Struct iced_x86::Instruction

source · [−]

pub struct Instruction { /* private fields */ }

Expand description

A 16/32/64-bit x86 instruction. Created by Decoder, by CodeAssembler or by Instruction::with*() methods.

Implementations

source

impl Instruction

source

pub fn new() -> Self

Creates an empty Instruction (all fields are cleared). See also the with_*() constructor methods.

source

pub fn eq_all_bits(&self, other: &Self) -> bool

Checks if two instructions are equal, comparing all bits, not ignoring anything. == ignores some fields.

Gets all op kinds (op_count() values)

pub fn op_kind(&self, operand: u32) -> OpKind

Gets an operand’s kind if it exists (see op_count())

pub fn set_op_kind(&mut self, operand: u32, op_kind: OpKind)

Sets an operand’s kind

Arguments

operand: Operand number, 0-4
op_kind: Operand kind

source

pub const fn has_segment_prefix(&self) -> bool

Checks if the instruction has a segment override prefix, see segment_prefix()

source

pub fn segment_prefix(&self) -> Register

Gets the segment override prefix or Register::None if none. See also memory_segment(). Use this method if the operand has kind OpKind::Memory, OpKind::MemorySegSI, OpKind::MemorySegESI, OpKind::MemorySegRSI

source

pub fn set_segment_prefix(&mut self, new_value: Register)

Sets the segment override prefix or Register::None if none. See also memory_segment(). Use this method if the operand has kind OpKind::Memory, OpKind::MemorySegSI, OpKind::MemorySegESI, OpKind::MemorySegRSI

Arguments

new_value: Segment register prefix

Gets the index register scale value, valid values are *1, *2, *4, *8. Use this method if the operand has kind OpKind::Memory

source

pub fn set_memory_index_scale(&mut self, new_value: u32)

Sets the index register scale value, valid values are *1, *2, *4, *8. Use this method if the operand has kind OpKind::Memory

Arguments

new_value: New value (1, 2, 4 or 8)

source

pub const fn memory_displacement32(&self) -> u32

Gets the memory operand’s displacement or the 32-bit absolute address if it’s an EIP or RIP relative memory operand. Use this method if the operand has kind OpKind::Memory

source

pub fn set_memory_displacement32(&mut self, new_value: u32)

Gets the memory operand’s displacement or the 32-bit absolute address if it’s an EIP or RIP relative memory operand. Use this method if the operand has kind OpKind::Memory

Arguments

new_value: New value

Gets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate8

source

pub fn set_immediate8(&mut self, new_value: u8)

Sets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate8

Arguments

new_value: New value

source

pub const fn immediate8_2nd(&self) -> u8

Gets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate8_2nd

source

pub fn set_immediate8_2nd(&mut self, new_value: u8)

Sets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate8_2nd

Arguments

new_value: New value

source

pub const fn immediate16(&self) -> u16

Gets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate16

source

pub fn set_immediate16(&mut self, new_value: u16)

Sets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate16

Arguments

new_value: New value

source

pub const fn immediate32(&self) -> u32

Gets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate32

source

pub fn set_immediate32(&mut self, new_value: u32)

Sets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate32

Arguments

new_value: New value

source

pub const fn immediate64(&self) -> u64

Gets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate64

source

pub fn set_immediate64(&mut self, new_value: u64)

Sets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate64

Arguments

new_value: New value

source

pub const fn immediate8to16(&self) -> i16

Gets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate8to16

source

pub fn set_immediate8to16(&mut self, new_value: i16)

Sets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate8to16

Arguments

new_value: New value

source

pub const fn immediate8to32(&self) -> i32

Gets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate8to32

source

pub fn set_immediate8to32(&mut self, new_value: i32)

Sets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate8to32

Arguments

new_value: New value

source

pub const fn immediate8to64(&self) -> i64

Gets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate8to64

source

pub fn set_immediate8to64(&mut self, new_value: i64)

Sets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate8to64

Arguments

new_value: New value

source

pub const fn immediate32to64(&self) -> i64

Gets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate32to64

source

pub fn set_immediate32to64(&mut self, new_value: i64)

Sets the operand’s immediate value. Use this method if the operand has kind OpKind::Immediate32to64

