Root > Reference > All Functions > DisasmInstruction

Function DisasmInstruction

 		Previous pageReturn to chapter overviewNext page   

Disassebles a single CPU instruction.

 

Unit

EDisAsm

 

Syntax

 

Code (Delphi)

function DisasmInstruction(

var Address: PAddress;

const AEncrypt: Boolean = False

): String;

 

Parameters

Address [in, out]

A pointer to CPU instruction. On input: a pointer to CPU instruction to disassemble. On output: a pointer to the next CPU instruction.

 

Return value

Textual representation of disassemled CPU instruction. This includes Address, RAW bytes, instruction itself and optional comments.

 

Remarks

Function disassembles a single CPU instruction, returns its textual representation and advances Address to the next instruction. The last can be used to walk through code while diassembling it.

 

Sample output:

 

Code

006989A2 E805C2F8FF CALL -$073DFB ; ($00624BB0) Unit1.TForm1.CheckVisible

 

• First part ("006989A2" in the above example) repeats Address and it's always 8 hex characters for 32-bit process and 16 hex characters for 64-bit process.
• Second part ("E805C2F8FF" in the above example) indicate RAW instruction bytes. Its size varies from 2 characters (1 byte) up to 30 characters (15 bytes) for x86-32 - depending on actual CPU instruction. These bytes includes any prefix, opcode, MOD/RM byte, SIB byte, displacement bytes, immediate value bytes.
• Third part ("CALL -$073DFB" in the above example) shows actual textual representation of disassembled instruction.
• Fourth part ("; ($00624BB0) Unit1.TForm1.CheckVisible" in the above example; optional) contains an optional comment for the instruction (such as call/jmp destination or string data dump).

 

Note

This hi-level function is a simple combination of low-level DecodeInstruction and InstructionToString. This function is used as base for DisasmFunction function.

 

See also



Send feedback... Build date: 2024-09-30
Last edited: 2024-09-30
PRIVACY STATEMENT
The documentation team uses the feedback submitted to improve the EurekaLog documentation. We do not use your e-mail address for any other purpose. We will remove your e-mail address from our system after the issue you are reporting has been resolved. While we are working to resolve this issue, we may send you an e-mail message to request more information about your feedback. After the issues have been addressed, we may send you an email message to let you know that your feedback has been addressed.

Permanent link to this article: https://www.eurekalog.com/help/eurekalog/topic_function_edisasm_disasminstruction.php