Typedefs
typedef PREDICATE_IA32	LEVEL_BASE::PREDICATE

Enumerations
enum	LEVEL_CORE::MEMORY_TYPE { MEMORY_TYPE_READ, MEMORY_TYPE_WRITE, MEMORY_TYPE_READ2 }

enum	LEVEL_CORE::SYSCALL_STANDARD { LEVEL_CORE::SYSCALL_STANDARD_INVALID, LEVEL_CORE::SYSCALL_STANDARD_IA32_LINUX, LEVEL_CORE::SYSCALL_STANDARD_IA32_LINUX_SYSENTER, LEVEL_CORE::SYSCALL_STANDARD_IA32E_LINUX, LEVEL_CORE::SYSCALL_STANDARD_IA32E_LINUX_VSYSCALL, LEVEL_CORE::SYSCALL_STANDARD_IA32_MAC, LEVEL_CORE::SYSCALL_STANDARD_IA32E_MAC, LEVEL_CORE::SYSCALL_STANDARD_IA32_WINDOWS_FAST, LEVEL_CORE::SYSCALL_STANDARD_IA32E_WINDOWS_FAST, LEVEL_CORE::SYSCALL_STANDARD_IA32_WINDOWS_ALT, LEVEL_CORE::SYSCALL_STANDARD_WOW64, LEVEL_CORE::SYSCALL_STANDARD_WINDOWS_INT }

Functions
INT32	LEVEL_CORE::INS_Category (const INS ins)

INT32	LEVEL_CORE::INS_Extension (const INS ins)

USIZE	LEVEL_CORE::INS_MemoryOperandSize (INS ins, UINT32 memoryOp)

USIZE	LEVEL_CORE::INS_MemoryOperandElementSize (INS ins, UINT32 memoryOp)

PIN_DEPRECATED_API USIZE	LEVEL_CORE::INS_MemoryWriteSize (INS ins)

PIN_DEPRECATED_API USIZE	LEVEL_CORE::INS_MemoryReadSize (INS ins)

PREDICATE	LEVEL_CORE::INS_GetPredicate (INS ins)

BOOL	LEVEL_CORE::INS_IsMemoryRead (INS ins)

BOOL	LEVEL_CORE::INS_IsMemoryWrite (INS ins)

BOOL	LEVEL_CORE::INS_HasMemoryRead2 (INS ins)

BOOL	LEVEL_CORE::INS_HasFallThrough (INS ins)

BOOL	LEVEL_CORE::INS_IsLea (INS ins)

BOOL	LEVEL_CORE::INS_IsNop (INS ins)

std::string	LEVEL_CORE::OPCODE_StringShort (UINT32 opcode)

std::string	LEVEL_CORE::INS_Mnemonic (INS ins)

BOOL	LEVEL_CORE::INS_IsBranch (INS ins)

BOOL	LEVEL_CORE::INS_IsDirectBranch (INS ins)

BOOL	LEVEL_CORE::INS_IsDirectCall (INS ins)

PIN_DEPRECATED_API BOOL	LEVEL_CORE::INS_IsDirectBranchOrCall (INS ins)

BOOL	LEVEL_CORE::INS_IsDirectControlFlow (INS ins)

PIN_DEPRECATED_API BOOL	LEVEL_CORE::INS_IsBranchOrCall (INS ins)

BOOL	LEVEL_CORE::INS_Stutters (INS ins)

BOOL	LEVEL_CORE::INS_IsCall (INS ins)

BOOL	LEVEL_CORE::INS_IsControlFlow (INS ins)

BOOL	LEVEL_CORE::INS_IsValidForIpointAfter (INS ins)

BOOL	LEVEL_CORE::INS_IsValidForIpointTakenBranch (INS ins)

BOOL	LEVEL_CORE::INS_IsProcedureCall (INS ins)

BOOL	LEVEL_CORE::INS_IsRet (INS ins)

BOOL	LEVEL_CORE::INS_IsSysret (INS ins)

BOOL	LEVEL_CORE::INS_IsPrefetch (INS ins)

BOOL	LEVEL_CORE::INS_IsAtomicUpdate (const INS ins)

