diff --git a/include/transform.hpp b/include/transform.hpp
index e754c63..562961b 100644
--- a/include/transform.hpp
+++ b/include/transform.hpp
@@ -217,11 +217,21 @@ namespace vm::transform
{ ZYDIS_MNEMONIC_ROR, ZYDIS_MNEMONIC_ROL }, { ZYDIS_MNEMONIC_ROL, ZYDIS_MNEMONIC_ROR },
{ ZYDIS_MNEMONIC_INC, ZYDIS_MNEMONIC_DEC }, { ZYDIS_MNEMONIC_DEC, ZYDIS_MNEMONIC_INC } };
+ ///
+ /// determines if the given mnemonic is a valid transformation...
+ ///
+ /// mnemonic of the native instruction...
+ /// returns true if the mnemonic is a transformation...
inline bool valid( zydis_mnemonic_t op )
{
return transforms< std::uint64_t >.find( op ) != transforms< std::uint64_t >.end();
}
+ ///
+ /// inverse operand decryption transformations...
+ ///
+ /// reference to the transformations to be inversed...
+ /// reference to the resulting inversed transformations...
inline void inverse_transforms( transform::map_t &transforms, transform::map_t &inverse )
{
inverse[ transform::type::generic0 ] = transforms[ transform::type::generic0 ];
@@ -249,6 +259,11 @@ namespace vm::transform
transform::inverse[ transforms[ transform::type::update_key ].mnemonic ];
}
+ ///
+ /// inverse transformations given a vector of them...
+ ///
+ /// reference to a vector of transformations...
+ /// returns true if all transformations were inversed...
inline auto inverse_transforms( std::vector< zydis_decoded_instr_t > &instrs ) -> bool
{
for ( auto idx = 0u; idx < instrs.size(); idx++ )
@@ -279,6 +294,11 @@ namespace vm::transform
}
}
+ ///
+ /// determines if a given decoded instruction has a second operand that is an immediate value...
+ ///
+ /// pointer to a decoded instruction...
+ /// returns true if the second operand is of type immediate...
inline bool has_imm( const zydis_decoded_instr_t *instr )
{
return instr->operand_count > 1 && ( instr->operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE );