添加项目文件。

ai_anti_malware/capstone/include/capstone/arm.h

@@ -0,0 +1,937 @@
+#ifndef CAPSTONE_ARM_H
+#define CAPSTONE_ARM_H
+
+/* Capstone Disassembly Engine */
+/* By Nguyen Anh Quynh <aquynh@gmail.com>, 2013-2015 */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "platform.h"
+
+#ifdef _MSC_VER
+#pragma warning(disable:4201)
+#endif
+
+/// ARM shift type
+typedef enum arm_shifter {
+	ARM_SFT_INVALID = 0,
+	ARM_SFT_ASR,	///< shift with immediate const
+	ARM_SFT_LSL,	///< shift with immediate const
+	ARM_SFT_LSR,	///< shift with immediate const
+	ARM_SFT_ROR,	///< shift with immediate const
+	ARM_SFT_RRX,	///< shift with immediate const
+	ARM_SFT_ASR_REG,	///< shift with register
+	ARM_SFT_LSL_REG,	///< shift with register
+	ARM_SFT_LSR_REG,	///< shift with register
+	ARM_SFT_ROR_REG,	///< shift with register
+	ARM_SFT_RRX_REG,	///< shift with register
+} arm_shifter;
+
+/// ARM condition code
+typedef enum arm_cc {
+	ARM_CC_INVALID = 0,
+	ARM_CC_EQ,            ///< Equal                      Equal
+	ARM_CC_NE,            ///< Not equal                  Not equal, or unordered
+	ARM_CC_HS,            ///< Carry set                  >, ==, or unordered
+	ARM_CC_LO,            ///< Carry clear                Less than
+	ARM_CC_MI,            ///< Minus, negative            Less than
+	ARM_CC_PL,            ///< Plus, positive or zero     >, ==, or unordered
+	ARM_CC_VS,            ///< Overflow                   Unordered
+	ARM_CC_VC,            ///< No overflow                Not unordered
+	ARM_CC_HI,            ///< Unsigned higher            Greater than, or unordered
+	ARM_CC_LS,            ///< Unsigned lower or same     Less than or equal
+	ARM_CC_GE,            ///< Greater than or equal      Greater than or equal
+	ARM_CC_LT,            ///< Less than                  Less than, or unordered
+	ARM_CC_GT,            ///< Greater than               Greater than
+	ARM_CC_LE,            ///< Less than or equal         <, ==, or unordered
+	ARM_CC_AL             ///< Always (unconditional)     Always (unconditional)
+} arm_cc;
+
+typedef enum arm_sysreg {
+	/// Special registers for MSR
+	ARM_SYSREG_INVALID = 0,
+
+	// SPSR* registers can be OR combined
+	ARM_SYSREG_SPSR_C = 1,
+	ARM_SYSREG_SPSR_X = 2,
+	ARM_SYSREG_SPSR_S = 4,
+	ARM_SYSREG_SPSR_F = 8,
+
+	// CPSR* registers can be OR combined
+	ARM_SYSREG_CPSR_C = 16,
+	ARM_SYSREG_CPSR_X = 32,
+	ARM_SYSREG_CPSR_S = 64,
+	ARM_SYSREG_CPSR_F = 128,
+
+	// independent registers
+	ARM_SYSREG_APSR = 256,
+	ARM_SYSREG_APSR_G,
