t_asmmod
Describes binary command produced by Assembleallforms(). If command was compiled in AM_IMPRECISE
mode, contains information necessary to find all variations of this
command. In fact, plugins don't need to know the internal
layout of this structure. They call Assembleallforms() or Getasmsearchmodel() to produce set of models and Comparecommand() or Comparesequence() to find command.
typedef
struct t_asmmod
{
// Description of assembled command
uchar code[MAXCMDSIZE]; // Binary code
uchar
mask[MAXCMDSIZE]; // Mask for binary code (0:
bit ignored)
ulong
prefixes;
// List of prefixes, set of PF_xxx
uchar
ncode;
// Length of code w/o prefixes, bytes
uchar
features;
// Code features, set of AMF_xxx
uchar
postbyte;
// Postbyte (if AMF_POSTBYTE set)
uchar
noperand;
// Number of operands (no pseudooperands)
t_modop
op[NOPERAND]; //
Description of operands
} t_asmmod;
Members:
code
Binary code of the command. In precise mode, this is the complete command of length ncode that includes prefixes and postbyte. If command was compiled in AM_IMPRECISE mode, usually contains only opcode without prefixes and postbyte
mask
Comparison mask, marks significant bits of code. In precise mode, all bits in the mask are set
prefixes
List of prefixes as a combination of flags ASP_xxx. In precise mode, prefixes are included in the code
ncode
Length of the significant part of the code and mask. In precise mode, this is the length of the complete command
features
Combination of zero or more of the following flags. Always zero in precise mode:
AMF_SAMEORDER - set if command accesses memory using SIB and registers (index, base) appear in the same order as in the source
AMF_ANYSEG - set if command must possess segment prefix, but it does not matter which
AMF_POSTBYTE - command includes postbyte
AMF_IMPRECISE
- model is imprecise in the sense that binary code alone is not
sufficient to locate the command and operands must be analysed. This
flag does not influence the comparion of prefixes
AMF_ANYSIZE - size of the operands does not matter, so optional data size prefix is acceptable
AMF_NOSMALL - 16-bit addressing is not allowed
postbyte
Postbyte as a last byte in the command, valid only if AMF_POSTBYTE is set
noperand
Number
of operands in op that must be taken into account when comparing
two commands. May differ from the real number of operands in the found
command
op
Pointer to array of structures t_modop that describe operands. Not used in precise mode
See
also: