(self)
end
insn_offset() click to toggle source

Returns the starting offset of the disassembled instruction relative to the initial value of the Program Counter (PC).

@return [Integer]

The offset of the instruction.
# File lib/ffi/udis86/ud.rb, line 515
def insn_offset
  UDis86.ud_insn_off(self)
end
insn_ptr() click to toggle source

Returns the pointer to the buffer holding the disassembled instruction bytes.

@return [FFI::Pointer]

The pointer to the instruction buffer.
# File lib/ffi/udis86/ud.rb, line 526
def insn_ptr
  UDis86.ud_insn_ptr(self)
end
lock_prefix() click to toggle source

The lock prefix of the last disassembled instruction.

@return [Integer]

The lock prefix.
# File lib/ffi/udis86/ud.rb, line 419
def lock_prefix
  self[:pfx_lock]
end
mnemonic() click to toggle source

The mnemonic string of the last disassembled instruction.

@return [Symbol]

The mnemonic string.
# File lib/ffi/udis86/ud.rb, line 369
def mnemonic
  UDis86.ud_lookup_mnemonic(self[:mnemonic]).to_sym
end
mnemonic_code() click to toggle source

The mnemonic code of the last disassembled instruction.

@return [Symbol]

The mnemonic code.
# File lib/ffi/udis86/ud.rb, line 359
def mnemonic_code
  self[:mnemonic]
end
mode() click to toggle source

Returns the mode the disassembler is running in.

@return [Integer]

Returns either 16, 32 or 64
# File lib/ffi/udis86/ud.rb, line 244
def mode
  self[:dis_mode]
end
mode=(new_mode) click to toggle source

Sets the mode the disassembler will run in.

@param [Integer] new_mode

The mode the disassembler will run in. Can be either 16, 32 or 64.

@return [Integer]

The new mode of the disassembler.
# File lib/ffi/udis86/ud.rb, line 257
def mode=(new_mode)
  unless MODES.include?(new_mode)
    raise(RuntimeError,"invalid disassembly mode #{new_mode}",caller)
  end

  UDis86.ud_set_mode(self,new_mode)
  return new_mode
end
next_insn() click to toggle source

Disassembles the next instruction in the input stream.

@return [UD]

The disassembler.
# File lib/ffi/udis86/ud.rb, line 494
def next_insn
  UDis86.ud_disassemble(self)
end
operand_prefix() click to toggle source

The operand-size prefix (66h) of the last disassembled instruction.

@return [Integer]

The operand-size prefix.
# File lib/ffi/udis86/ud.rb, line 399
def operand_prefix
  self[:pfx_opr]
end
operands() click to toggle source

Returns the operands for the last disassembled instruction.

@return [Array<Operand>]

The operands of the instruction.
# File lib/ffi/udis86/ud.rb, line 482
def operands
  self[:operand].entries.select do |operand|
    OPERAND_TYPES.include?(operand.type)
  end
end
pc() click to toggle source

Returns the current value of the Program Counter (PC).

@return [Integer]

The value of the PC.
# File lib/ffi/udis86/ud.rb, line 320
def pc
  self[:pc]
end
pc=(new_pc) click to toggle source

Sets the value of the Program Counter (PC).

@param [Integer] new_pc

The new value to use for the PC.

@return [Integer]

The new value of the PC.
# File lib/ffi/udis86/ud.rb, line 333
def pc=(new_pc)
  UDis86.ud_set_pc(self,new_pc)
  return new_pc
end
rep_prefix() click to toggle source

The rep prefix of the last disassembled instruction.

@return [Integer]

The rep prefix.
# File lib/ffi/udis86/ud.rb, line 429
def rep_prefix
  self[:pfx_rep]
end
repe_prefix() click to toggle source

The repe prefix of the last disassembled instruction.

@return [Integer]

The repe prefix.
# File lib/ffi/udis86/ud.rb, line 439
def repe_prefix
  self[:pfx_repe]
end
repne_prefix() click to toggle source

The repne prefix of the last disassembled instruction.

@return [Integer]

The repne prefix.
# File lib/ffi/udis86/ud.rb, line 449
def repne_prefix
  self[:pfx_repne]
end
rex_prefix() click to toggle source

The 64-bit mode REX prefix of the last disassembled instruction.

@return [Integer]

The 64-bit REX prefix.
# File lib/ffi/udis86/ud.rb, line 379
def rex_prefix
  self[:pfx_rex]
end
segment_prefix() click to toggle source

The segment register prefix of the last disassembled instruction.

@return [Integer]

The segment register prefix.
# File lib/ffi/udis86/ud.rb, line 389
def segment_prefix
  self[:pfx_seg]
end
skip(n) click to toggle source

Causes the disassembler to skip a certain number of bytes in the input stream.

@param [Integer] n

The number of bytes to skip.

@return [UD]

The disassembler.
# File lib/ffi/udis86/ud.rb, line 348
def skip(n)
  UDis86.ud_input_skip(self,n)
  return self
end
syntax=(new_syntax) click to toggle source

Sets the assembly syntax that the disassembler will emit.

@param [Symbol, String] new_syntax

The new assembler syntax the disassembler will emit. Can be
either `:att` or `:intel`.

@return [Symbol]

The new assembly syntax being used.
# File lib/ffi/udis86/ud.rb, line 276
def syntax=(new_syntax)
  new_syntax = new_syntax.to_s.downcase.to_sym
  func_name = UDis86::SYNTAX[new_syntax]

  unless func_name
    raise(ArgumentError,"unknown syntax name #{new_syntax}",caller)
  end

  UDis86.ud_set_syntax(self,UDis86.method(func_name))
  return new_syntax
end
to_asm() click to toggle source

Returns the assembly syntax for the last disassembled instruction.

@return [String]

The assembly syntax for the instruction.
# File lib/ffi/udis86/ud.rb, line 459
def to_asm
  UDis86.ud_insn_asm(self)
end
Also aliased as: to_s
to_hex() click to toggle source

Returns the hexadecimal representation of the disassembled instruction.

@return [String]

The hexadecimal form of the disassembled instruction.
# File lib/ffi/udis86/ud.rb, line 470
def to_hex
  UDis86.ud_insn_hex(self)
end
to_s()
Alias for: to_asm
vendor() click to toggle source

The vendor of whose instructions are to be chosen from during disassembly.

@return [Symbol]

The vendor name, may be either `:amd` or `:intel`.
# File lib/ffi/udis86/ud.rb, line 295
def vendor
  VENDORS[self[:vendor]]
end
vendor=(new_vendor) click to toggle source

Sets the vendor, of whose instructions are to be chosen from during disassembly.

@param [Symbol] new_vendor

The new vendor to use, can be either `:amd` or `:intel`.

@return [Symbol]

The new vendor to use.
# File lib/ffi/udis86/ud.rb, line 309
def vendor=(new_vendor)
  UDis86.ud_set_vendor(self,VENDORS.index(new_vendor))
  return new_vendor
end