Functions allowing formatting of previously decoded instructions to human readable text. More...

Functions
ZYDIS_EXPORT ZyanStatus	ZydisFormatterInit (ZydisFormatter *formatter, ZydisFormatterStyle style)
	Initializes the given ZydisFormatter instance.
ZYDIS_EXPORT ZyanStatus	ZydisFormatterSetProperty (ZydisFormatter *formatter, ZydisFormatterProperty property, ZyanUPointer value)
	Changes the value of the specified formatter property.
ZYDIS_EXPORT ZyanStatus	ZydisFormatterSetHook (ZydisFormatter formatter, ZydisFormatterFunction type, const void *callback)
	Replaces a formatter function with a custom callback and/or retrieves the currently used function.
ZYDIS_EXPORT ZyanStatus	ZydisFormatterFormatInstruction (const ZydisFormatter formatter, const ZydisDecodedInstruction instruction, const ZydisDecodedOperand operands, ZyanU8 operand_count, char buffer, ZyanUSize length, ZyanU64 runtime_address, void *user_data)
	Formats the given instruction and writes it into the output buffer.
ZYDIS_EXPORT ZyanStatus	ZydisFormatterFormatOperand (const ZydisFormatter formatter, const ZydisDecodedInstruction instruction, const ZydisDecodedOperand operand, char buffer, ZyanUSize length, ZyanU64 runtime_address, void *user_data)
	Formats the given operand and writes it into the output buffer.
ZYDIS_EXPORT ZyanStatus	ZydisFormatterTokenizeInstruction (const ZydisFormatter formatter, const ZydisDecodedInstruction instruction, const ZydisDecodedOperand operands, ZyanU8 operand_count, void buffer, ZyanUSize length, ZyanU64 runtime_address, ZydisFormatterTokenConst *token, void user_data)
	Tokenizes the given instruction and writes it into the output buffer.
ZYDIS_EXPORT ZyanStatus	ZydisFormatterTokenizeOperand (const ZydisFormatter formatter, const ZydisDecodedInstruction instruction, const ZydisDecodedOperand operand, void buffer, ZyanUSize length, ZyanU64 runtime_address, ZydisFormatterTokenConst *token, void user_data)
	Tokenizes the given operand and writes it into the output buffer.

Detailed Description

Functions allowing formatting of previously decoded instructions to human readable text.

Function Documentation

◆ ZydisFormatterFormatInstruction()

ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatInstruction	(	const ZydisFormatter *	formatter,
		const ZydisDecodedInstruction *	instruction,
		const ZydisDecodedOperand *	operands,
		ZyanU8	operand_count,
		char *	buffer,
		ZyanUSize	length,
		ZyanU64	runtime_address,
		void *	user_data )

Formats the given instruction and writes it into the output buffer.

Parameters

Formatter	A pointer to the ZydisFormatter instance.
instruction	A pointer to the ZydisDecodedInstruction struct.
operands	A pointer to the decoded operands array.
operand_count	The length of the operands array. Must be equal to or greater than the value of instruction->operand_count_visible.
buffer	A pointer to the output buffer.
length	The length of the output buffer (in characters).
runtime_address	The runtime address of the instruction or ZYDIS_RUNTIME_ADDRESS_NONE to print relative addresses.
user_data	A pointer to user-defined data which can be used in custom formatter callbacks. Can be ZYAN_NULL.

Returns: A zyan status code.

◆ ZydisFormatterFormatOperand()

ZYDIS_EXPORT ZyanStatus ZydisFormatterFormatOperand	(	const ZydisFormatter *	formatter,
		const ZydisDecodedInstruction *	instruction,
		const ZydisDecodedOperand *	operand,
		char *	buffer,
		ZyanUSize	length,
		ZyanU64	runtime_address,
		void *	user_data )

Formats the given operand and writes it into the output buffer.

Parameters

Formatter	A pointer to the ZydisFormatter instance.
instruction	A pointer to the ZydisDecodedInstruction struct.
operand	A pointer to the ZydisDecodedOperand struct of the operand to format.
buffer	A pointer to the output buffer.
length	The length of the output buffer (in characters).
runtime_address	The runtime address of the instruction or ZYDIS_RUNTIME_ADDRESS_NONE to print relative addresses.
user_data	A pointer to user-defined data which can be used in custom formatter callbacks. Can be ZYAN_NULL.