+	ARM_SYSREG_APSR_NZCVQ,
+	ARM_SYSREG_APSR_NZCVQG,
+
+	ARM_SYSREG_IAPSR,
+	ARM_SYSREG_IAPSR_G,
+	ARM_SYSREG_IAPSR_NZCVQG,
+	ARM_SYSREG_IAPSR_NZCVQ,
+
+	ARM_SYSREG_EAPSR,
+	ARM_SYSREG_EAPSR_G,
+	ARM_SYSREG_EAPSR_NZCVQG,
+	ARM_SYSREG_EAPSR_NZCVQ,
+
+	ARM_SYSREG_XPSR,
+	ARM_SYSREG_XPSR_G,
+	ARM_SYSREG_XPSR_NZCVQG,
+	ARM_SYSREG_XPSR_NZCVQ,
+
+	ARM_SYSREG_IPSR,
+	ARM_SYSREG_EPSR,
+	ARM_SYSREG_IEPSR,
+
+	ARM_SYSREG_MSP,
+	ARM_SYSREG_PSP,
+	ARM_SYSREG_PRIMASK,
+	ARM_SYSREG_BASEPRI,
+	ARM_SYSREG_BASEPRI_MAX,
+	ARM_SYSREG_FAULTMASK,
+	ARM_SYSREG_CONTROL,
+
+	// Banked Registers
+	ARM_SYSREG_R8_USR,
+	ARM_SYSREG_R9_USR,
+	ARM_SYSREG_R10_USR,
+	ARM_SYSREG_R11_USR,
+	ARM_SYSREG_R12_USR,
+	ARM_SYSREG_SP_USR,
+	ARM_SYSREG_LR_USR,
+	ARM_SYSREG_R8_FIQ,
+	ARM_SYSREG_R9_FIQ,
+	ARM_SYSREG_R10_FIQ,
+	ARM_SYSREG_R11_FIQ,
+	ARM_SYSREG_R12_FIQ,
+	ARM_SYSREG_SP_FIQ,
+	ARM_SYSREG_LR_FIQ,
+	ARM_SYSREG_LR_IRQ,
+	ARM_SYSREG_SP_IRQ,
+	ARM_SYSREG_LR_SVC,
+	ARM_SYSREG_SP_SVC,
+	ARM_SYSREG_LR_ABT,
+	ARM_SYSREG_SP_ABT,
+	ARM_SYSREG_LR_UND,
+	ARM_SYSREG_SP_UND,
+	ARM_SYSREG_LR_MON,
+	ARM_SYSREG_SP_MON,
+	ARM_SYSREG_ELR_HYP,
+	ARM_SYSREG_SP_HYP,
+
+	ARM_SYSREG_SPSR_FIQ,
+	ARM_SYSREG_SPSR_IRQ,
+	ARM_SYSREG_SPSR_SVC,
+	ARM_SYSREG_SPSR_ABT,
+	ARM_SYSREG_SPSR_UND,
+	ARM_SYSREG_SPSR_MON,
+	ARM_SYSREG_SPSR_HYP,
+} arm_sysreg;
+
+/// The memory barrier constants map directly to the 4-bit encoding of
+/// the option field for Memory Barrier operations.
+typedef enum arm_mem_barrier {
+	ARM_MB_INVALID = 0,
+	ARM_MB_RESERVED_0,
+	ARM_MB_OSHLD,
+	ARM_MB_OSHST,
+	ARM_MB_OSH,
+	ARM_MB_RESERVED_4,
+	ARM_MB_NSHLD,
+	ARM_MB_NSHST,
+	ARM_MB_NSH,
+	ARM_MB_RESERVED_8,
+	ARM_MB_ISHLD,
+	ARM_MB_ISHST,
+	ARM_MB_ISH,
+	ARM_MB_RESERVED_12,
+	ARM_MB_LD,
+	ARM_MB_ST,
+	ARM_MB_SY,
+} arm_mem_barrier;
+
+/// Operand type for instruction's operands
+typedef enum arm_op_type {
+	ARM_OP_INVALID = 0, ///< = CS_OP_INVALID (Uninitialized).
+	ARM_OP_REG, ///< = CS_OP_REG (Register operand).
+	ARM_OP_IMM, ///< = CS_OP_IMM (Immediate operand).
+	ARM_OP_MEM, ///< = CS_OP_MEM (Memory operand).
+	ARM_OP_FP,  ///< = CS_OP_FP (Floating-Point operand).
+	ARM_OP_CIMM = 64, ///< C-Immediate (coprocessor registers)
+	ARM_OP_PIMM, ///< P-Immediate (coprocessor registers)
+	ARM_OP_SETEND,	///< operand for SETEND instruction
+	ARM_OP_SYSREG,	///< MSR/MRS special register operand
+} arm_op_type;
+
+/// Operand type for SETEND instruction
+typedef enum arm_setend_type {
+	ARM_SETEND_INVALID = 0,	///< Uninitialized.
+	ARM_SETEND_BE,	///< BE operand.
