Documentation
¶
Index ¶
- type DecodeMetadata
- type DecodeOptions
- type ELFDisassembler
- type EffectiveAddress
- type EffectiveAddressKind
- type ImmediateValue
- type IndexRegister
- type Instruction
- func Decode(data []byte, address uint32) (*Instruction, error)
- func DecodeFunc(read ReadFunc, address uint32) (*Instruction, error)
- func DecodeFuncWithOptions(read ReadFunc, address uint32, opts DecodeOptions) (*Instruction, error)
- func DecodeReaderAt(reader io.ReaderAt, address uint32) (*Instruction, error)
- func DecodeReaderAtWithOptions(reader io.ReaderAt, address uint32, opts DecodeOptions) (*Instruction, error)
- func DecodeWithOptions(data []byte, address uint32, opts DecodeOptions) (*Instruction, error)
- func DisassembleRange(data []byte, startAddress uint32) ([]Instruction, error)
- func DisassembleRangeWithOptions(data []byte, startAddress uint32, opts DecodeOptions) ([]Instruction, error)
- type Operand
- type OperandKind
- type PartialDecodeError
- type ReadFunc
- type Register
- type RegisterKind
- type SectionInfo
- type SymbolizeFunc
- type Symbolizer
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type DecodeMetadata ¶ added in v1.0.1
type DecodeOptions ¶ added in v1.0.1
type DecodeOptions struct {
Symbolizer Symbolizer
}
type ELFDisassembler ¶
type ELFDisassembler struct {
// contains filtered or unexported fields
}
ELFDisassembler holds an ELF file and provides disassembly functions
func OpenELF ¶
func OpenELF(filePath string) (*ELFDisassembler, error)
OpenELF opens an ELF file and returns an ELFDisassembler
func (*ELFDisassembler) Close ¶
func (ed *ELFDisassembler) Close() error
Close closes the underlying ELF file
func (*ELFDisassembler) DisassembleAllExecutableSections ¶
func (ed *ELFDisassembler) DisassembleAllExecutableSections() (map[string][]Instruction, error)
DisassembleAllExecutableSections disassembles all executable sections (SHF_EXECINSTR flag) Returns a map of section name → instructions
func (*ELFDisassembler) DisassembleSection ¶
func (ed *ELFDisassembler) DisassembleSection(sectionName string) ([]Instruction, error)
DisassembleSection disassembles a named ELF section by name (e.g., ".text") Returns instructions with addresses from the section's VA (virtual address)
func (*ELFDisassembler) ListSections ¶
func (ed *ELFDisassembler) ListSections() []SectionInfo
ListSections returns information about all loadable sections in the ELF file.
type EffectiveAddress ¶ added in v1.0.1
type EffectiveAddress struct {
Kind EffectiveAddressKind
Mode uint8
Register uint8
Base *Register
Displacement *int32
AbsoluteAddress *uint32
ResolvedAddress *uint32
Immediate *ImmediateValue
Index *IndexRegister
}
type EffectiveAddressKind ¶ added in v1.0.1
type EffectiveAddressKind string
const ( EAKindDataRegisterDirect EffectiveAddressKind = "data_register_direct" EAKindAddressRegisterDirect EffectiveAddressKind = "address_register_direct" EAKindAddressIndirect EffectiveAddressKind = "address_indirect" EAKindPostIncrement EffectiveAddressKind = "post_increment" EAKindPreDecrement EffectiveAddressKind = "pre_decrement" EAKindDisplacement EffectiveAddressKind = "displacement" EAKindIndex EffectiveAddressKind = "index" EAKindAbsoluteShort EffectiveAddressKind = "absolute_short" EAKindAbsoluteLong EffectiveAddressKind = "absolute_long" EAKindPCDisplacement EffectiveAddressKind = "pc_displacement" EAKindPCIndex EffectiveAddressKind = "pc_index" EAKindImmediate EffectiveAddressKind = "immediate" )
type ImmediateValue ¶ added in v1.0.1
type IndexRegister ¶ added in v1.0.1
type Instruction ¶
type Instruction struct {
Address uint32
Opcode uint16
Mnemonic string
Operands string
Size uint32 // Größe der Instruktion in Bytes (2, 4, 6, etc.)
Bytes []byte // Die Rohdaten der Instruktion
ExtensionWords []uint16
Metadata DecodeMetadata
}
Instruction repräsentiert eine einzelne assemblierte Instruktion.
func Decode ¶
func Decode(data []byte, address uint32) (*Instruction, error)
Decode liest eine einzelne Instruktion an der gegebenen Adresse aus dem Byte-Slice.
func DecodeFunc ¶ added in v1.0.1
func DecodeFunc(read ReadFunc, address uint32) (*Instruction, error)
func DecodeFuncWithOptions ¶ added in v1.0.1
func DecodeFuncWithOptions(read ReadFunc, address uint32, opts DecodeOptions) (*Instruction, error)
func DecodeReaderAt ¶ added in v1.0.1
func DecodeReaderAt(reader io.ReaderAt, address uint32) (*Instruction, error)
func DecodeReaderAtWithOptions ¶ added in v1.0.1
func DecodeReaderAtWithOptions(reader io.ReaderAt, address uint32, opts DecodeOptions) (*Instruction, error)
func DecodeWithOptions ¶ added in v1.0.1
func DecodeWithOptions(data []byte, address uint32, opts DecodeOptions) (*Instruction, error)
func DisassembleRange ¶
func DisassembleRange(data []byte, startAddress uint32) ([]Instruction, error)
DisassembleRange disassembliert einen Speicherbereich sequenziell.
func DisassembleRangeWithOptions ¶ added in v1.0.1
func DisassembleRangeWithOptions(data []byte, startAddress uint32, opts DecodeOptions) ([]Instruction, error)
func (Instruction) Assembly ¶
func (i Instruction) Assembly() string
Assembly liefert den reinen Assembler-Code (Mnemonic + Operanden).
func (Instruction) String ¶
func (i Instruction) String() string
String liefert eine lesbare Repräsentation der Instruktion (z.B. für CLI-Output).
type Operand ¶ added in v1.0.1
type Operand struct {
Text string
Kind OperandKind
Register *Register
Immediate *ImmediateValue
EffectiveAddress *EffectiveAddress
RegisterList []string
BranchTarget *uint32
}
type OperandKind ¶ added in v1.0.1
type OperandKind string
const ( OperandKindRegister OperandKind = "register" OperandKindImmediate OperandKind = "immediate" OperandKindEffectiveAddr OperandKind = "effective_address" OperandKindRegisterList OperandKind = "register_list" OperandKindBranchTarget OperandKind = "branch_target" )
type PartialDecodeError ¶ added in v1.0.1
func (*PartialDecodeError) Error ¶ added in v1.0.1
func (e *PartialDecodeError) Error() string
type Register ¶ added in v1.0.1
type Register struct {
Kind RegisterKind
Number uint8
}
type RegisterKind ¶ added in v1.0.1
type RegisterKind string
const ( RegisterKindData RegisterKind = "data" RegisterKindAddress RegisterKind = "address" RegisterKindPC RegisterKind = "pc" )
type SectionInfo ¶
type SectionInfo struct {
Name string // Section name (e.g., ".text")
Addr uint64 // Virtual address
Offset uint64 // File offset
Size uint64 // Size in bytes
Flags uint32 // Raw section flags
IsExec bool // True if executable (SHF_EXECINSTR)
}
SectionInfo describes a section in an ELF file