Arguments

new_value: New value

source

pub const fn near_branch16(&self) -> u16

Gets the operand’s branch target. Use this method if the operand has kind OpKind::NearBranch16

source

pub fn set_near_branch16(&mut self, new_value: u16)

Sets the operand’s branch target. Use this method if the operand has kind OpKind::NearBranch16

Arguments

new_value: New value

source

pub const fn near_branch32(&self) -> u32

Gets the operand’s branch target. Use this method if the operand has kind OpKind::NearBranch32

source

pub fn set_near_branch32(&mut self, new_value: u32)

Sets the operand’s branch target. Use this method if the operand has kind OpKind::NearBranch32

Arguments

new_value: New value

source

pub const fn near_branch64(&self) -> u64

Gets the operand’s branch target. Use this method if the operand has kind OpKind::NearBranch64

source

pub fn set_near_branch64(&mut self, new_value: u64)

Sets the operand’s branch target. Use this method if the operand has kind OpKind::NearBranch64

Arguments

new_value: New value

Sets operand #4’s register value. Use this method if operand #4 (op0_kind()) has kind OpKind::Register, see op_count() and try_op_register()

Arguments

new_value: New value

source

pub fn op_register(&self, operand: u32) -> Register

Gets the operand’s register value. Use this method if the operand has kind OpKind::Register

Arguments

operand: Operand number, 0-4

Examples

use iced_x86::*;

// add [rax],ebx
let bytes = b"\x01\x18";
let mut decoder = Decoder::new(64, bytes, DecoderOptions::NONE);
let instr = decoder.decode();

assert_eq!(instr.op_count(), 2);
assert_eq!(instr.op_kind(0), OpKind::Memory);
assert_eq!(instr.op_kind(1), OpKind::Register);
assert_eq!(instr.op_register(1), Register::EBX);

source

pub fn set_op_register(&mut self, operand: u32, new_value: Register)

Sets the operand’s register value. Use this method if the operand has kind OpKind::Register

Arguments

operand: Operand number, 0-4
new_value: New value

source

pub fn op_mask(&self) -> Register

Gets the opmask register (Register::K1 - Register::K7) or Register::None if none

source

pub fn set_op_mask(&mut self, new_value: Register)

Sets the opmask register (Register::K1 - Register::K7) or Register::None if none

Arguments

new_value: New value

Sets a new db value, see also declare_data_len(). Can only be called if code() is Code::DeclareByte

Errors

Fails if index is invalid

Arguments

index: Index (0-15)
new_value: New value

source

pub fn set_declare_byte_value(&mut self, index: usize, new_value: u8)

Sets a new db value, see also declare_data_len(). Can only be called if code() is Code::DeclareByte

Arguments

index: Index (0-15)
new_value: New value

source

pub fn get_declare_byte_value(&self, index: usize) -> u8

Gets a db value, see also declare_data_len(). Can only be called if code() is Code::DeclareByte

Arguments

index: Index (0-15)

source

pub fn set_declare_word_value_i16(&mut self, index: usize, new_value: i16)

Sets a new dw value, see also declare_data_len(). Can only be called if code() is Code::DeclareWord

Arguments

index: Index (0-7)
new_value: New value

source

pub fn set_declare_word_value(&mut self, index: usize, new_value: u16)

Sets a new dw value, see also declare_data_len(). Can only be called if code() is Code::DeclareWord

Arguments

index: Index (0-7)
new_value: New value

source

pub fn get_declare_word_value(&self, index: usize) -> u16

Gets a dw value, see also declare_data_len(). Can only be called if code() is Code::DeclareWord

Arguments

index: Index (0-7)

source

pub fn set_declare_dword_value_i32(&mut self, index: usize, new_value: i32)

Sets a new dd value, see also declare_data_len(). Can only be called if code() is Code::DeclareDword

Arguments

index: Index (0-3)
new_value: New value

source

pub fn set_declare_dword_value(&mut self, index: usize, new_value: u32)

Sets a new dd value, see also declare_data_len(). Can only be called if code() is Code::DeclareDword

Arguments

index: Index (0-3)
new_value: New value

source

pub fn get_declare_dword_value(&self, index: usize) -> u32

Gets a dd value, see also declare_data_len(). Can only be called if code() is Code::DeclareDword

Arguments

index: Index (0-3)

source

pub fn set_declare_qword_value_i64(&mut self, index: usize, new_value: i64)

Sets a new dq value, see also declare_data_len(). Can only be called if code() is Code::DeclareQword