+	ARM_SETEND_LE, ///< LE operand
+} arm_setend_type;
+
+typedef enum arm_cpsmode_type {
+	ARM_CPSMODE_INVALID = 0,
+	ARM_CPSMODE_IE = 2,
+	ARM_CPSMODE_ID = 3
+} arm_cpsmode_type;
+
+/// Operand type for SETEND instruction
+typedef enum arm_cpsflag_type {
+	ARM_CPSFLAG_INVALID = 0,
+	ARM_CPSFLAG_F = 1,
+	ARM_CPSFLAG_I = 2,
+	ARM_CPSFLAG_A = 4,
+	ARM_CPSFLAG_NONE = 16,	///< no flag
+} arm_cpsflag_type;
+
+/// Data type for elements of vector instructions.
+typedef enum arm_vectordata_type {
+	ARM_VECTORDATA_INVALID = 0,
+
+	// Integer type
+	ARM_VECTORDATA_I8,
+	ARM_VECTORDATA_I16,
+	ARM_VECTORDATA_I32,
+	ARM_VECTORDATA_I64,
+
+	// Signed integer type
+	ARM_VECTORDATA_S8,
+	ARM_VECTORDATA_S16,
+	ARM_VECTORDATA_S32,
+	ARM_VECTORDATA_S64,
+
+	// Unsigned integer type
+	ARM_VECTORDATA_U8,
+	ARM_VECTORDATA_U16,
+	ARM_VECTORDATA_U32,
+	ARM_VECTORDATA_U64,
+
+	// Data type for VMUL/VMULL
+	ARM_VECTORDATA_P8,
+
+	// Floating type
+	ARM_VECTORDATA_F32,
+	ARM_VECTORDATA_F64,
+
+	// Convert float <-> float
+	ARM_VECTORDATA_F16F64,	// f16.f64
+	ARM_VECTORDATA_F64F16,	// f64.f16
+	ARM_VECTORDATA_F32F16,	// f32.f16
+	ARM_VECTORDATA_F16F32,	// f32.f16
+	ARM_VECTORDATA_F64F32,	// f64.f32
+	ARM_VECTORDATA_F32F64,	// f32.f64
+
+	// Convert integer <-> float
+	ARM_VECTORDATA_S32F32,	// s32.f32
+	ARM_VECTORDATA_U32F32,	// u32.f32
+	ARM_VECTORDATA_F32S32,	// f32.s32
+	ARM_VECTORDATA_F32U32,	// f32.u32
+	ARM_VECTORDATA_F64S16,	// f64.s16
+	ARM_VECTORDATA_F32S16,	// f32.s16
+	ARM_VECTORDATA_F64S32,	// f64.s32
+	ARM_VECTORDATA_S16F64,	// s16.f64
+	ARM_VECTORDATA_S16F32,	// s16.f64
+	ARM_VECTORDATA_S32F64,	// s32.f64
+	ARM_VECTORDATA_U16F64,	// u16.f64
+	ARM_VECTORDATA_U16F32,	// u16.f32
+	ARM_VECTORDATA_U32F64,	// u32.f64
+	ARM_VECTORDATA_F64U16,	// f64.u16
+	ARM_VECTORDATA_F32U16,	// f32.u16
+	ARM_VECTORDATA_F64U32,	// f64.u32
+} arm_vectordata_type;
+
+/// ARM registers
+typedef enum arm_reg {
+	ARM_REG_INVALID = 0,
+	ARM_REG_APSR,
+	ARM_REG_APSR_NZCV,
+	ARM_REG_CPSR,
+	ARM_REG_FPEXC,
+	ARM_REG_FPINST,
+	ARM_REG_FPSCR,
+	ARM_REG_FPSCR_NZCV,
+	ARM_REG_FPSID,
+	ARM_REG_ITSTATE,
+	ARM_REG_LR,
+	ARM_REG_PC,
+	ARM_REG_SP,
+	ARM_REG_SPSR,
+	ARM_REG_D0,
+	ARM_REG_D1,
+	ARM_REG_D2,
+	ARM_REG_D3,
+	ARM_REG_D4,
+	ARM_REG_D5,
+	ARM_REG_D6,
+	ARM_REG_D7,
+	ARM_REG_D8,
+	ARM_REG_D9,
+	ARM_REG_D10,
+	ARM_REG_D11,
+	ARM_REG_D12,
+	ARM_REG_D13,
+	ARM_REG_D14,
+	ARM_REG_D15,
+	ARM_REG_D16,
+	ARM_REG_D17,
+	ARM_REG_D18,
+	ARM_REG_D19,
+	ARM_REG_D20,
+	ARM_REG_D21,
+	ARM_REG_D22,
+	ARM_REG_D23,
+	ARM_REG_D24,
+	ARM_REG_D25,
+	ARM_REG_D26,
+	ARM_REG_D27,
+	ARM_REG_D28,
+	ARM_REG_D29,
+	ARM_REG_D30,
+	ARM_REG_D31,
+	ARM_REG_FPINST2,
+	ARM_REG_MVFR0,
+	ARM_REG_MVFR1,
+	ARM_REG_MVFR2,
+	ARM_REG_Q0,
+	ARM_REG_Q1,
+	ARM_REG_Q2,
+	ARM_REG_Q3,
+	ARM_REG_Q4,
+	ARM_REG_Q5,
+	ARM_REG_Q6,
+	ARM_REG_Q7,
+	ARM_REG_Q8,
+	ARM_REG_Q9,
+	ARM_REG_Q10,
+	ARM_REG_Q11,
+	ARM_REG_Q12,
+	ARM_REG_Q13,
+	ARM_REG_Q14,
+	ARM_REG_Q15,
+	ARM_REG_R0,
+	ARM_REG_R1,
+	ARM_REG_R2,
+	ARM_REG_R3,
+	ARM_REG_R4,
+	ARM_REG_R5,
+	ARM_REG_R6,
+	ARM_REG_R7,
+	ARM_REG_R8,
+	ARM_REG_R9,
+	ARM_REG_R10,
+	ARM_REG_R11,
+	ARM_REG_R12,
+	ARM_REG_S0,
+	ARM_REG_S1,
+	ARM_REG_S2,
+	ARM_REG_S3,
+	ARM_REG_S4,
+	ARM_REG_S5,
+	ARM_REG_S6,
+	ARM_REG_S7,
+	ARM_REG_S8,
+	ARM_REG_S9,
+	ARM_REG_S10,
+	ARM_REG_S11,
+	ARM_REG_S12,
+	ARM_REG_S13,
+	ARM_REG_S14,
+	ARM_REG_S15,
+	ARM_REG_S16,
+	ARM_REG_S17,
+	ARM_REG_S18,
+	ARM_REG_S19,
+	ARM_REG_S20,
+	ARM_REG_S21,
+	ARM_REG_S22,
+	ARM_REG_S23,
+	ARM_REG_S24,
+	ARM_REG_S25,
+	ARM_REG_S26,
+	ARM_REG_S27,
+	ARM_REG_S28,
+	ARM_REG_S29,
+	ARM_REG_S30,
+	ARM_REG_S31,
+
+	ARM_REG_ENDING,		// <-- mark the end of the list or registers
+
+	// alias registers
+	ARM_REG_R13 = ARM_REG_SP,
+	ARM_REG_R14 = ARM_REG_LR,
+	ARM_REG_R15 = ARM_REG_PC,
+
+	ARM_REG_SB = ARM_REG_R9,
+	ARM_REG_SL = ARM_REG_R10,
+	ARM_REG_FP = ARM_REG_R11,
+	ARM_REG_IP = ARM_REG_R12,
+} arm_reg;
+
+/// Instruction's operand referring to memory
+/// This is associated with ARM_OP_MEM operand type above
+typedef struct arm_op_mem {
+	arm_reg base;	///< base register
+	arm_reg index;	///< index register
+	int scale;	///< scale for index register (can be 1, or -1)
+	int disp;	///< displacement/offset value
+	/// left-shift on index register, or 0 if irrelevant
+	/// NOTE: this value can also be fetched via operand.shift.value
+	int lshift;
+} arm_op_mem;
+
+/// Instruction operand
+typedef struct cs_arm_op {
+	int vector_index;	///< Vector Index for some vector operands (or -1 if irrelevant)
+
+	struct {
+		arm_shifter type;
+		unsigned int value;
+	} shift;
+
+	arm_op_type type;	///< operand type
+
+	union {
+		int reg;	///< register value for REG/SYSREG operand
+		int32_t imm;			///< immediate value for C-IMM, P-IMM or IMM operand
+		double fp;			///< floating point value for FP operand
+		arm_op_mem mem;		///< base/index/scale/disp value for MEM operand
+		arm_setend_type setend; ///< SETEND instruction's operand type
+	};
+
+	/// in some instructions, an operand can be subtracted or added to
+	/// the base register,
+	/// if TRUE, this operand is subtracted. otherwise, it is added.
