Intel functions

---

VMProtect 是新一代软件盗版保护解决方案。VMProtect 是目前强大的反盗版解决方案之一，许多领先的软件发行商都在使用它。VMProtect允许保护可执行文件（EXE，SCR），动态链接库（DLL，OCX，BPL）和驱动程序（SYS）。

VMProtect最新版下载

加密解密技术交流群（766135708）

一个用于处理英特尔函数列表的类：

class IntelFunctions {
public:
	IntelFunction item(int index); // returns a function with the given index
	int count(); // returns the number of functions in the list
	void clear(); // clears the list
	IntelFunction itemByAddress(uint64 address); // returns a function at the given address
	IntelFunction itemByName(string name); // returns a function with the given name
	IntelFunction addByAddress(uint64 address, CompilationType type = ctVirtualization); 
		// Adds a new function with the given address and compilation type
};

编辑类型：

enum CompilationType {
	None,
	Virtualization,
	Mutation,
	Ultra
};

一个与英特尔函数一起工作的类：

class IntelFunction {
public:
	uint64 address(); // returns the address of the function
	string name(); // returns the name of the function
	ObjectType type(); // returns the type of the function
	IntelCommand item(int index); // returns a command with the given index
	int count(); // returns the number of commands in the list
	CompilationType compilationType(); // returns the compilation type
	void setCompilationType(CompilationType value); // sets the compilation type
	CommandLinks links(); // returns the list of links
	IntelCommand itemByAddress(uint64 address); // returns a command at the given address
	void destroy(); // destroys the function
	Folder folder(); // returns the custom folder
	void setFolder(Folder folder); // sets the custom folder
};

