Welcome to the BeaEngine Sweet Home - x86 x86-64 disassembler library - (IA-32 & Intel64)

Disasm Structure

This structure is used to store the mnemonic, source and destination operands. You just have to specify the address where the engine has to make the analysis.

struct _Disasm {
   long long EIP;
   long long VirtualAddr;
   long SecurityBlock;
   char CompleteInstr[64];
   long Archi;
   long Options;
   INSTRTYPE Instruction;
   ARGTYPE Argument1;
   ARGTYPE Argument2;
   ARGTYPE Argument3;
   PREFIXINFO Prefix;
};

Members

EIP

[in] The address where the engine will make the decoding.

VirtualAddr

[in] optional - (For instructions CALL - JMP - conditional JMP - LOOP) By default, this value is 0 (disable). The disassembler calculates the destination address of the branch instruction by using VirtualAddr (not EIP). This address can be 64 bits long. This option allows us to decode instructions located anywhere in memory even if they are not at their original place.

CompleteInstr

[out] String used to store the complete instruction.

SecurityBlock

[in] By default, this value is 0. (disabled option). In other cases, this number is the number of bytes the engine is allowed to read since EIP. Thus, we can make a read block to avoid some Access violation. On INTEL processors, (in IA-32 or intel 64 modes) , instruction never exceeds 15 bytes. A SecurityBlock value outside this range is useless.

Archi

[in] This field is used to specify the architecture used for the decoding. If it is set to 0, the architecture used is IA-32. If it is set to 64 (0x40), the architecture used is Intel 64.

Options

[in] This field allows you to define some display options. You can specify the syntax : masm, nasm ,goasm or AT&T. You can specify the number format you want to use : prefixed numbers or suffixed ones. You can even add a tabulation between the mnemonic and the first operand or display the segment registers used by the memory addressing. Constants used are the following :

  NoTabulation = 0x0,
  Tabulation = 0x1,
  MasmSyntax = 0x000,
  GoAsmSyntax = 0x100,
  NasmSyntax = 0x200,
  ATSyntax = 0x400,
  PrefixedNumeral = 0x10000,
  SuffixedNumeral = 0x00000,
  ShowSegmentRegs = 0x01000000

Instruction

[out] Structure INSTRTYPE .

Argument1

[out] Structure ARGTYPE that concerns the first argument.

Argument2

[out] Structure ARGTYPE that concerns the second argument.

Argument3

[out] Structure ARGTYPE that concerns the third argument.

Prefix

[out] Structure PREFIXINFO containing an exhaustive list of used prefixes.

Valid XHTML 1.0 Strict

Valid CSS!