+	bool subtracted;
+
+	/// How is this operand accessed? (READ, WRITE or READ|WRITE)
+	/// This field is combined of cs_ac_type.
+	/// NOTE: this field is irrelevant if engine is compiled in DIET mode.
+	uint8_t access;
+
+	/// Neon lane index for NEON instructions (or -1 if irrelevant)
+	int8_t neon_lane;
+} cs_arm_op;
+
+/// Instruction structure
+typedef struct cs_arm {
+	bool usermode;	///< User-mode registers to be loaded (for LDM/STM instructions)
+	int vector_size; 	///< Scalar size for vector instructions
+	arm_vectordata_type vector_data; ///< Data type for elements of vector instructions
+	arm_cpsmode_type cps_mode;	///< CPS mode for CPS instruction
+	arm_cpsflag_type cps_flag;	///< CPS mode for CPS instruction
+	arm_cc cc;			///< conditional code for this insn
+	bool update_flags;	///< does this insn update flags?
+	bool writeback;		///< does this insn write-back?
+	arm_mem_barrier mem_barrier;	///< Option for some memory barrier instructions
+
+	/// Number of operands of this instruction,
+	/// or 0 when instruction has no operand.
+	uint8_t op_count;
+
+	cs_arm_op operands[36];	///< operands for this instruction.
+} cs_arm;
+
+/// ARM instruction
+typedef enum arm_insn {
+	ARM_INS_INVALID = 0,
+
+	ARM_INS_ADC,
+	ARM_INS_ADD,
+	ARM_INS_ADR,
+	ARM_INS_AESD,
+	ARM_INS_AESE,
+	ARM_INS_AESIMC,
+	ARM_INS_AESMC,
+	ARM_INS_AND,
+	ARM_INS_BFC,
+	ARM_INS_BFI,
+	ARM_INS_BIC,
+	ARM_INS_BKPT,
+	ARM_INS_BL,
+	ARM_INS_BLX,
+	ARM_INS_BX,
+	ARM_INS_BXJ,
+	ARM_INS_B,
+	ARM_INS_CDP,
+	ARM_INS_CDP2,
+	ARM_INS_CLREX,
+	ARM_INS_CLZ,
+	ARM_INS_CMN,
+	ARM_INS_CMP,
+	ARM_INS_CPS,
+	ARM_INS_CRC32B,
+	ARM_INS_CRC32CB,
+	ARM_INS_CRC32CH,
+	ARM_INS_CRC32CW,
+	ARM_INS_CRC32H,
+	ARM_INS_CRC32W,
+	ARM_INS_DBG,
+	ARM_INS_DMB,
+	ARM_INS_DSB,
+	ARM_INS_EOR,
+	ARM_INS_ERET,
+	ARM_INS_VMOV,
+	ARM_INS_FLDMDBX,
+	ARM_INS_FLDMIAX,
+	ARM_INS_VMRS,
+	ARM_INS_FSTMDBX,
+	ARM_INS_FSTMIAX,
+	ARM_INS_HINT,
+	ARM_INS_HLT,
+	ARM_INS_HVC,
+	ARM_INS_ISB,
+	ARM_INS_LDA,