Arguments

index: Index (0-1)
new_value: New value

source

pub fn set_declare_qword_value(&mut self, index: usize, new_value: u64)

Sets a new dq value, see also declare_data_len(). Can only be called if code() is Code::DeclareQword

Arguments

index: Index (0-1)
new_value: New value

source

pub fn get_declare_qword_value(&self, index: usize) -> u64

Gets a dq value, see also declare_data_len(). Can only be called if code() is Code::DeclareQword

Arguments

index: Index (0-1)

source

pub const fn is_vsib(&self) -> bool

Checks if this is a VSIB instruction, see also is_vsib32(), is_vsib64()

Gets the RIP/EIP releative address (memory_displacement32() or memory_displacement64()). This method is only valid if there’s a memory operand with RIP/EIP relative addressing, see is_ip_rel_memory_operand()

source

pub fn virtual_address<F>(
 &self,
 operand: u32,
 element_index: usize,
 get_register_value: F
) -> Option<u64>where
 F: FnMut(Register, usize, usize) -> Option<u64>,

Gets the virtual address of a memory operand

Arguments

operand: Operand number, 0-4, must be a memory operand
element_index: Only used if it’s a vsib memory operand. This is the element index of the vector index register.
get_register_value: Function that returns the value of a register or the base address of a segment register, or None for unsupported registers.

Call-back function args

Arg 1: register: Register (GPR8, GPR16, GPR32, GPR64, XMM, YMM, ZMM, seg). If it’s a segment register, the call-back function should return the segment’s base address, not the segment’s register value.
Arg 2: element_index: Only used if it’s a vsib memory operand. This is the element index of the vector index register.
Arg 3: element_size: Only used if it’s a vsib memory operand. Size in bytes of elements in vector index register (4 or 8).

Examples

use iced_x86::*;

// add [rdi+r12*8-5AA5EDCCh],esi
let bytes = b"\x42\x01\xB4\xE7\x34\x12\x5A\xA5";
let mut decoder = Decoder::new(64, bytes, DecoderOptions::NONE);
let instr = decoder.decode();

let va = instr.virtual_address(0, 0, |register, _element_index, _element_size| {
    match register {
        // The base address of ES, CS, SS and DS is always 0 in 64-bit mode
        Register::DS => Some(0x0000_0000_0000_0000),
        Register::RDI => Some(0x0000_0000_1000_0000),
        Register::R12 => Some(0x0000_0004_0000_0000),
        _ => None,
    }
});
assert_eq!(va, Some(0x0000_001F_B55A_1234));

source

use iced_x86::*;

// or ecx,esi
// ud0 rcx,rsi
// call rcx
let bytes = b"\x0B\xCE\x48\x0F\xFF\xCE\xFF\xD1";
let mut decoder = Decoder::new(64, bytes, DecoderOptions::NONE);

// or ecx,esi
let instr = decoder.decode();
assert_eq!(instr.flow_control(), FlowControl::Next);

// ud0 rcx,rsi
let instr = decoder.decode();
assert_eq!(instr.flow_control(), FlowControl::Exception);

// call rcx
let instr = decoder.decode();
assert_eq!(instr.flow_control(), FlowControl::IndirectCall);

source

pub fn is_privileged(&self) -> bool

true if it’s a privileged instruction (all CPL=0 instructions (except VMCALL) and IOPL instructions IN, INS, OUT, OUTS, CLI, STI)

source

pub fn is_stack_instruction(&self) -> bool

true if this is an instruction that implicitly uses the stack pointer (SP/ESP/RSP), eg. CALL, PUSH, POP, RET, etc. See also stack_pointer_increment()

Examples

use iced_x86::*;

// or ecx,esi
// push rax
let bytes = b"\x0B\xCE\x50";
let mut decoder = Decoder::new(64, bytes, DecoderOptions::NONE);

// or ecx,esi
let instr = decoder.decode();
assert!(!instr.is_stack_instruction());

// push rax
let instr = decoder.decode();
assert!(instr.is_stack_instruction());
assert_eq!(instr.stack_pointer_increment(), -8);

source

pub fn is_save_restore_instruction(&self) -> bool

true if it’s an instruction that saves or restores too many registers (eg. FXRSTOR, XSAVE, etc).

