Class Disassembler

Derive a value from disassembly.

Args:
  start: Where to start disassembly (Usually a symbol name).
  end: Where to stop disassembly.

  length: If end is not specified, we disassemble at most this many
    bytes.

  rules: A list of rules (see above).

Overrides: object.__init__

str(x)

Overrides: object.__str__

(inherited documentation)

Convert the rule into a regular expression.

Rules are a list of patterns. Each pattern corresponds to a single instruction. There can be an arbitrary number of instructions between each rule.

Output is captured using $out (this can only be specified once). Wild cards are denoted by *. Wildcards only apply across a single instruction (and comment). The following is an example of a rule:

MOV EAX, [ESI+$out] TEST EAX, EAX PUSH EAX CALL DWORD *__imp__PsGetProcessId

Returns the expected value or a NoneObject.

Overrides: DynamicParser.calculate

(inherited documentation)