+	ARM_INS_LDAB,
+	ARM_INS_LDAEX,
+	ARM_INS_LDAEXB,
+	ARM_INS_LDAEXD,
+	ARM_INS_LDAEXH,
+	ARM_INS_LDAH,
+	ARM_INS_LDC2L,
+	ARM_INS_LDC2,
+	ARM_INS_LDCL,
+	ARM_INS_LDC,
+	ARM_INS_LDMDA,
+	ARM_INS_LDMDB,
+	ARM_INS_LDM,
+	ARM_INS_LDMIB,
+	ARM_INS_LDRBT,
+	ARM_INS_LDRB,
+	ARM_INS_LDRD,
+	ARM_INS_LDREX,
+	ARM_INS_LDREXB,
+	ARM_INS_LDREXD,
+	ARM_INS_LDREXH,
+	ARM_INS_LDRH,
+	ARM_INS_LDRHT,
+	ARM_INS_LDRSB,
+	ARM_INS_LDRSBT,
+	ARM_INS_LDRSH,
+	ARM_INS_LDRSHT,
+	ARM_INS_LDRT,
+	ARM_INS_LDR,
+	ARM_INS_MCR,
+	ARM_INS_MCR2,
+	ARM_INS_MCRR,
+	ARM_INS_MCRR2,
+	ARM_INS_MLA,
+	ARM_INS_MLS,
+	ARM_INS_MOV,
+	ARM_INS_MOVT,
+	ARM_INS_MOVW,
+	ARM_INS_MRC,
+	ARM_INS_MRC2,
+	ARM_INS_MRRC,
+	ARM_INS_MRRC2,
+	ARM_INS_MRS,
+	ARM_INS_MSR,
+	ARM_INS_MUL,
+	ARM_INS_MVN,
+	ARM_INS_ORR,
+	ARM_INS_PKHBT,
+	ARM_INS_PKHTB,
+	ARM_INS_PLDW,
+	ARM_INS_PLD,
+	ARM_INS_PLI,
+	ARM_INS_QADD,
+	ARM_INS_QADD16,
+	ARM_INS_QADD8,
+	ARM_INS_QASX,
+	ARM_INS_QDADD,
+	ARM_INS_QDSUB,
+	ARM_INS_QSAX,
+	ARM_INS_QSUB,
+	ARM_INS_QSUB16,
+	ARM_INS_QSUB8,
+	ARM_INS_RBIT,
+	ARM_INS_REV,
+	ARM_INS_REV16,
+	ARM_INS_REVSH,
+	ARM_INS_RFEDA,
+	ARM_INS_RFEDB,
+	ARM_INS_RFEIA,
+	ARM_INS_RFEIB,
+	ARM_INS_RSB,
+	ARM_INS_RSC,
+	ARM_INS_SADD16,
+	ARM_INS_SADD8,
+	ARM_INS_SASX,
+	ARM_INS_SBC,
+	ARM_INS_SBFX,
+	ARM_INS_SDIV,
+	ARM_INS_SEL,
+	ARM_INS_SETEND,
+	ARM_INS_SHA1C,
+	ARM_INS_SHA1H,
+	ARM_INS_SHA1M,
+	ARM_INS_SHA1P,
+	ARM_INS_SHA1SU0,
+	ARM_INS_SHA1SU1,
+	ARM_INS_SHA256H,
+	ARM_INS_SHA256H2,
+	ARM_INS_SHA256SU0,
+	ARM_INS_SHA256SU1,
+	ARM_INS_SHADD16,
+	ARM_INS_SHADD8,
+	ARM_INS_SHASX,
+	ARM_INS_SHSAX,
+	ARM_INS_SHSUB16,
+	ARM_INS_SHSUB8,
+	ARM_INS_SMC,
+	ARM_INS_SMLABB,
+	ARM_INS_SMLABT,
+	ARM_INS_SMLAD,
+	ARM_INS_SMLADX,
+	ARM_INS_SMLAL,
+	ARM_INS_SMLALBB,
+	ARM_INS_SMLALBT,
+	ARM_INS_SMLALD,
+	ARM_INS_SMLALDX,
+	ARM_INS_SMLALTB,
+	ARM_INS_SMLALTT,
+	ARM_INS_SMLATB,
+	ARM_INS_SMLATT,
+	ARM_INS_SMLAWB,
+	ARM_INS_SMLAWT,
+	ARM_INS_SMLSD,
+	ARM_INS_SMLSDX,
+	ARM_INS_SMLSLD,
+	ARM_INS_SMLSLDX,
