OllyDbg | A assembler level analysing debugger for Windows

t_asmmod

Describes binary command produced by Assembleallforms(). If command was compiled in AM_IMPRECISE mode, contains information necessary to find all variations of this command. In fact, plugins don't need to know the internal layout of this structure. They call Assembleallforms() or Getasmsearchmodel() to produce set of models and Comparecommand() or Comparesequence() to find command.

typedef struct t_asmmod {              // Description of assembled command
uchar          code[MAXCMDSIZE];     // Binary code
uchar          mask[MAXCMDSIZE];     // Mask for binary code (0: bit ignored)
ulong          prefixes;             // List of prefixes, set of PF_xxx
uchar          ncode;                // Length of code w/o prefixes, bytes
uchar          features;             // Code features, set of AMF_xxx
uchar          postbyte;             // Postbyte (if AMF_POSTBYTE set)
uchar          noperand;             // Number of operands (no pseudooperands)
t_modop        op[NOPERAND];         // Description of operands
} t_asmmod;

Members:

code

Binary code of the command. In precise mode, this is the complete command of length ncode that includes prefixes and postbyte. If command was compiled in AM_IMPRECISE mode, usually contains only opcode without prefixes and postbyte

mask

Comparison mask, marks significant bits of code. In precise mode, all bits in the mask are set

prefixes

List of prefixes as a combination of flags ASP_xxx. In precise mode, prefixes are included in the code

ncode

Length of the significant part of the code and mask. In precise mode, this is the length of the complete command

features

Combination of zero or more of the following flags. Always zero in precise mode:
AMF_SAMEORDER - set if command accesses memory using SIB and registers (index, base) appear in the same order as in the source
AMF_ANYSEG - set if command must possess segment prefix, but it does not matter which
AMF_POSTBYTE - command includes postbyte
AMF_IMPRECISE - model is imprecise in the sense that binary code alone is not sufficient to locate the command and operands must be analysed. This flag does not influence the comparion of prefixes
AMF_ANYSIZE - size of the operands does not matter, so optional data size prefix is acceptable
AMF_NOSMALL - 16-bit addressing is not allowed

postbyte

Postbyte as a last byte in the command, valid only if AMF_POSTBYTE is set

noperand

Number of operands in op that must be taken into account when comparing two commands. May differ from the real number of operands in the found command

Pointer to array of structures t_modop that describe operands. Not used in precise mode