eBPF

Instruction

class Instruction : public LIEF::assembly::Instruction

This class represents an eBPF instruction.

Public Types

using operands_it = iterator_range<Operand::Iterator>

Public Functions

OPCODE opcode() const

The instruction opcode as defined in LLVM.

operands_it operands() const

Iterator over the operands of the current instruction.

virtual ~Instruction() override = default

Public Static Functions

static bool classof(const assembly::Instruction *inst)

True if inst is an effective instance of ebpf::Instruction.

Opcodes

See LIEF::assembly::ebpf::OPCODE in include/asm/ebpf/opcodes.hpp

Operands

class Operand

This class represents an operand for an eBPF instruction.

Subclassed by LIEF::assembly::ebpf::operands::Immediate, LIEF::assembly::ebpf::operands::Memory, LIEF::assembly::ebpf::operands::PCRelative, LIEF::assembly::ebpf::operands::Register

Public Functions

std::string to_string() const

Pretty representation of the operand.

template<class T>
inline const T *as() const

This function can be used to down cast an Operand instance:

std::unique_ptr<assembly::ebpf::Operand> op = ...;
if (const auto* imm = inst->as<assembly::ebpf::operands::Immediate>()) {
  const int64_t value = imm->value();
}

virtual ~Operand()

Friends

inline friend std::ostream &operator<<(std::ostream &os, const Operand &op)

class Iterator : public LIEF::iterator_facade_base<Iterator, std::forward_iterator_tag, Operand, std::ptrdiff_t, const Operand*, const Operand&>

Forward iterator that lazily disassembles ebpf Operand.

Public Types

using implementation = details::OperandIt

Public Functions

Iterator()

Iterator(std::unique_ptr<details::OperandIt> impl)

Iterator(const Iterator&)

Iterator &operator=(const Iterator&)

Iterator(Iterator&&) noexcept

Iterator &operator=(Iterator&&) noexcept

~Iterator()

Iterator &operator++()

const Operand &operator*() const

const Operand *operator->() const

std::unique_ptr<Operand> yield()

Transfer ownership of the operand at the current position to the caller. Returns nullptr if the iterator is past-the-end.

inline DerivedT operator++(int)

Friends

friend bool operator==(const Iterator &LHS, const Iterator &RHS)

inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS)

Immediate

class Immediate : public LIEF::assembly::ebpf::Operand

This class represents an immediate operand (i.e. a constant).

For instance:

r1 = 8
     |
     +---> Immediate(8)

Public Functions

int64_t value() const

The constant value wrapped by this operand.

~Immediate() override = default

Public Static Functions

static bool classof(const Operand *op)

Register

class Register : public LIEF::assembly::ebpf::Operand

This class represents a register operand.

For instance:

r0 = r1
 |    |
 |    +---------> Register(r1)
 |
 +--------------> Register(r0)

Public Functions

REG value() const

The effective REG wrapped by this operand.

~Register() override = default

Public Static Functions

static bool classof(const Operand *op)

Memory

class Memory : public LIEF::assembly::ebpf::Operand

This class represents a memory operand.

*(u64 *)(r1 + 8) = r2
          |    |
          |    +-----> Displacement: 8
          |
          +----------> Base: r1

Public Functions

REG base() const

The base register.

For *(u64 *)(r1 + 8) it would return r1.

int64_t displacement() const

The displacement value.

For *(u64 *)(r1 + 8) it would return 8.

~Memory() override = default

Public Static Functions

static bool classof(const Operand *op)

PCRelative

class PCRelative : public LIEF::assembly::ebpf::Operand

This class represents a PC-relative operand.

if r1 == 0 goto +5
                |
                v
        PC Relative operand

Public Functions

int64_t value() const

The effective value that is relative to the current pc register.

~PCRelative() override = default

Public Static Functions

static bool classof(const Operand *op)