INSTRTYPE Structure
this structure gives informations on the analyzed instruction.
struct INSTRTYPE {
long Category;
long Opcode;
char Mnemonic[16];
long BranchType;
EFLStruct Flags;
long long AddrValue;
long long Immediat;
long ImplicitModifiedRegs;
};
Membres
Category
[out] Specify the family instruction . More precisely, (MyDisasm.Instruction.Category & 0xFFFF0000) is used to know if the instruction is a standard one or comes from one of the following technologies : MMX, FPU, SSE, SSE2, SSE3, SSSE3, SSE4.1, SSE4.2, VMX or SYSTEM. LOWORD(MyDisasm.Instruction.Category) is used to know if the instruction is an arithmetic instruction, a logical one, a data transfer one ... To see the complete list of constants used by BeaEngine, go HERE .
Opcode
[out] This field contains the opcode on 1, 2 or 3 bytes. If the instruction uses a mandatory prefix, this last one is not present here. For that, you have to use the structure MyDisasm.Prefix.
Mnemonic
[out] This field sends back the instruction mnemonic with an ASCII format. You must know that all mnemonics are followed by a space (0x20). For example , the instruction "add" is written "add ".
BranchType
[out] If the decoded instruction is a branch instruction, this field is set to indicate what kind of jump it is (call, ret, unconditional jump, conditional jump). To get a complete list of constants used by BeaEngine, go HERE
Flags
[out] Structure EFLStruct that specifies the used flags.
AddrValue
[out] If the decoded instruction is a branch instruction and if the destination address can be calculated, the result is stored in that field. A "jmp eax" or a "jmp [eax]" will set this field to 0 .
Immediat
[out] If the instruction uses a constant, this immediat value is stored here.
ImplicitModifiedRegs
[out] Some instructions modify registers implicitly. For example, "push 0" modifies the register ESP. In that case, MyDisasm.Instruction.ImplicitModifiedRegs == REGISTER_TYPE + GENERAL_REG + REG4.
