t_result

OllyDbg Plugin API

t_result

Type of structure that contains result of expression evaluation.

typedef struct t_result { // Result of expression's evaluation

int type; // Type of expression, DEC(R)_xxx

int dtype; // Type of data, DEC_xxx

union {

char data[10]; // Binary form of expression's value

ulong u; // Value as unsigned integer

long l; // Value as signed integer

long double f; }; // Value as 80-bit float

union {

char value[TEXTLEN]; // ASCII form of expression's value

wchar_t wvalue[TEXTLEN/2]; };// UNICODE form of expression's value

ulong lvaddr; // Address or index of lvalue or NULL

} t_result;

Members:

type - exact type of expression, one of DEC_xxx or DECR_xxx possibly ORed with DEC_SIGNED if result should be interpreted as signed number. type is DEC_UNKNOWN if expression is invalid. Expression is lvalue (can be assigned to) if either type is DEC_xxx and lvaddr is not 0, or if type is one of DECR_xxx. All possible types are listed in the table below:

type & DECR_TYPEMASK Meaning
DEC_UNKNOWN Error in expression
DEC_BYTE Byte
DEC_WORD Short integer
DEC_DWORD Long integer
DEC_FLOAT4 32-bit float
DEC_FWORD 48-bit descriptor or long pointer
DEC_FLOAT8 64-bit double
DEC_QWORD Quadword
DEC_FLOAT10 80-bit long double
DEC_STRING Zero-terminated ASCII string
DEC_UNICODE Zero-terminated UNICODE string
DECR_BYTE Byte register
DECR_WORD Short integer register
DECR_DWORD Long integer register
DECR_QWORD MMX register
DECR_FLOAT10 Floating-point register
DECR_SEG Segment register

dtype - simplified type of data, possibly ORed with DEC_SIGNED, describes value stored in t_result.data. If bit DEC_SIGNED is set, result must be interpreted as signed, otherwise as unsigned:

dtype Interpretation of t_result.data
DEC_UNKNOWN Error in expression or result doesn't fit into data
DEC_DWORD 32-bit unsigned integer in t_result.u
DEC_DWORD|DEC_SIGNED 32-bit signed integer stored in t_result.l
DEC_QWORD 64-bit integer in data[0..7]
DEC_FLOAT10 80-bit long double stored in t_result.f

data, u, l, f - result of expression if this can be represented as integer or float. Which field to select depends on dtype;

value - result of expression of type DEC_STRING (truncated to TEXTLEN characters) or error message if type is DEC_UNKNOWN;

wvalue - result of expression of type DEC_UNICODE (truncated to TEXTLEN/2 characters);

lvaddr - address of expression if type is one of DEC_xxx, or index of register if type is DECR_xxx.

See also: Expression