LM_Disassemble
Disassembles a single instruction from machine code.The memory address of the instruction to be disassembled.
Pointer to an
lm_inst_t structure that will be populated with the disassembled instruction.Returns
LM_TRUE on success, LM_FALSE on failure.LM_DisassembleEx
Disassembles multiple instructions from machine code with full control over architecture and instruction count.The memory address of the instructions to be disassembled.
The architecture to disassemble for. Can be:
LM_ARCH_X86- x86 32-bitLM_ARCH_X64- x86 64-bitLM_ARCH_ARMV7,LM_ARCH_ARMV8,LM_ARCH_AARCH64- ARM variants- And more (see
lm_arch_tenum)
The maximum number of bytes to disassemble.Use
0 to disassemble as many instructions as possible (limited by instruction_count).The maximum number of instructions to disassemble.Use
0 to disassemble as many instructions as possible (limited by max_size).The runtime address used to resolve addressing (e.g., relative jumps and calls will be displayed with their resolved addresses).Typically set to the same value as
machine_code.Pointer that will receive an allocated array of
lm_inst_t structures.Important: Must be freed with LM_FreeInstructions() after use.Returns the number of instructions successfully disassembled on success, or
0 on failure.LM_FreeInstructions
Frees memory allocated byLM_DisassembleEx.
The instruction array that was allocated by
LM_DisassembleEx.Example (Modern C++)
This example demonstrates disassembling a function until aret instruction is found:
lm_inst_t Structure
Thelm_inst_t structure represents a single disassembled instruction:
The memory address where this instruction is located.
The size of the instruction in bytes (typically 1-16 bytes on x86/x64).
The raw machine code bytes of the instruction. Maximum size is
LM_INST_MAX (16 bytes).The instruction mnemonic (operation name), such as
"mov", "jmp", "call", etc.The operands of the instruction as a string, such as
"eax, ebx" or "[rax + 0x10]". May be empty for instructions with no operands.