Provide "peek at bytes" ability in sleigh #7196
Labels
Feature: Sleigh
Status: Triage
Information is being gathered
Type: Enhancement
New feature or request
I started off trying to implement a processor module an an architecture which uses "instruction bundles". This arch requires to look at some instruction metadata in order to determine the number and size of instructions located in the "instruction bundle". Trouble is that the metadata for the instructions is located at the end of the bundle.
Due to how ghidra consumes bytes relating to instructions, the current implementation requires me to use a token to look at an instruction bundle. If I decode a single instruction, ghidra consumes the bytes referred to in the token and I then skip over the remaining instructions.
Describe the solution you'd like
What I would like is some ability in SLEIGH to look at bytes without consuming them. This would allow me to "peek" at the bytes in the metadata and then decode one instruction.
Describe alternatives you've considered
I've currently written rules in SLEIGH to essentially do recursive parsing on the instruction bundle. Trouble is that this is very tedious to write and then Ghidra displays all of the decoded instructions on a single line. Ghidra will consume an entire "instruction bundle" and consider it 1 instruction.
Furthermore, I do not expect this to work well when branching to an address within the middle of an instruction bundle.
If SLEIGH provided some token-like ability to look at a block of bytes starting at the current instruction, but not consuming them as the token does, that would be really helpful and greatly simplify my current SLEIGH rules.
The text was updated successfully, but these errors were encountered: