eBPF¶

Instruction¶

class Instruction : public LIEF::assembly::Instruction¶

This class represents an eBPF instruction.

Public Types

using operands_it = iterator_range<Operand::Iterator>¶

Public Functions

OPCODE opcode() const¶

The instruction opcode as defined in LLVM.

operands_it operands() const¶

Iterator over the operands of the current instruction.

virtual ~Instruction() override = default¶

Public Static Functions

static bool classof(const assembly::Instruction *inst)¶

True if inst is an effective instance of ebpf::Instruction.

Opcodes¶

See LIEF::assembly::ebpf::OPCODE in include/asm/ebpf/opcodes.hpp

Operands¶

class Operand¶

This class represents an operand for an eBPF instruction.

Subclassed by LIEF::assembly::ebpf::operands::Immediate, LIEF::assembly::ebpf::operands::Memory, LIEF::assembly::ebpf::operands::PCRelative, LIEF::assembly::ebpf::operands::Register

Public Functions

std::string to_string() const¶

Pretty representation of the operand.

template<class T>
inline const T *as() const¶

This function can be used to down cast an Operand instance:

std::unique_ptr<assembly::ebpf::Operand> op = ...;
if (const auto* imm = inst->as<assembly::ebpf::operands::Immediate>()) {
  const int64_t value = imm->value();
}

virtual ~Operand()¶

Friends

inline friend std::ostream &operator<<(std::ostream &os, const Operand &op)¶

class Iterator : public LIEF::iterator_facade_base<Iterator, std::forward_iterator_tag, Operand, std::ptrdiff_t, const Operand*, const Operand&>¶

Forward iterator that lazily disassembles ebpf Operand.

Public Types

using implementation = details::OperandIt¶

Public Functions

Iterator()¶

Iterator(std::unique_ptr<details::OperandIt> impl)¶

Iterator(const Iterator&)¶

Iterator &operator=(const Iterator&)¶

Iterator(Iterator&&) noexcept¶

Iterator &operator=(Iterator&&) noexcept¶

~Iterator()¶

Iterator &operator++()¶

const Operand &operator*() const¶

const Operand *operator->() const¶

std::unique_ptr<Operand> yield()¶

Transfer ownership of the operand at the current position to the caller. Returns nullptr if the iterator is past-the-end.

inline DerivedT operator++(int)¶

Friends

friend bool operator==(const Iterator &LHS, const Iterator &RHS)¶

inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS)¶