英特尔类型

enum IntelCommandType {
	Unknown, Push, Pop, Mov, Add, Xor, Test, Lea, Ud0, Ret, Ssh, Crc, Call, Jmp, 
	Fstsw, Fsqrt, Fchs, Fstcw, Fldcw, Fild, Fist, Fistp, Fld, Fstp, Fst, Fadd, 
	Fsub, Fsubr, Fisub, Fisubr, Fdiv, Fcomp, Fmul, Repe, Repne, Rep, DB, DW, DD, DQ,
	Movs, Cmps, Scas, Movzx, Movsx, Inc, Dec, Les, Lds, Lfs, Lgs, Lss, Xadd, Bswap,
	Jxx, And, Sub, Stos, Lods, Nop, Xchg, Pushf, Popf, Sahf, Lahf, Shl, Shr, Sal, 
	Sar, Rcl, Rcr, Rol, Ror, Shld, Shrd, Loope, Loopne, Loop, Jcxz, In, Ins, Out, 
	Outs, Wait, Cbw, Cwde, Cdqe, Cwd, Cdq, Cqo, Clc, Stc, Cli, Sti, Cld, Std, Not,
	Neg, Div, Imul, Idiv, Mul, Or, Adc, Cmp, Sbb, Pusha, Popa, Clflush, Pause, 
	Bound, Arpl, Daa, Das, Aaa, Aam, Aad, Aas, Enter, Leave, Int, Into, Iret, Set, 
	Cmov, Addpd, Addps, Addsd, Addss, Andpd, Andps, Andnpd, Andnps, Cmppd, Cmpps, 
	Cmpsd, Cmpss, Comisd, Comiss, Cvtdq2ps, Cvtpd2dq, Cvtdq2pd, Cvtpd2pi, Cvtps2pi,
	Cvtpd2ps, Cvtps2pd, Cvtpi2pd, Cvtpi2ps, Cvtps2dq, Cvtsd2si, Cvtss2si, Cvtsd2ss,
	Cvtss2sd, Cvttpd2pi, Cvttps2pi, Cvttpd2dq, Cvttps2dq, Cvttsd2si, Cvttss2si, 
	Divpd, Divps, Divsd, Divss, Maxpd, Maxps, Maxsd, Maxss, Minpd, Minps, Minsd, 
	Minss, Mulpd, Mulps, Mulsd, Mulss, Orpd, Orps, Movd, Movq, Movntq, Movapd, Movaps,
	Movdqa, Movdqu, Movdq2q, Movq2dq, Movhlps, Movhpd, Movhps, Movlhps, Movlpd, 
	Movlps, Movmskpd, Movmskps, Movnti, Movntpd, Movntps, Movsd, Movss, Movupd, 
	Movups, Pmovmskb, Psadbw, Pshufw, Pshufd, Pshuflw, Pshufhw, Psubb, Psubw, Psubd, 
	Psubq, Psubsb, Psubsw, Psubusb, Psubusw, Paddb, Paddw, Paddd, Paddq, Paddsb, 
	Paddsw, Paddusb, Paddusw, Pavgb, Pavgw, Pinsrw, Pextrw, Pmaxsw, Pmaxub, Pminsw, 
	Pminub, Pmulhuw, Pmulhw, Pmullw, Pmuludq, Psllw, Pslld, Psllq, Pslldq, Psraw, 
	Psrad, Psrlw, Psrld, Psrlq, Psrldq, Punpcklbw, Punpcklwd, Punpckldq, Punpcklqdq, 
	Punpckhqdq, Packusdw, Pcmpgtb, Pcmpgtw, Pcmpgtd, Pcmpeqb, Pcmpeqw, Pcmpeqd, 
	Emms, Packsswb, Packuswb, Punpckhbw, Punpckhwd, Punpckhdq, Packssdw, Pand, 
	Pandn, Por, Pxor, Pmaddwd, Rcpps, Rcpss, Rsqrtss, Movsxd, Shufps, Shufpd, Sqrtpd, 
	Sqrtps, Sqrtsd, Sqrtss, Subpd, Subps, Subsd, Subss, Ucomisd, Ucomiss, Unpckhpd, 
	Unpckhps, Unpcklpd, Unpcklps, Xorpd, Xorps, Bt, Bts, Btr, Btc, Xlat, Cpuid, 
	Rsm, Bsf, Bsr, Cmpxchg, Cmpxchg8b, Hlt, Cmc, Lgdt, Sgdt, Lidt, Sidt, Smsw, Lmsw, 
	Invlpg, Lar, Lsl, Clts, Invd, Wbinvd, Ud2, Wrmsr, Rdtsc, Rdmsr, Rdpmc, Fcom, 
	Fdivr, Fiadd, Fimul, Ficom, Ficomp, Fidiv, Fidivr, Faddp, Fmulp, Fsubp, Fsubrp, 
	Fdivp, Fdivrp, Fbld, Fbstp, Ffree, Frstor, Fsave, Fucom, Fucomp, Fldenv, Fstenvm,
	Fxch, Fabs, Fxam, Fld1, Fldl2t, Fldl2e, Fldpi, Fldlg2, Fldln2, Fldz, Fyl2x, 
	Fptan, Fpatan, Fxtract, Fprem1, Fdecstp, Fincstp, Fprem, Fyl2xp1, Fsincos, Frndint, 
	Fscale, Fsin, Fcos, Ftst, Fstenv, F2xm1, Fnop, Finit, Fclex, Fcompp, Sysenter, 
	Sysexit, Sldt, Str, Lldt, Ltr, Verr, Verw, Sfence, Lfence, Mfence, Prefetchnta, 
	Prefetcht0, Prefetcht1, Prefetcht2, Prefetch, Prefetchw, Fxrstor, Fxsave, Ldmxcsr, 
	Stmxcsr, Fcmovb, Fcmove, Fcmovbe, Fcmovu, Fcmovnb, Fcmovne, Fcmovnbe, Fcmovnu,
	Fucomi, Fcomi, Fucomip, Fcomip, Fucompp, Vmcall, Vmlaunch, Vmresume, Vmxoff, 
	Monitor, Mwait, Xgetbv, Xsetbv, Vmrun, Vmmcall, Vmload, Vmsave, Stgi, Clgi, 
	Skinit, Invlpga, Swapgs, Rdtscp, Syscall, Sysret, Femms, Getsec, Pshufb, Phaddw, 
	Phaddd, Phaddsw, Pmaddubsw, Phsubw, Phsubd, Phsubsw, Psignb, Psignw, Psignd, 
	Pmulhrsw, Pabsb, Pabsw, Pabsd, Movbe, Palignr, Rsqrtps, Vmread, Vmwrite, Svldt, 
	Rsldt, Svts, Rsts, Xsave, Xrstor, Vmptrld, Vmptrst, Maskmovq, Fnstenv, Fnstcw, 
	Fstp1, Fneni, Fndisi, Fnclex, Fninit, Fsetpm, Fisttp, Fnsave, Fnstsw, Fxch4, 
	Fcomp5, Ffreep, Fxch7, Fstp8, Fstp9, Haddpd, Hsubpd, Addsubpd, Addsubps, Movntdq, 
	Fcom2, Fcomp3, Haddps, Hsubps, Movddup, Movsldup, Cvtsi2sd, Cvtsi2ss, Movntsd, 
	Movntss, Lddqu, Movshdup, Popcnt, Tzcnt, Lzcnt, Pblendvb, Pblendps, Pblendpd, 
	Ptest, Movsxbw, Movsxbd, Movsxbq, Movsxwd, Movsxwq, Movsxdq, Muldq, Pcmpeqq, 
	Movntdqa, Xsaveopt, Maskmovdqu, Ud1, Pcmpgtq, Movzxbw, Movzxbd, Movzxbq, Movzxwd, 
	Movzxwq, Movzxdq
};