Returns: A zyan status code.

Use ZydisFormatterFormatInstruction or ZydisFormatterFormatInstructionEx to format a complete instruction.

◆ ZydisFormatterInit()

ZYDIS_EXPORT ZyanStatus ZydisFormatterInit	(	ZydisFormatter *	formatter,
		ZydisFormatterStyle	style )

Initializes the given ZydisFormatter instance.

Parameters

Formatter	A pointer to the ZydisFormatter instance.
style	The base formatter style (either AT&T or Intel style).

Returns: A zyan status code.

◆ ZydisFormatterSetHook()

ZYDIS_EXPORT ZyanStatus ZydisFormatterSetHook	(	ZydisFormatter *	formatter,
		ZydisFormatterFunction	type,
		const void **	callback )

Replaces a formatter function with a custom callback and/or retrieves the currently used function.

Parameters

Formatter	A pointer to the ZydisFormatter instance.
type	The formatter function-type.
callback	A pointer to a variable that contains the pointer of the callback function and receives the pointer of the currently used function.

Returns: A zyan status code.

Call this function with callback pointing to a ZYAN_NULL value to retrieve the currently used function without replacing it.

This function returns ZYAN_STATUS_INVALID_OPERATION if a function can't be replaced for the current formatter-style.

◆ ZydisFormatterSetProperty()

ZYDIS_EXPORT ZyanStatus ZydisFormatterSetProperty	(	ZydisFormatter *	formatter,
		ZydisFormatterProperty	property,
		ZyanUPointer	value )

Changes the value of the specified formatter property.

Parameters

Formatter	A pointer to the ZydisFormatter instance.
property	The id of the formatter-property.
value	The new value.

Returns: A zyan status code.

This function returns ZYAN_STATUS_INVALID_OPERATION if a property can't be changed for the current formatter-style.

◆ ZydisFormatterTokenizeInstruction()

ZYDIS_EXPORT ZyanStatus ZydisFormatterTokenizeInstruction	(	const ZydisFormatter *	formatter,
		const ZydisDecodedInstruction *	instruction,
		const ZydisDecodedOperand *	operands,
		ZyanU8	operand_count,
		void *	buffer,
		ZyanUSize	length,
		ZyanU64	runtime_address,
		ZydisFormatterTokenConst **	token,
		void *	user_data )

Tokenizes the given instruction and writes it into the output buffer.

Parameters

Formatter	A pointer to the ZydisFormatter instance.
instruction	A pointer to the ZydisDecodedInstruction struct.
operands	A pointer to the decoded operands array.
operand_count	The length of the operands array. Must be equal to or greater than the value of instruction->operand_count_visible.
buffer	A pointer to the output buffer.
length	The length of the output buffer (in bytes).
runtime_address	The runtime address of the instruction or ZYDIS_RUNTIME_ADDRESS_NONE to print relative addresses.
token	Receives a pointer to the first token in the output buffer.
user_data	A pointer to user-defined data which can be used in custom formatter callbacks. Can be ZYAN_NULL.

Returns: A zyan status code.

◆ ZydisFormatterTokenizeOperand()

ZYDIS_EXPORT ZyanStatus ZydisFormatterTokenizeOperand	(	const ZydisFormatter *	formatter,
		const ZydisDecodedInstruction *	instruction,
		const ZydisDecodedOperand *	operand,
		void *	buffer,
		ZyanUSize	length,
		ZyanU64	runtime_address,
		ZydisFormatterTokenConst **	token,
		void *	user_data )

Tokenizes the given operand and writes it into the output buffer.

Parameters

Formatter	A pointer to the ZydisFormatter instance.
instruction	A pointer to the ZydisDecodedInstruction struct.
operand	A pointer to the ZydisDecodedOperand struct of the operand to format.
buffer	A pointer to the output buffer.
length	The length of the output buffer (in bytes).
runtime_address	The runtime address of the instruction or ZYDIS_RUNTIME_ADDRESS_NONE to print relative addresses.
token	Receives a pointer to the first token in the output buffer.
user_data	A pointer to user-defined data which can be used in custom formatter callbacks. Can be ZYAN_NULL.

Returns: A zyan status code.

Use ZydisFormatterTokenizeInstruction to tokenize a complete instruction.