x86 disassembler¶
-
class
malduck.disasm.
Disassemble
[source]¶ -
disassemble
(data: bytes, addr: int, x64: bool = False, count: int = 0) → Iterator[malduck.disasm.Instruction][source]¶ Disassembles data from specific address
Changed in version 4.0.0: Returns iterator instead of list of instructions, accepts maximum number of instructions to disassemble
short: disasm
- Parameters
data (bytes) – Block of data to disasseble
addr (int) – Virtual address of data
x64 (bool (default=False)) – Disassemble in x86-64 mode?
count (int (default=0)) – Number of instructions to disassemble
- Returns
Returns iterator of instructions
- Return type
Iterator[
Instruction
]
-
-
class
malduck.disasm.
Instruction
(mnem: Optional[str] = None, op1: Optional[malduck.disasm.Operand] = None, op2: Optional[malduck.disasm.Operand] = None, op3: Optional[malduck.disasm.Operand] = None, addr: Optional[int] = None, x64: bool = False)[source]¶ Represents single instruction in
Disassemble
short: insn
Properties correspond to the following elements of instruction:
00400000 imul ecx, edx, 0 [addr] [mnem] [op1], [op2], [op3]
Usage example:
def get_move_value(self, p, hit, *args): # find move value of `mov eax, x` for ins in p.disasmv(hit, 0x100): if ins.mnem == 'mov' and ins.op1.value == 'eax': return ins.op2.value
See also
malduck.procmem.ProcessMemory.disasmv()
-
property
addr
¶ Instruction address
-
property
op1
¶ First operand
-
property
op2
¶ Second operand
-
property
op3
¶ Third operand
-
property
-
class
malduck.disasm.
Operand
(op: capstone.x86.X86Op, x64: bool)[source]¶ Operand object for single
Instruction
-
property
is_imm
¶ Is it immediate operand?
-
property
is_mem
¶ Is it memory operand?
-
property
is_reg
¶ Is it register operand?
-
property
reg
¶ Returns register used by operand.
For memory operands, returns base register or index register if base is not used. For immediate operands or displacement-only memory operands returns None.
- Return type
str
-
property
value
¶ Returns operand value or displacement value for memory operands
- Return type
str or int or None
-
property