x86/x86-64¶

Instruction¶

class lief.assembly.x86.Instruction¶

Bases: Instruction

This class represents a x86/x86-64 instruction

property opcode → lief.assembly.x86.OPCODE¶: The instruction opcode as defined in LLVM

property operands → Iterator[lief.assembly.x86.Operand | None]¶: Iterator over the operands of the current instruction

Opcodes¶

See: lief.assembly.x86.OPCODE

Operands¶

class lief.assembly.x86.Operand¶

Bases: object

This class represents an operand for an x86/x86-64 instruction

property to_string → str¶: Pretty representation of the operand

Immediate¶

class lief.assembly.x86.operands.Immediate¶

Bases: Operand

This class represents an immediate operand (i.e. a constant)

For instance:

mov edi, 1;
         |
         +---> Immediate(1)

property value → int¶: The constant value wrapped by this operand

Register¶

class lief.assembly.x86.operands.Register¶

Bases: Operand

This class represents a register operand.

For instance:

mov r15d, edi
     |     |
     |     +---------> Register(EDI)
     |
     +---------------> Register(R15D)

property value → lief.assembly.x86.REG¶: The effective lief.assembly.x86.REG wrapped by this operand

Memory¶

class lief.assembly.x86.operands.Memory¶

Bases: Operand

This class represents a memory operand.

For instance:

movq xmm3, qword ptr [rip + 823864];

                     |
                     |
                   Memory
                     |
         +-----------+-----------+
         |           |           |
     Base: rip    Scale: 1    Displacement: 823864

property base → lief.assembly.x86.REG¶

The base register.

For lea rdx, [rip + 244634] it would return rip

property displacement → int¶

The displacement value.

For call qword ptr [rip + 248779] it would return 248779

property scale → int¶

The scale value associated with the scaled_register:

For mov rdi, qword ptr [r13 + 8*r14] it would return 8

property scaled_register → lief.assembly.x86.REG¶

The scaled register.

For mov rdi, qword ptr [r13 + 8*r14] it would return r14

property segment_register → lief.assembly.x86.REG¶

The segment register associated with the memory operation.

For mov eax, dword ptr gs:[0] is would return gs

PCRelative¶

class lief.assembly.x86.operands.PCRelative¶

Bases: Operand

This class represents a RIP/EIP-relative operand.

For instance:

jmp 67633;
    |
    +----------> PCRelative(67633)

property value → int¶: The effective value that is relative to the current rip/eip register