英特尔分部：

enum IntelSegment {
	None,
	es,
	cs,
	ss,
	ds,
	fs,
	gs
};

英特尔的标志：

enum IntelFlag {
	C,
	P,
	A,
	Z,
	S,
	T,
	I,
	D,
	O
};

英特尔注册：

enum IntelRegistr {
	eax,
	ecx,
	edx,
	ebx,
	esp,
	ebp,
	esi,
	edi,
	r8,
	r9,
	r10,
	r11,
	r12,
	r13,
	r14,
	r15
};

一个与英特尔命令合作的类：

class IntelCommand {
public:
	uint64 address(); // returns the address of the command
	IntelCommandType type(); // returns the type of the command
	string text(); // returns the text representation
	int size(); // returns the size of the command
	int dump(int index); // returns data of the command with the given index
	CommandLink link(); // returns the command link
	int flags(); // returns command flags
	IntelSegment baseSegment(); // returns the base segment
	IntelCommandType preffix(); // returns the type of the prefix command
	IntelOperand operand(int index); // returns an operand with the given index
};

操作类型：

enum OperandType {
	None,
	Value,
	Registr,
	Memory,
	SegmentRegistr,
	ControlRegistr,
	DebugRegistr,
	FPURegistr,
	HiPartRegistr,
	BaseRegistr,
	MMXRegistr,
	XMMRegistr
};

操作数尺寸：

enum OperandSize {
	Byte,
	Word,
	DWord,
	QWord,
	TByte,
	OWord,
	FWord
};

一个处理英特尔命令的操作数的类：

class IntelOperand {
public:
	int type(); // returns the type of the operand
	OperandSize size(); // returns the size of the operand
	int registr(); // returns the register
	int baseRegistr(); // returns the base register
	int scale(); // returns the scale
	uint64 value(); // returns the value
};

一个用于处理命令链接列表的类：

class CommandLinks {
public:
	CommandLink item(int index); // returns a link with the given index
	int count(); // returns the number of links in the list
};

链接类型：

enum LinkType {
	None,
	SEHBlock,
	FinallyBlock,
	DualSEHBlock,
	FilterSEHBlock,
	Jmp,
	JmpWithFlag,
	JmpWithFlagNSFS,
	JmpWithFlagNSNA,
	JmpWithFlagNSNS,
	Call,
	Case,
	Switch,
	Native,
	Offset,
	GateOffset,
	ExtSEHBlock,
	MemSEHBlock,
	ExtSEHHandler,
	VBMemSEHBlock
};

一个与命令链接合作的类：

class CommandLink {
public:
	uint64 toAddress(); // returns the address the link refers
	LinkType type(); // returns the type of the link
	IntelCommand from(); // returns the parent command
};

一个与图书馆合作的类：

enum ParamType {
	"void",
	"byte",
	"char",
	"short",
	"ushort",
	"int",
	"uint",
	"long",
	"ulong",
	"size_t",
	"float",
	"double",
	"string",
	"pointer"
};

enum CallType {
	"default", 
	"cdecl", 
	"stdcall"
};

class FFILibrary {
public:
	string name(); // returns the name 
	uint64 address(); // returns the address in the memory
	void close();
	FFIFunction getFunction(string name, ParamType ret, ParamType param1, ...); // returns a function
	FFIFunction getFunction(string name, table (ParamType ret, CallType abi, ParamType, ...)); // returns a function
};

一个与国外函数一起工作的类：

class FFIFunction {
	string name(); // returns the name
	uint64 address(); // returns the address in the memory
}