-- Hoogle documentation, generated by Haddock
-- See Hoogle, http://www.haskell.org/hoogle/
-- | Disassembler for X86 & AMD64 machine code
--
-- Disassembler for X86 & AMD64 machine code
@package disassembler
@version 0.1.0
-- | Disassembler for x86 machine code.
--
-- This is a disassembler for object code for the x86 architecture. It
-- provides functions for disassembling byte arrays, byte lists and
-- memory blocks containing raw binary code.
--
-- Features:
--
--
-- - Disassembles memory blocks, lists or arrays of bytes into lists of
-- instructions.
-- - Abstract instructions provide as much information as possible
-- about opcodes, addressing modes or operand sizes, allowing for
-- detailed output.
-- - Provides functions for displaying instructions in Intel or
-- AT&T style (like the GNU tools)
--
--
-- Differences to GNU tools, like gdb or objdump:
--
--
-- - Displacements are shown in decimal, with sign if negative.
--
--
-- Missing:
--
--
-- - LOCK and repeat prefixes are recognized, but not contained in the
-- opcodes of instructions.
-- - Support for 16-bit addressing modes. Could be added when
-- needed.
-- - Complete disassembly of all 64-bit instructions. I have tried to
-- disassemble them properly but have been limited to the information in
-- the docs, because I have no 64-bit machine to test on. This will
-- probably change when I get GNU as to produce 64-bit object files.
-- - Not all MMX and SSESSE2SSE3 instructions are decoded yet.
-- This is just a matter of missing time.
-- - segment override prefixes are decoded, but not appended to memory
-- references
--
--
-- On the implementation:
--
-- This disassembler uses the Parsec parser combinators, working on byte
-- lists. This proved to be very convenient, as the combinators keep
-- track of the current position, etc.
module Text.Disassembler.X86Disassembler
-- | All opcodes are represented by this enumeration type.
data Opcode
-- | All operands are in one of the following locations:
--
--
-- - Constants in the instruction stream
-- - Memory locations
-- - Registers
--
--
-- Memory locations are referred to by on of several addressing modes:
--
--
-- - Absolute (address in instruction stream)
-- - Register-indirect (address in register)
-- - Register-indirect with displacement
-- - Base-Index with scale
-- - Base-Index with scale and displacement
--
--
-- Displacements can be encoded as 8 or 32-bit immediates in the
-- instruction stream, but are encoded as Int in instructions for
-- simplicity.
data Operand
-- | Immediate value
OpImm :: Word32 -> Operand
-- | Absolute address
OpAddr :: Word32 -> InstrOperandSize -> Operand
-- | Register
OpReg :: String -> Int -> Operand
-- | Floating-point register
OpFPReg :: Int -> Operand
-- | Register-indirect
OpInd :: String -> InstrOperandSize -> Operand
-- | Register-indirect with displacement
OpIndDisp :: String -> Int -> InstrOperandSize -> Operand
-- | Base plus scaled index
OpBaseIndex :: String -> String -> Int -> InstrOperandSize -> Operand
-- | Scaled index with displacement
OpIndexDisp :: String -> Int -> Int -> InstrOperandSize -> Operand
-- | Base plus scaled index with displacement
OpBaseIndexDisp :: String -> String -> Int -> Int -> InstrOperandSize -> Operand
-- | Some opcodes can operate on data of several widths. This information
-- is encoded in instructions using the following enumeration type..
data InstrOperandSize
-- | No operand size specified
OPNONE :: InstrOperandSize
-- | 8-bit integer operand
OP8 :: InstrOperandSize
-- | 16-bit integer operand
OP16 :: InstrOperandSize
-- | 32-bit integer operand
OP32 :: InstrOperandSize
-- | 64-bit integer operand
OP64 :: InstrOperandSize
-- | 128-bit integer operand
OP128 :: InstrOperandSize
-- | 32-bit floating point operand
OPF32 :: InstrOperandSize
-- | 64-bit floating point operand
OPF64 :: InstrOperandSize
-- | 80-bit floating point operand
OPF80 :: InstrOperandSize
-- | The disassembly routines return lists of the following datatype. It
-- encodes both invalid byte sequences (with a useful error message, if
-- possible), or a valid instruction. Both variants contain the list of
-- opcode bytes from which the instruction was decoded and the address of
-- the instruction.
data Instruction
-- | Invalid instruction
BadInstruction :: Word8 -> String -> Int -> [Word8] -> Instruction
-- | Pseudo instruction, e.g. label
PseudoInstruction :: Int -> String -> Instruction
-- | Valid instruction
Instruction :: Opcode -> InstrOperandSize -> [Operand] -> Int -> [Word8] -> Instruction
-- | Opcode of the instruction
opcode :: Instruction -> Opcode
-- | Operand size, if any
opsize :: Instruction -> InstrOperandSize
-- | Instruction operands
operands :: Instruction -> [Operand]
-- | Start address of instruction
address :: Instruction -> Int
-- | Instruction bytes
bytes :: Instruction -> [Word8]
-- | Instructions can be displayed either in Intel or AT&T style (like
-- in GNU tools).
--
-- Intel style:
--
--
-- - Destination operand comes first, source second.
-- - No register or immediate prefixes.
-- - Memory operands are annotated with operand size.
-- - Hexadecimal numbers are suffixed with H and prefixed with
-- 0 if necessary.
--
--
-- AT&T style:
--
--
-- - Source operand comes first, destination second.
-- - Register names are prefixes with %.
-- - Immediates are prefixed with $.
-- - Hexadecimal numbers are prefixes with 0x
-- - Opcodes are suffixed with operand size, when ambiguous
-- otherwise.
--
data ShowStyle
-- | Show in Intel style
IntelStyle :: ShowStyle
-- | Show in AT&T style
AttStyle :: ShowStyle
data Config
Config :: OperandSize -> OperandSize -> OperandSize -> Bool -> Word32 -> Config
confDefaultBitMode :: Config -> OperandSize
confOperandBitMode :: Config -> OperandSize
confAddressBitMode :: Config -> OperandSize
confIn64BitMode :: Config -> Bool
confStartAddr :: Config -> Word32
-- | Disassemble a block of memory. Starting at the location pointed to by
-- the given pointer, the given number of bytes are disassembled.
disassembleBlock :: Ptr Word8 -> Int -> IO (Either ParseError [Instruction])
-- | Disassemble the contents of the given list.
disassembleList :: Monad m => [Word8] -> m (Either ParseError [Instruction])
-- | Disassemble the contents of the given array.
disassembleArray :: (Monad m, IArray a Word8, Ix i) => a i Word8 -> m (Either ParseError [Instruction])
disassembleFile :: FilePath -> IO (Either ParseError [Instruction])
disassembleBlockWithConfig :: Config -> Ptr Word8 -> Int -> IO (Either ParseError [Instruction])
disassembleListWithConfig :: Monad m => Config -> [Word8] -> m (Either ParseError [Instruction])
disassembleArrayWithConfig :: (Monad m, IArray a Word8, Ix i) => Config -> a i Word8 -> m (Either ParseError [Instruction])
disassembleFileWithConfig :: Config -> FilePath -> IO (Either ParseError [Instruction])
-- | Show an instruction in Intel style.
showIntel :: Instruction -> [Char]
-- | Show an instruction in AT&T style.
showAtt :: Instruction -> [Char]
defaultConfig :: Config
instance Eq Instruction
instance Show InstrOperandSize
instance Eq InstrOperandSize
instance Eq Operand
instance Show Opcode
instance Eq Opcode
instance Show Instruction