PIN_DEPRECATED_API BOOL	LEVEL_CORE::INS_IsIndirectBranchOrCall (INS ins)

BOOL	LEVEL_CORE::INS_IsIndirectControlFlow (INS ins)

BOOL	LEVEL_CORE::INS_HasExplicitMemoryReference (INS ins)

REG	LEVEL_CORE::INS_RegR (INS x, UINT32 k)

REG	LEVEL_CORE::INS_RegW (INS x, UINT32 k)

OPCODE	LEVEL_CORE::INS_Opcode (INS ins)

std::string	LEVEL_CORE::CATEGORY_StringShort (UINT32 num)

std::string	LEVEL_CORE::EXTENSION_StringShort (UINT32 num)

UINT32	LEVEL_CORE::INS_MaxNumRRegs (INS x)

UINT32	LEVEL_CORE::INS_MaxNumWRegs (INS x)

BOOL	LEVEL_CORE::INS_RegRContain (const INS ins, const REG reg)

BOOL	LEVEL_CORE::INS_RegWContain (const INS ins, const REG reg)

BOOL	LEVEL_CORE::INS_IsStackRead (const INS ins)

BOOL	LEVEL_CORE::INS_IsStackWrite (const INS ins)

BOOL	LEVEL_CORE::INS_IsIpRelRead (const INS ins)

BOOL	LEVEL_CORE::INS_IsIpRelWrite (const INS ins)

BOOL	LEVEL_CORE::INS_IsPredicated (INS ins)

BOOL	LEVEL_CORE::INS_IsOriginal (INS ins)

std::string	LEVEL_CORE::INS_Disassemble (INS ins)

xed_decoded_inst_t *	LEVEL_CORE::INS_XedDec (INS ins)

REG	LEVEL_CORE::INS_XedExactMapToPinReg (xed_reg_enum_t xed_reg)

PIN_DEPRECATED_API REG	LEVEL_CORE::INS_XedExactMapToPinReg (unsigned int r)

xed_reg_enum_t	LEVEL_CORE::INS_XedExactMapFromPinReg (REG pin_reg)

UINT32	LEVEL_CORE::INS_MemoryOperandCount (INS ins)

UINT32	LEVEL_CORE::INS_MemoryOperandElementCount (INS ins, UINT32 memoryOp)

BOOL	LEVEL_CORE::INS_OperandIsAddressGenerator (INS ins, UINT32 n)

BOOL	LEVEL_CORE::INS_MemoryOperandIsRead (INS ins, UINT32 memopIdx)

BOOL	LEVEL_CORE::INS_MemoryOperandIsWritten (INS ins, UINT32 memopIdx)

BOOL	LEVEL_CORE::INS_IsSyscall (INS ins)

SYSCALL_STANDARD	LEVEL_CORE::INS_SyscallStd (INS ins)

RTN	LEVEL_PINCLIENT::INS_Rtn (INS x)

INS	LEVEL_PINCLIENT::INS_Next (INS x)

INS	LEVEL_PINCLIENT::INS_Prev (INS x)

INS	LEVEL_PINCLIENT::INS_Invalid ()

BOOL	LEVEL_PINCLIENT::INS_Valid (INS x)

ADDRINT	LEVEL_PINCLIENT::INS_Address (INS ins)

USIZE	LEVEL_PINCLIENT::INS_Size (INS ins)

PIN_DEPRECATED_API ADDRINT	LEVEL_PINCLIENT::INS_DirectBranchOrCallTargetAddress (INS ins)

ADDRINT	LEVEL_PINCLIENT::INS_DirectControlFlowTargetAddress (INS ins)

ADDRINT	LEVEL_PINCLIENT::INS_NextAddress (INS ins)

Variables
const UINT32	LEVEL_CORE::VSYSCALL_NR = 0xABCDDCBA

Detailed Description

Use these functions to examine an instruction. They work for all instruction sets.

Availability:: Mode: JIT & Probe
O/S: Linux & Windows
CPU: All

Enumeration Type Documentation

◆ MEMORY_TYPE

enum LEVEL_CORE::MEMORY_TYPE

Memory type of argument

◆ SYSCALL_STANDARD

enum LEVEL_CORE::SYSCALL_STANDARD

Calling standard of the system call instruction.

Enumerator
SYSCALL_STANDARD_INVALID	Invalid value; the instruction is not a system call.
SYSCALL_STANDARD_IA32_LINUX	Linux system call on IA-32 architecture.
SYSCALL_STANDARD_IA32_LINUX_SYSENTER	Linux system call via 'sysenter' on IA-32 architecture.
SYSCALL_STANDARD_IA32E_LINUX	Linux system call on Intel(R) 64 architecture.
SYSCALL_STANDARD_IA32E_LINUX_VSYSCALL	Linux virtual system call on Intel(R) 64 architecture.
SYSCALL_STANDARD_IA32_MAC	macOS* system call in IA-32 architecture
SYSCALL_STANDARD_IA32E_MAC	macOS* system call in Intel(R) 64 architecture
SYSCALL_STANDARD_IA32_WINDOWS_FAST	"Fast" (SYSENTER) Windows system call in IA-32 architecture
SYSCALL_STANDARD_IA32E_WINDOWS_FAST	"Fast" (SYSCALL) Windows system call in Intel(R) 64 architecture
SYSCALL_STANDARD_IA32_WINDOWS_ALT	Alternative (INT2E) Windows system call in IA-32 architecture.
SYSCALL_STANDARD_WOW64	System call in WOW64 (32 bit process in 64-bit Windows)
SYSCALL_STANDARD_WINDOWS_INT	Software interruption (INT n) in Windows.

Function Documentation

◆ CATEGORY_StringShort()

std::string LEVEL_CORE::CATEGORY_StringShort ( UINT32 num )

Returns: String form of category

◆ EXTENSION_StringShort()

std::string LEVEL_CORE::EXTENSION_StringShort ( UINT32 num )

Returns: String form of ISA extension

◆ INS_Address()

ADDRINT LEVEL_PINCLIENT::INS_Address ( INS ins )

Returns: Address of instruction

Availability:: Mode: JIT & Probe
O/S: Linux, Windows & macOS*
CPU: All

◆ INS_Category()

INT32 LEVEL_CORE::INS_Category ( const INS ins )

The category of an instruction is a higher level semantic description of an instruction than its opcode (INS_Opcode). So, for instance, you can test for a conditional branch by using INS_Category(ins) == XED_CATEGORY_COND_BR, whereas using INS_Opcode(ins) would require that you enumerate all twenty conditional branch opcodes.

The full mapping of opcodes to categories can be found in the idata.txt file in the Intel(R) X86 Encoder Decoder distribution (which is distributed as part of the Pin kit). The category enumeration can be found in the file "xed-category-enum.h".

A category can be converted into a string by using CATEGORY_StringShort.

Returns: Instruction category

◆ INS_DirectBranchOrCallTargetAddress()

PIN_DEPRECATED_API ADDRINT LEVEL_PINCLIENT::INS_DirectBranchOrCallTargetAddress ( INS ins )

Returns: For direct branches or calls, the target address

Note: DEPRECATED: see INS_DirectControlFlowTargetAddress() instead.

◆ INS_DirectControlFlowTargetAddress()

ADDRINT LEVEL_PINCLIENT::INS_DirectControlFlowTargetAddress ( INS ins )

Returns: the target address for direct control-flow instructions. must verify that INS_IsDirectControlFlow() is true before using this function. Refer to INS_IsControlFlow() for more details on control-flow instructions.

◆ INS_Disassemble()

std::string LEVEL_CORE::INS_Disassemble ( INS ins )

Returns: std::string disassembly of instruction

◆ INS_Extension()

INT32 LEVEL_CORE::INS_Extension ( const INS ins )

Returns: Instruction extension, Use EXTENSION_StringShort to make it a string

◆ INS_GetPredicate()

PREDICATE LEVEL_CORE::INS_GetPredicate ( INS ins )

Returns: predicate for instruction (see PREDICATE)

CMOVcc and FMOVcc instructions are treated as predicated. Rep string ops are treated as predicated.

◆ INS_HasExplicitMemoryReference()

BOOL LEVEL_CORE::INS_HasExplicitMemoryReference ( INS ins )

Test if this instruction has an explict memory operand. We include the memory operand in lea.

Returns: TRUE if the instruction is has an explicit memory operand

◆ INS_HasFallThrough()

BOOL LEVEL_CORE::INS_HasFallThrough ( INS ins )

If INS_HasFallThrough(INS) is TRUE, then the instruction may execute the "natural" next instruction (i.e. the one which starts immediately after this one), if it is FALSE, then the instruction following the one tested will not (normally) be executed next. So HasFallThrough is TRUE for instructions which don't change the control flow (most instructions), or for conditional branches (which might change the control flow, but might not), and FALSE for unconditional branches and calls (where the next instruction to be executed is always explicitly specified).

Note that an unconditional branch or call to the next instruction still doesn't have a fall-through, since a fall through is the implicitly following instruction, and an unconditional branch never uses that.

Returns: true if the instruction type has a fallthrough path based on the opcode

Note: for system calls function returns false.

◆ INS_HasMemoryRead2()

BOOL LEVEL_CORE::INS_HasMemoryRead2 ( INS ins )

Returns: true if this instruction has 2 memory read operands

◆ INS_Invalid()

INS LEVEL_PINCLIENT::INS_Invalid ( )

Returns: Invalid instruction used in iterators INS_Prev and INS_Next

Availability:: Mode: JIT & Probe
O/S: Linux, Windows & macOS*
CPU: All

◆ INS_IsAtomicUpdate()

BOOL LEVEL_CORE::INS_IsAtomicUpdate ( const INS ins )

Returns: true if this instruction performs an atomic update of memory.

Note: An XCHG instruction accessing memory is atomic with or without a LOCK prefix.

◆ INS_IsBranch()

BOOL LEVEL_CORE::INS_IsBranch ( INS ins )

Returns: true if ins is a branch instruction. A branch can be conditional or unconditional.

Note: In some cases branch instructions are actually system calls. In case ins is in practice a system call, the function returns false. For example, JMP_FAR in Windows IA-32 can be a system call under certain conditions.

◆ INS_IsBranchOrCall()

PIN_DEPRECATED_API BOOL LEVEL_CORE::INS_IsBranchOrCall ( INS ins )

Returns: TRUE if ins is a Branch or Call instruction, includes both direct and indirect instruction types.

Note: DEPRECATED: Use INS_IsValidForIpointTakenBranch() instead to check if you can use IPOINT_TAKEN_BRANCH. Or use INS_IsControlFlow() to check if instruction is a control flow.

◆ INS_IsCall()

BOOL LEVEL_CORE::INS_IsCall ( INS ins )

Returns: true if ins is a Call instruction. Note: In case ins is in practice a system call, the function returns false.

◆ INS_IsControlFlow()

BOOL LEVEL_CORE::INS_IsControlFlow ( INS ins )

Returns: true if ins is a Control Flow instruction.

Note: In general, any Branch, Call or Ret is a control flow instruction. However, we exclude any instruction which in practice is a system call (e.g. FAR_JMP in Windows with IA32 is sometimes a syscall).
In addition, note that it returns true for Xbegin and Xend instructions. Use this function to verify that an instruction is valid for instrumentation with IARG_BRANCH_TARGET_ADDR.

◆ INS_IsDirectBranch()

BOOL LEVEL_CORE::INS_IsDirectBranch ( INS ins )

These are supposed to be near relative branches.

Returns: true if the target address is an offset from the instruction pointer or is an immediate.

◆ INS_IsDirectBranchOrCall()

PIN_DEPRECATED_API BOOL LEVEL_CORE::INS_IsDirectBranchOrCall ( INS ins )

These are supposed to be near relative branches.

Returns: true if the target address is an offset from the instruction pointer or is an immediate.

Note: DEPRECATED: see INS_IsDirectControlFlow() instead.

◆ INS_IsDirectCall()

BOOL LEVEL_CORE::INS_IsDirectCall ( INS ins )

These are supposed to be near relative branches.