Creates an instruction with 1 operand

Errors

Fails if one of the operands is invalid (basic checks)

Arguments

code: Code value
op0: First operand (eg. a Register, an integer (a u32/i64/u64 number suffix is sometimes needed), or a MemoryOperand)

Examples

use iced_x86::*;

let _ = Instruction::with1(Code::Pop_rm64, Register::RCX)?;
let _ = Instruction::with1(Code::Pop_rm64, MemoryOperand::new(Register::RBP, Register::RSI, 2, -0x5432_10FF, 8, false, Register::FS))?;

source

pub fn with2<T, U>(code: Code, op0: T, op1: U) -> Result<Instruction, IcedError>where
Self: With2<T, U>,

Creates an instruction with 2 operands

Errors

Fails if one of the operands is invalid (basic checks)

Arguments

code: Code value
op0: First operand (eg. a Register, an integer (a u32/i64/u64 number suffix is sometimes needed), or a MemoryOperand)
op1: Second operand

Examples

use iced_x86::*;

let _ = Instruction::with2(Code::Add_rm8_r8, Register::CL, Register::DL)?;
let _ = Instruction::with2(Code::Add_r8_rm8, Register::CL, MemoryOperand::new(Register::RBP, Register::RSI, 2, -0x5432_10FF, 8, false, Register::FS))?;

source

pub fn with3<T, U, V>(
 code: Code,
 op0: T,
 op1: U,
 op2: V
) -> Result<Instruction, IcedError>where
 Self: With3<T, U, V>,

Creates an instruction with 3 operands

Errors

Fails if one of the operands is invalid (basic checks)

Arguments

code: Code value
op0: First operand (eg. a Register, an integer (a u32/i64/u64 number suffix is sometimes needed), or a MemoryOperand)
op1: Second operand
op2: Third operand

Examples

use iced_x86::*;

let _ = Instruction::with3(Code::Imul_r16_rm16_imm16, Register::CX, Register::DX, 0x5AA5)?;
let _ = Instruction::with3(Code::Imul_r16_rm16_imm16, Register::CX, MemoryOperand::new(Register::RBP, Register::RSI, 2, -0x5432_10FF, 8, false, Register::FS), 0xA55A)?;

source

pub fn with4<T, U, V, W>(
 code: Code,
 op0: T,
 op1: U,
 op2: V,
 op3: W
) -> Result<Instruction, IcedError>where
 Self: With4<T, U, V, W>,

Creates an instruction with 4 operands

Errors

Fails if one of the operands is invalid (basic checks)

Arguments

code: Code value
op0: First operand (eg. a Register, an integer (a u32/i64/u64 number suffix is sometimes needed), or a MemoryOperand)
op1: Second operand
op2: Third operand
op3: Fourth operand

Examples

use iced_x86::*;

let _ = Instruction::with4(Code::Insertq_xmm_xmm_imm8_imm8, Register::XMM1, Register::XMM2, 0xA5, 0xFD)?;
let _ = Instruction::with4(Code::VEX_Vfmaddsubps_xmm_xmm_xmm_xmmm128, Register::XMM1, Register::XMM2, Register::XMM3, MemoryOperand::new(Register::RBP, Register::RSI, 2, -0x5432_10FF, 8, false, Register::FS))?;

source

pub fn with5<T, U, V, W, X>(
 code: Code,
 op0: T,
 op1: U,
 op2: V,
 op3: W,
 op4: X
) -> Result<Instruction, IcedError>where
 Self: With5<T, U, V, W, X>,

Creates an instruction with 5 operands

Errors

Fails if one of the operands is invalid (basic checks)

Arguments

code: Code value
op0: First operand (eg. a Register, an integer (a u32/i64/u64 number suffix is sometimes needed), or a MemoryOperand)
op1: Second operand
op2: Third operand
op3: Fourth operand
op4: Fifth operand

Examples

use iced_x86::*;

let _ = Instruction::with5(Code::VEX_Vpermil2ps_xmm_xmm_xmmm128_xmm_imm4, Register::XMM1, Register::XMM2, Register::XMM3, Register::XMM4, 0x0)?;
let _ = Instruction::with5(Code::VEX_Vpermil2ps_xmm_xmm_xmm_xmmm128_imm4, Register::XMM1, Register::XMM2, Register::XMM3, MemoryOperand::new(Register::RBP, Register::RSI, 2, -0x5432_10FF, 8, false, Register::FS), 0x1)?;