23.3.3.22 Disassembly In Guile

The disassembler can be invoked from Scheme code. Furthermore, the disassembler can take a Guile port as input, allowing one to disassemble from any source, and not just target memory.

Scheme Procedure: arch-disassemble arch start-pc [#:port port] [#:offset offset] [#:size size] [#:count count]

Return a list of disassembled instructions starting from the memory address start-pc.

The optional argument port specifies the input port to read bytes from. If port is #f then bytes are read from target memory.

The optional argument offset specifies the address offset of the first byte in port. This is useful, for example, when port specifies a ‘bytevector’ and you want the bytevector to be disassembled as if it came from that address. The start-pc passed to the reader for port is offset by the same amount.

Example:

(gdb) guile (use-modules (rnrs io ports))
(gdb) guile (define pc (value->integer (parse-and-eval "$pc")))
(gdb) guile (define mem (open-memory #:start pc))
(gdb) guile (define bv (get-bytevector-n mem 10))
(gdb) guile (define bv-port (open-bytevector-input-port bv))
(gdb) guile (define arch (current-arch))
(gdb) guile (arch-disassemble arch pc #:port bv-port #:offset pc)
(((address . 4195516) (asm . "mov    $0x4005c8,%edi") (length . 5)))

The optional arguments size and count determine the number of instructions in the returned list. If either size or count is specified as zero, then no instructions are disassembled and an empty list is returned. If both the optional arguments size and count are specified, then a list of at most count disassembled instructions whose start address falls in the closed memory address interval from start-pc to (start-pc + size - 1) are returned. If size is not specified, but count is specified, then count number of instructions starting from the address start-pc are returned. If count is not specified but size is specified, then all instructions whose start address falls in the closed memory address interval from start-pc to (start-pc + size - 1) are returned. If neither size nor count are specified, then a single instruction at start-pc is returned.

Each element of the returned list is an alist (associative list) with the following keys:

address

The value corresponding to this key is a Guile integer of the memory address of the instruction.

asm

The value corresponding to this key is a string value which represents the instruction with assembly language mnemonics. The assembly language flavor used is the same as that specified by the current CLI variable disassembly-flavor. See Machine Code.

length

The value corresponding to this key is the length of the instruction in bytes.