Returns: true if the target address is an offset from the instruction pointer or is an immediate.

◆ INS_IsDirectControlFlow()

BOOL LEVEL_CORE::INS_IsDirectControlFlow ( INS ins )

Returns: TRUE if ins is a control-flow instruction, and its target address is an offset from the instruction pointer or is an immediate.

◆ INS_IsIndirectBranchOrCall()

PIN_DEPRECATED_API BOOL LEVEL_CORE::INS_IsIndirectBranchOrCall ( INS ins )

Returns: true if the branch target comes from a register or memory. result is valid only if INS_IsControlFlow() is true.

Note: DEPRECATED: see INS_IsIndirectControlFlow() instead.

◆ INS_IsIndirectControlFlow()

BOOL LEVEL_CORE::INS_IsIndirectControlFlow ( INS ins )

Returns: true if ins is a control-flow instruction, and its target address is provided through memory or through a register.

◆ INS_IsIpRelRead()

BOOL LEVEL_CORE::INS_IsIpRelRead ( const INS ins )

Is an IP-relative read

◆ INS_IsIpRelWrite()

BOOL LEVEL_CORE::INS_IsIpRelWrite ( const INS ins )

Is an IP-relative write

◆ INS_IsLea()

BOOL LEVEL_CORE::INS_IsLea ( INS ins )

Returns: TRUE if the instruction is Lea.

◆ INS_IsMemoryRead()

BOOL LEVEL_CORE::INS_IsMemoryRead ( INS ins )

Returns: true if this instruction reads memory

Note: Segment prefix operands (i.e. gs:0x14 ) are memory operands.

◆ INS_IsMemoryWrite()

BOOL LEVEL_CORE::INS_IsMemoryWrite ( INS ins )

Returns: true if this instruction writes memory

Note: Segment prefix operands (i.e. gs:0x14 ) are memory operands.

◆ INS_IsNop()

BOOL LEVEL_CORE::INS_IsNop ( INS ins )

Returns: TRUE if the instruction is a nop.

◆ INS_IsOriginal()

BOOL LEVEL_CORE::INS_IsOriginal ( INS ins )

Returns: true if this is an original instruction

◆ INS_IsPredicated()

BOOL LEVEL_CORE::INS_IsPredicated ( INS ins )

We treat these instructions as predicated conditional move (CMOVcc) floating conditional move (FCMOVcc) rep string ops (since they don't execute if GCX==0)

◆ INS_IsPrefetch()

BOOL LEVEL_CORE::INS_IsPrefetch ( INS ins )

Returns: true if this instruction is a prefetch

◆ INS_IsProcedureCall()

BOOL LEVEL_CORE::INS_IsProcedureCall ( INS ins )

Returns: true if ins is a procedure call. This filters out call instructions that are (ab)used for other purposes

◆ INS_IsRet()

BOOL LEVEL_CORE::INS_IsRet ( INS ins )

Returns true if the given ins is a ret instruction.

Note: This function will return true for iret instructions as well.; See also INS_IsIRet.

Returns: true if the instruction is ret or iret.

◆ INS_IsStackRead()

BOOL LEVEL_CORE::INS_IsStackRead ( const INS ins )

Access to the stack simply means that the instruction accesses memory relative to the stack pointer (ESP or RSP), or the frame pointer (EBP or RBP). In code compiled without a frame pointer (where EBP/RBP is used as a general register), this may give a misleading result.

Returns: TRUE if ins is a read from the stack

◆ INS_IsStackWrite()

BOOL LEVEL_CORE::INS_IsStackWrite ( const INS ins )

Detection of stack accesses is done in the same way as for INS_IsStackRead, so the same caveats apply here too.

Returns: TRUE if ins is a write to the stack

◆ INS_IsSyscall()

BOOL LEVEL_CORE::INS_IsSyscall ( INS ins )

Returns: true if the instruction is a system call

◆ INS_IsSysret()

BOOL LEVEL_CORE::INS_IsSysret ( INS ins )

Returns: true if ins is a System Return instruction

◆ INS_IsValidForIpointAfter()

BOOL LEVEL_CORE::INS_IsValidForIpointAfter ( INS ins )

Returns: TRUE if ins can be instrumented at location IPOINT_AFTER.

◆ INS_IsValidForIpointTakenBranch()

BOOL LEVEL_CORE::INS_IsValidForIpointTakenBranch ( INS ins )

Returns: TRUE if ins can be instrumented at location IPOINT_TAKEN_BRANCH.

◆ INS_MaxNumRRegs()

UINT32 LEVEL_CORE::INS_MaxNumRRegs ( INS x )

Returns: Maximum number of read operands

◆ INS_MaxNumWRegs()

UINT32 LEVEL_CORE::INS_MaxNumWRegs ( INS x )

Returns: Maximum number of write operands

◆ INS_MemoryOperandCount()

UINT32 LEVEL_CORE::INS_MemoryOperandCount ( INS ins )

Returns: the number of memory operands. Please note INS_MemoryOperandElementCount for reading the number of elements per memory operand.

Note: Segment prefix operands (i.e. gs:0x14 ) are memory operands.

◆ INS_MemoryOperandElementCount()

UINT32 LEVEL_CORE::INS_MemoryOperandElementCount	(	INS	ins,
		UINT32	memoryOp
	)

Returns: the number of elements in the requested memory operand. For instructions where the memory operands has not elemenets, returns 1.

◆ INS_MemoryOperandElementSize()

USIZE LEVEL_CORE::INS_MemoryOperandElementSize	(	INS	ins,
		UINT32	memoryOp
	)

Parameters

[in]	ins	the instruction.
[in]	memoryOp	the memory operand index whose element size is required.

Returns: the size of the requested memory operand element in bytes. For scalar instructions, this function will return the same as INS_MemoryOperandSize. For vector instructions, this function will return the size of a single element.

◆ INS_MemoryOperandIsRead()

BOOL LEVEL_CORE::INS_MemoryOperandIsRead	(	INS	ins,
		UINT32	memopIdx
	)

Returns: TRUE if memory operand memopIdx is read

◆ INS_MemoryOperandIsWritten()

BOOL LEVEL_CORE::INS_MemoryOperandIsWritten	(	INS	ins,
		UINT32	memopIdx
	)

Returns: TRUE if memory operand memopIdx is written

◆ INS_MemoryOperandSize()

USIZE LEVEL_CORE::INS_MemoryOperandSize	(	INS	ins,
		UINT32	memoryOp
	)

Parameters

[in]	ins	the instruction.
[in]	memoryOp	the memory operand index whose size is required.

Returns: the size of the requested memory operand in bytes (for REPped instructions this is the size accessed in each iteration of the implicit loop). The operand of instructions with scattered memory access (like vscatter/vgather) does not have a size, and this function should not be called for these functions. Use INS_HasScatteredMemoryAccess before calling this function.

◆ INS_MemoryReadSize()

PIN_DEPRECATED_API USIZE LEVEL_CORE::INS_MemoryReadSize ( INS ins )

Returns: the size of the memory read in bytes (for REP prefixed instructions this is the size of the operand read on each iteration of the REP, so 1,2,4 or 8).

Note: DEPRECATED: see INS_MemoryOperandSize() instead.

◆ INS_MemoryWriteSize()

PIN_DEPRECATED_API USIZE LEVEL_CORE::INS_MemoryWriteSize ( INS ins )

Returns: the size of the memory write in bytes (for REP prefixed instructions this is the size of the operand written on each iteration of the REP, so 1,2,4 or 8).

Note: DEPRECATED: see INS_MemoryOperandSize() instead.

◆ INS_Mnemonic()

std::string LEVEL_CORE::INS_Mnemonic ( INS ins )

Only use this function if you really want a printable version of the instruction's opcode.

If you are trying to test what the opcode of an instruction is, use INS_Opcode and compare it with one of the XED_ICLASS values, or use one of the INS_Is... calls such as INS_IsMov, rather than using this function and comparing a string. Generating and comparing strings is much slower than comparing small integer values!

Returns: String form of mnemonic

◆ INS_Next()

INS LEVEL_PINCLIENT::INS_Next ( INS x )

Returns: Instruction that follows x, or INS_Invalid() if x is the last in the rtn or trace

Availability:: Mode: JIT & Probe
O/S: Linux, Windows & macOS*
CPU: All

◆ INS_NextAddress()

ADDRINT LEVEL_PINCLIENT::INS_NextAddress ( INS ins )

Get the address of the next instruction.

Returns: Address of instruction that follows this one

◆ INS_Opcode()

OPCODE LEVEL_CORE::INS_Opcode ( INS ins )

On ia-32 and Intel64 the opcodes are constants of the form XED_ICLASS_name. The full list of valid opcodes can be found in the idata.txt file in the Intel(R) X86 Encoder Decoder distribution (which is distributed as part of the Pin kit), and the enum definitions are in the file "xed-iclass-enum.h".

Use INS_Mnemonic if you want a string.

Returns: Opcode of instruction

◆ INS_OperandIsAddressGenerator()

BOOL LEVEL_CORE::INS_OperandIsAddressGenerator	(	INS	ins,
		UINT32	n
	)

Returns: true if this operand generates an address, but the address does not access memory (e.g. load effective address instruction)

◆ INS_Prev()

INS LEVEL_PINCLIENT::INS_Prev ( INS x )

Returns: Instruction that precedes x, or INS_Invalid() if x is the first in the rtn or trace

Availability:: Mode: JIT & Probe
O/S: Linux, Windows & macOS*
CPU: All

◆ INS_RegR()

REG LEVEL_CORE::INS_RegR	(	INS	x,
		UINT32	k
	)

Returns: kth read register of instruction x, including implicit reads (e.g. stack pointer is read by push on IA-32 architectures)

◆ INS_RegRContain()

BOOL LEVEL_CORE::INS_RegRContain	(	const INS	ins,
		const REG	reg
	)

Returns: true if ins uses reg as a read operand

◆ INS_RegW()

REG LEVEL_CORE::INS_RegW	(	INS	x,
		UINT32	k
	)

Returns: kth write register of instruction x, including implicit writes (e.g. stack pointer is written by push on IA-32 architectures)

◆ INS_RegWContain()

BOOL LEVEL_CORE::INS_RegWContain	(	const INS	ins,
		const REG	reg
	)

Returns: true if ins uses reg as a write operand

◆ INS_Rtn()

RTN LEVEL_PINCLIENT::INS_Rtn ( INS x )

Returns: Routine that contains this instruction

Availability:: Mode: JIT & Probe
O/S: Linux, Windows & macOS*
CPU: All

◆ INS_Size()

USIZE LEVEL_PINCLIENT::INS_Size ( INS ins )

Returns: Size of instruction in bytes

◆ INS_Stutters()

BOOL LEVEL_CORE::INS_Stutters ( INS ins )

Returns: true if ins "stutters", so re-executes even though it is not a branch or call. REP prefixed string ops do this.

◆ INS_SyscallStd()

SYSCALL_STANDARD LEVEL_CORE::INS_SyscallStd ( INS ins )

Check to see if the given instruction is a system call and return corresponding calling standard.

Returns: calling standard of the system call instruction or SYSCALL_STANDARD_INVALID if the instruction is not a system call.

◆ INS_Valid()

BOOL LEVEL_PINCLIENT::INS_Valid ( INS x )

Returns: Invalid instruction used in iterators INS_Prev and INS_Next

Availability:: Mode: JIT & Probe
O/S: Linux, Windows & macOS*
CPU: All

◆ INS_XedDec()

xed_decoded_inst_t* LEVEL_CORE::INS_XedDec ( INS ins )

Returns: This provides the pointer to the decoded Intel(R) X86 Encoder Decoder instruction.

◆ INS_XedExactMapFromPinReg()

xed_reg_enum_t LEVEL_CORE::INS_XedExactMapFromPinReg ( REG pin_reg )

Convert Pin REG type (application register) to an Intel(R) X86 Encoder Decoder xed_reg_enum_t register.

Returns: xed reg mapping to pin reg. if no map returns XED_REG_INVALID

◆ INS_XedExactMapToPinReg() [1/2]

PIN_DEPRECATED_API REG LEVEL_CORE::INS_XedExactMapToPinReg ( unsigned int r )

Convert a Intel(R) X86 Encoder Decoder xed_reg_enum_t register to a Pin REG type.

Returns: a valid pin register, but never an invalid one. Asserts if there is no exact map.

Note: DEPRECATED: Use INS_XedExactMapToPinReg(xed_reg_enum_t xed_reg) instead

◆ INS_XedExactMapToPinReg() [2/2]

REG LEVEL_CORE::INS_XedExactMapToPinReg ( xed_reg_enum_t xed_reg )

Convert a Intel(R) X86 Encoder Decoder xed_reg_enum_t register to a Pin REG type.

Returns: a valid pin register, but never an invalid one. Asserts if there is no exact map.

◆ OPCODE_StringShort()

std::string LEVEL_CORE::OPCODE_StringShort ( UINT32 opcode )

Returns: String with the opcode of the instruction

Variable Documentation

◆ VSYSCALL_NR

const UINT32 LEVEL_CORE::VSYSCALL_NR = 0xABCDDCBA

system call number for function called from vsyscall

Typedefs

Enumerations

Functions

Variables

Detailed Description

Enumeration Type Documentation

◆ MEMORY_TYPE

◆ SYSCALL_STANDARD

Function Documentation

◆ CATEGORY_StringShort()

◆ EXTENSION_StringShort()

◆ INS_Address()

◆ INS_Category()

◆ INS_DirectBranchOrCallTargetAddress()

◆ INS_DirectControlFlowTargetAddress()

◆ INS_Disassemble()

◆ INS_Extension()

◆ INS_GetPredicate()

◆ INS_HasExplicitMemoryReference()

◆ INS_HasFallThrough()

◆ INS_HasMemoryRead2()

◆ INS_Invalid()

◆ INS_IsAtomicUpdate()

◆ INS_IsBranch()

◆ INS_IsBranchOrCall()

◆ INS_IsCall()

◆ INS_IsControlFlow()

◆ INS_IsDirectBranch()

◆ INS_IsDirectBranchOrCall()

◆ INS_IsDirectCall()

◆ INS_IsDirectControlFlow()

◆ INS_IsIndirectBranchOrCall()

◆ INS_IsIndirectControlFlow()

◆ INS_IsIpRelRead()

◆ INS_IsIpRelWrite()

◆ INS_IsLea()

◆ INS_IsMemoryRead()

◆ INS_IsMemoryWrite()

◆ INS_IsNop()

◆ INS_IsOriginal()

◆ INS_IsPredicated()

◆ INS_IsPrefetch()

◆ INS_IsProcedureCall()

◆ INS_IsRet()

◆ INS_IsStackRead()

◆ INS_IsStackWrite()

◆ INS_IsSyscall()

◆ INS_IsSysret()

◆ INS_IsValidForIpointAfter()

◆ INS_IsValidForIpointTakenBranch()

◆ INS_MaxNumRRegs()

◆ INS_MaxNumWRegs()

◆ INS_MemoryOperandCount()

◆ INS_MemoryOperandElementCount()

◆ INS_MemoryOperandElementSize()

◆ INS_MemoryOperandIsRead()

◆ INS_MemoryOperandIsWritten()

◆ INS_MemoryOperandSize()

◆ INS_MemoryReadSize()

◆ INS_MemoryWriteSize()

◆ INS_Mnemonic()

◆ INS_Next()

◆ INS_NextAddress()

◆ INS_Opcode()

◆ INS_OperandIsAddressGenerator()

◆ INS_Prev()

◆ INS_RegR()

◆ INS_RegRContain()

◆ INS_RegW()

◆ INS_RegWContain()

◆ INS_Rtn()

◆ INS_Size()

◆ INS_Stutters()

◆ INS_SyscallStd()

◆ INS_Valid()

◆ INS_XedDec()

◆ INS_XedExactMapFromPinReg()

◆ INS_XedExactMapToPinReg() [1/2]

◆ INS_XedExactMapToPinReg() [2/2]

◆ OPCODE_StringShort()