eBPF¶

Instruction¶

class lief.assembly.ebpf.Instruction¶

Bases: Instruction

This class represents an eBPF instruction

property opcode → lief.assembly.ebpf.OPCODE¶: The instruction opcode as defined in LLVM

property operands → Iterator[lief.assembly.ebpf.Operand | None]¶: Iterator over the operands of the current instruction

See: lief.assembly.ebpf.OPCODE

class lief.assembly.ebpf.Operand¶

Bases: object

This class represents an operand for an eBPF instruction

class lief.assembly.ebpf.operands.Immediate¶

Bases: Operand

This class represents an immediate operand (i.e. a constant)

For instance:

r1 = 8
     |
     +---> Immediate(8)

class lief.assembly.ebpf.operands.Register¶

Bases: Operand

This class represents a register operand.

For instance:

r0 = r1
 |    |
 |    +---------> Register(r1)
 |
 +--------------> Register(r0)

property value → lief.assembly.ebpf.REG¶: The effective lief.assembly.ebpf.REG wrapped by this operand

class lief.assembly.ebpf.operands.Memory¶

Bases: Operand

This class represents a memory operand.

*(u64 *)(r1 + 8) = r2
          |    |
          |    +-----> Displacement: 8
          |
          +----------> Base: r1

property base → lief.assembly.ebpf.REG¶

The base register.

For *(u64 *)(r1 + 8) it would return r1.

property displacement → int¶

The displacement value.

For *(u64 *)(r1 + 8) it would return 8.

class lief.assembly.ebpf.operands.PCRelative¶

Bases: Operand

This class represents a PC-relative operand.

if r1 == 0 goto +5
                |
                v
        PC Relative operand

property value → int¶: The effective value that is relative to the current pc register