Python¶

Architectures¶

Engine¶

class lief.assembly.Engine¶

Bases: object

This class interfaces the assembler/disassembler support

Instruction¶

class lief.assembly.Instruction¶

Bases: object

This class represents an assembly instruction

class MemoryAccess(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Flag

NONE = 0¶

READ = 1¶

WRITE = 2¶

from_value(arg: int) → lief.assembly.Instruction.MemoryAccess = <nanobind.nb_func object>¶

property address → int¶

Address of the instruction

property branch_target → int | lief.lief_errors¶

Given a is_branch instruction, try to evaluate the address of the destination.

property is_add → bool¶

True if the instruction performs an arithmetic addition.

property is_barrier → bool¶

True if the instruction prevents executing the instruction that immediatly follows the current. This includes return or unconditional branch instructions

property is_bitcast → bool¶

True if the instruction is doing a bitcast

property is_branch → bool¶

True if the instruction is a branch

property is_call → bool¶

True if the instruction is a call

property is_compare → bool¶

True if the instruction is a comparison

property is_conditional_branch → bool¶

True if the instruction is conditionally jumping to the next instruction or an instruction into some other basic block.

property is_indirect_branch → bool¶

True if the instruction is and indirect branch.

This includes instructions that branch through a register (e.g. jmp rax, br x1).

property is_memory_access → bool¶

True if the instruction performs a memory access

property is_move_immediate → bool¶

True if the instruction is moving an immediate

property is_move_reg → bool¶

True if the instruction is a register to register move.

property is_return → bool¶

True if the instruction is a return

property is_syscall → bool¶

True if the instruction is a syscall

property is_terminator → bool¶

True if the instruction marks the end of a basic block

property is_trap → bool¶

True if the instruction is a trap.

• On x86/x86-64 this includes the ud1/ud2 instructions

• On AArch64 this includes the brk/udf instructions

property is_unconditional_branch → bool¶

True if the instruction is jumping (unconditionally) to some other basic block.

property memory_access → lief.assembly.Instruction.MemoryAccess¶

Memory access flags

property mnemonic → str¶

Instruction mnemonic (e.g. br)

property raw → bytes¶

Raw bytes of the current instruction

property size → int¶

Size of the instruction in bytes

to_string(self, with_address: bool) → str¶

Representation of the current instruction in a pretty assembly way