+	ARM_INS_SMMLA,
+	ARM_INS_SMMLAR,
+	ARM_INS_SMMLS,
+	ARM_INS_SMMLSR,
+	ARM_INS_SMMUL,
+	ARM_INS_SMMULR,
+	ARM_INS_SMUAD,
+	ARM_INS_SMUADX,
+	ARM_INS_SMULBB,
+	ARM_INS_SMULBT,
+	ARM_INS_SMULL,
+	ARM_INS_SMULTB,
+	ARM_INS_SMULTT,
+	ARM_INS_SMULWB,
+	ARM_INS_SMULWT,
+	ARM_INS_SMUSD,
+	ARM_INS_SMUSDX,
+	ARM_INS_SRSDA,
+	ARM_INS_SRSDB,
+	ARM_INS_SRSIA,
+	ARM_INS_SRSIB,
+	ARM_INS_SSAT,
+	ARM_INS_SSAT16,
+	ARM_INS_SSAX,
+	ARM_INS_SSUB16,
+	ARM_INS_SSUB8,
+	ARM_INS_STC2L,
+	ARM_INS_STC2,
+	ARM_INS_STCL,
+	ARM_INS_STC,
+	ARM_INS_STL,
+	ARM_INS_STLB,
+	ARM_INS_STLEX,
+	ARM_INS_STLEXB,
+	ARM_INS_STLEXD,
+	ARM_INS_STLEXH,
+	ARM_INS_STLH,
+	ARM_INS_STMDA,
+	ARM_INS_STMDB,
+	ARM_INS_STM,
+	ARM_INS_STMIB,
+	ARM_INS_STRBT,
+	ARM_INS_STRB,
+	ARM_INS_STRD,
+	ARM_INS_STREX,
+	ARM_INS_STREXB,
+	ARM_INS_STREXD,
+	ARM_INS_STREXH,
+	ARM_INS_STRH,
+	ARM_INS_STRHT,
+	ARM_INS_STRT,
+	ARM_INS_STR,
+	ARM_INS_SUB,
+	ARM_INS_SVC,
+	ARM_INS_SWP,
+	ARM_INS_SWPB,
+	ARM_INS_SXTAB,
+	ARM_INS_SXTAB16,
+	ARM_INS_SXTAH,
+	ARM_INS_SXTB,
+	ARM_INS_SXTB16,
+	ARM_INS_SXTH,
+	ARM_INS_TEQ,
+	ARM_INS_TRAP,
+	ARM_INS_TST,
+	ARM_INS_UADD16,
+	ARM_INS_UADD8,
+	ARM_INS_UASX,
+	ARM_INS_UBFX,
+	ARM_INS_UDF,
+	ARM_INS_UDIV,
+	ARM_INS_UHADD16,
+	ARM_INS_UHADD8,
+	ARM_INS_UHASX,
+	ARM_INS_UHSAX,
+	ARM_INS_UHSUB16,
+	ARM_INS_UHSUB8,
+	ARM_INS_UMAAL,
+	ARM_INS_UMLAL,
+	ARM_INS_UMULL,
+	ARM_INS_UQADD16,
+	ARM_INS_UQADD8,
+	ARM_INS_UQASX,
+	ARM_INS_UQSAX,
+	ARM_INS_UQSUB16,
+	ARM_INS_UQSUB8,
+	ARM_INS_USAD8,
+	ARM_INS_USADA8,
+	ARM_INS_USAT,
+	ARM_INS_USAT16,
+	ARM_INS_USAX,
+	ARM_INS_USUB16,
+	ARM_INS_USUB8,
+	ARM_INS_UXTAB,
+	ARM_INS_UXTAB16,
+	ARM_INS_UXTAH,
+	ARM_INS_UXTB,
+	ARM_INS_UXTB16,
+	ARM_INS_UXTH,
+	ARM_INS_VABAL,
+	ARM_INS_VABA,
+	ARM_INS_VABDL,
+	ARM_INS_VABD,
+	ARM_INS_VABS,
+	ARM_INS_VACGE,
+	ARM_INS_VACGT,
+	ARM_INS_VADD,
+	ARM_INS_VADDHN,
+	ARM_INS_VADDL,
+	ARM_INS_VADDW,
+	ARM_INS_VAND,
+	ARM_INS_VBIC,
+	ARM_INS_VBIF,
+	ARM_INS_VBIT,
+	ARM_INS_VBSL,
