t_result
Keeps
result of expression evaluation.
typedef
struct t_result
{
// Result of expression evaluation
int
lvaltype;
// Type of expression, EXPR_xxx
ulong
lvaladdr;
// Address of lvalue or 0
int
datatype;
// Type of data, EXPR_xxx
int
repcount;
// Repeat count (0..32, 0 means default)
union {
uchar
data[10];
// Value as set of bytes
ulong
u;
// Value as address or unsigned integer
long
l;
// Value as signed integer
long double f;
};
// Value as 80-bit float
wchar_t
value[TEXTLEN]; // Value decoded to
string
} t_result;
Members:
lvaltype
Type of the expression treated as a lvalue, one of the following flags optionally combined with EXPR_REG. If expression is not a lvalue (for example, EAX+1 is not because it can't be assigned to), lvaltype is set to EXPR_INVALID. Note that this does not indicate that the expression is invalid or can't be estimated:
EXPR_INVALID - the result of the estimation is not a lvalue and can't be modified
EXPR_BYTE - memory byte at address lvaladdr
EXPR_BYTE|EXPR_REG - 8-bit general register with index lvaladdr
EXPR_WORD - memory word at address lvaladdr
EXPR_WORD|EXPR_REG - 16-bit general register with index lvaladdr
EXPR_DWORD - memory doubleword at address lvaladdr
EXPR_DWORD|EXPR_REG - 32-bit general register with index lvaladdr
EXPR_FLOAT4 - 32-bit floating-point number in the memory at address lvaladdr
EXPR_FLOAT8 - 64-bit floating-point number in the memory at address lvaladdr
EXPR_FLOAT10 - 80-bit floating-point number in the memory at address lvaladdr
EXPR_FLOAT10|EXPR_REG - 80-bit FPU register with index lvaladdr
EXPR_SEG|EXPR_REG - 16-bit segment register with index lvaladdr
EXPR_ASCII - lvaladdr is the address of ASCII string in the memory
EXPR_UNICODE - lvaladdr is the address of UNICODE string in the memory
lvaladdr
If lvaltype is EXPR_INVALID, lvaladdr is undefined. If flag EXPR_REG in lvaltype is not set, this is the address of the memory to which the supplied expression extimates. If EXPR_REG is set, this is the index of the register.
datatype
Type of result, one of the following combinations:
EXPR_INVALID - expression is invalid or can't be evaluated, value contains error message
EXPR_DWORD - expression evaluates to unsigned integer number u
EXPR_DWORD|EXPR_SIGNED (shortcut EXPR_SIGDWORD) - expression evaluates to signed integer number i
EXPR_FLOAT10 - expression evaluates to floating-point number f
EXPR_ASCII - the result is a pointer to ASCII string in u
EXPR_UNICODE - the result is a pointer to UNICODE string u
EXPR_TEXT - the result is an immediate UNICODE string in value
repcount
Repeat count for the outermost memory expression, may differ from 1 only if expression was evaluated in EMOD_MULTI mode
data
Binary value of the expression. If repcount is higher than 1, data contains only the first evaluated item
u
Binary value if expression estimates to unsigned integer or pointer
l
Binary value if expression estimates to signed integer
f
Binary value if expression estimates to floating-point number
value
Result of expression estimation in the human-readable form. If datatype is EXPR_ASCII or EXPR_UNICODE, value is the pointed string in UNICODE format. If datatype is EXPR_INVALID, result contains error message. Binary-to-human conversion may be time-consuming. To suppress it, use EMOD_NOVALUE
See
also: