ptrlib.cpu.intel.disassembler

This package provides disassemblers for Intel architecture.

Classes

IntelDisassembly

A single Intel instruction.

Functions

disassemble_capstone(→ list[IntelDisassembly])	Disassemble with capstone engine.
disassemble_objdump(→ list[IntelDisassembly])	Disassemble with objdump.

Module Contents

class ptrlib.cpu.intel.disassembler.IntelDisassembly

Bases: NamedTuple

A single Intel instruction.

This is a typing.NamedTuple with the following fields:

• address (int)

• bytes (bytes)

• prefix (list[str])

• mnemonic (str)

• operands (list[str])

address: int

bytes: IntelDisassembly.bytes

prefix: list[str]

mnemonic: str

operands: list[str]

ptrlib.cpu.intel.disassembler.disassemble_capstone(bytecode: bytes, address: int = 0, bits: ptrlib.types.PtrlibBitsT = 64, syntax: ptrlib.types.PtrlibAssemblySyntaxT = 'intel') → list[IntelDisassembly]

Disassemble with capstone engine.

Parameters:

• bytecode (bytes) – The machine code.

• address (int) – The address of the first instruction. Default to 0.

• bits (int) – The bits (16, 32, or 64) for the assembly. Default to 64.

• syntax (str, optional) – ‘intel’ for Intel syntax, or ‘att’ for AT&T syntax.

Returns:

A list of IntelDisassembly objects.

Return type:

list

ptrlib.cpu.intel.disassembler.disassemble_objdump(bytecode: bytes, address: int = 0, bits: ptrlib.types.PtrlibBitsT = 64, syntax: ptrlib.types.PtrlibAssemblySyntaxT = 'intel') → list[IntelDisassembly]

Disassemble with objdump.

Parameters:

• bytecode (bytes) – The machine code.

• address (int) – The address of the first instruction. Default to 0.

• bits (int) – The bits (16, 32, or 64) for the assembly. Default to 64.

• syntax (str, optional) – ‘intel’ for Intel syntax, or ‘att’ for AT&T syntax.

Returns:

A list of IntelDisassembly objects.

Return type:

list