Skip to content

Structual changes to decouple operand-decoding #110

@flobernd

Description

@flobernd

Decouple operand-decoding from general instruction decoding to significantly decrease the size of ZydisDecodedInstruction which will improve usage of CPU cache in some situations.


  • Remove the ZydisDecodedOperand array from the ZydisDecodedInstruction struct
  • Provide a function that allows to decode count operands beginning from a given index. Additional flags like e.g. "include hidden operands" could be useful as well.
  • Implement a wrapper struct that contains the fixed size ZydisDecodedOperand array (like in the current ZydisDecodedInstruction) and a function to fill this struct (for convenience reasons)

Possible prototypes for the decoding functions could be:

ZydisStatus ZydisDecodeOperands(ZydisDecodedInstruction* instruction, ZydisDecodedOperand* operands, ZyanU8 count);

and

ZydisStatus ZydisDecodeOperandsEx(ZydisDecodedInstruction* instruction, ZydisDecodedOperand* operands, ZyanU8 count, ZyanU8 index, ZydisOperandDecodeFlags flags);

where ZydisOperandDecodeFlags might look like this:

#define ZYDIS_OPERAND_DECODE_FLAGS_VISIBLE 1 << 0
#define ZYDIS_OPERAND_DECODE_FLAGS_HIDDEN  1 << 1
#define ZYDIS_OPERAND_DECODE_FLAGS_ALL     = ZYDIS_OPERAND_DECODE_FLAGS_VISIBLE | ZYDIS_OPERAND_DECODE_FLAGS_HIDDEN 

Additionally the basic ZydisDecodedInstruction struct should always be filled with at least operand_count and operand_count_hidden.

Metadata

Metadata

Assignees

Labels

A-decoderArea: DecoderC-enhancementCategory: Enhancement of existing features

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions