eBPF

Instruction

class lief.assembly.ebpf.Instruction

Bases: Instruction

This class represents an eBPF instruction

property opcode → lief.assembly.ebpf.OPCODE

The instruction opcode as defined in LLVM

property operands → Iterator[lief.assembly.ebpf.Operand | None]

Iterator over the operands of the current instruction

Opcodes

See: lief.assembly.ebpf.OPCODE

Operands

class lief.assembly.ebpf.Operand

Bases: object

This class represents an operand for an eBPF instruction

property to_string → str

Pretty representation of the operand

Immediate

class lief.assembly.ebpf.operands.Immediate

Bases: Operand

This class represents an immediate operand (i.e. a constant)

For instance:

r1 = 8
     |
     +---> Immediate(8)

property value → int

The constant value wrapped by this operand

Register

class lief.assembly.ebpf.operands.Register

Bases: Operand

This class represents a register operand.

For instance:

r0 = r1
 |    |
 |    +---------> Register(r1)
 |
 +--------------> Register(r0)

property value → lief.assembly.ebpf.REG

The effective lief.assembly.ebpf.REG wrapped by this operand

Memory

class lief.assembly.ebpf.operands.Memory

Bases: Operand

This class represents a memory operand.

*(u64 *)(r1 + 8) = r2
          |    |
          |    +-----> Displacement: 8
          |
          +----------> Base: r1

property base → lief.assembly.ebpf.REG

The base register.

For *(u64 *)(r1 + 8) it would return r1.

property displacement → int

The displacement value.

For *(u64 *)(r1 + 8) it would return 8.

PCRelative

class lief.assembly.ebpf.operands.PCRelative

Bases: Operand

This class represents a PC-relative operand.

if r1 == 0 goto +5
                |
                v
        PC Relative operand

property value → int

The effective value that is relative to the current pc register