+	ARM_INS_VCEQ,
+	ARM_INS_VCGE,
+	ARM_INS_VCGT,
+	ARM_INS_VCLE,
+	ARM_INS_VCLS,
+	ARM_INS_VCLT,
+	ARM_INS_VCLZ,
+	ARM_INS_VCMP,
+	ARM_INS_VCMPE,
+	ARM_INS_VCNT,
+	ARM_INS_VCVTA,
+	ARM_INS_VCVTB,
+	ARM_INS_VCVT,
+	ARM_INS_VCVTM,
+	ARM_INS_VCVTN,
+	ARM_INS_VCVTP,
+	ARM_INS_VCVTT,
+	ARM_INS_VDIV,
+	ARM_INS_VDUP,
+	ARM_INS_VEOR,
+	ARM_INS_VEXT,
+	ARM_INS_VFMA,
+	ARM_INS_VFMS,
+	ARM_INS_VFNMA,
+	ARM_INS_VFNMS,
+	ARM_INS_VHADD,
+	ARM_INS_VHSUB,
+	ARM_INS_VLD1,
+	ARM_INS_VLD2,
+	ARM_INS_VLD3,
+	ARM_INS_VLD4,
+	ARM_INS_VLDMDB,
+	ARM_INS_VLDMIA,
+	ARM_INS_VLDR,
+	ARM_INS_VMAXNM,
+	ARM_INS_VMAX,
+	ARM_INS_VMINNM,
+	ARM_INS_VMIN,
+	ARM_INS_VMLA,
+	ARM_INS_VMLAL,
+	ARM_INS_VMLS,
+	ARM_INS_VMLSL,
+	ARM_INS_VMOVL,
+	ARM_INS_VMOVN,
+	ARM_INS_VMSR,
+	ARM_INS_VMUL,
+	ARM_INS_VMULL,
+	ARM_INS_VMVN,
+	ARM_INS_VNEG,
+	ARM_INS_VNMLA,
+	ARM_INS_VNMLS,
+	ARM_INS_VNMUL,
+	ARM_INS_VORN,
+	ARM_INS_VORR,
+	ARM_INS_VPADAL,
+	ARM_INS_VPADDL,
+	ARM_INS_VPADD,
+	ARM_INS_VPMAX,
+	ARM_INS_VPMIN,
+	ARM_INS_VQABS,
+	ARM_INS_VQADD,
+	ARM_INS_VQDMLAL,
+	ARM_INS_VQDMLSL,
+	ARM_INS_VQDMULH,
+	ARM_INS_VQDMULL,
+	ARM_INS_VQMOVUN,
+	ARM_INS_VQMOVN,
+	ARM_INS_VQNEG,
+	ARM_INS_VQRDMULH,
+	ARM_INS_VQRSHL,
+	ARM_INS_VQRSHRN,
+	ARM_INS_VQRSHRUN,
+	ARM_INS_VQSHL,
+	ARM_INS_VQSHLU,
+	ARM_INS_VQSHRN,
+	ARM_INS_VQSHRUN,
+	ARM_INS_VQSUB,
+	ARM_INS_VRADDHN,
+	ARM_INS_VRECPE,
+	ARM_INS_VRECPS,
+	ARM_INS_VREV16,
+	ARM_INS_VREV32,
+	ARM_INS_VREV64,
+	ARM_INS_VRHADD,
+	ARM_INS_VRINTA,
+	ARM_INS_VRINTM,
+	ARM_INS_VRINTN,
+	ARM_INS_VRINTP,
+	ARM_INS_VRINTR,
+	ARM_INS_VRINTX,
+	ARM_INS_VRINTZ,
+	ARM_INS_VRSHL,
+	ARM_INS_VRSHRN,
+	ARM_INS_VRSHR,
+	ARM_INS_VRSQRTE,
+	ARM_INS_VRSQRTS,
+	ARM_INS_VRSRA,
+	ARM_INS_VRSUBHN,
+	ARM_INS_VSELEQ,
+	ARM_INS_VSELGE,
+	ARM_INS_VSELGT,
+	ARM_INS_VSELVS,
+	ARM_INS_VSHLL,
+	ARM_INS_VSHL,
+	ARM_INS_VSHRN,
+	ARM_INS_VSHR,
+	ARM_INS_VSLI,
+	ARM_INS_VSQRT,
+	ARM_INS_VSRA,
+	ARM_INS_VSRI,
+	ARM_INS_VST1,
+	ARM_INS_VST2,
+	ARM_INS_VST3,
+	ARM_INS_VST4,
+	ARM_INS_VSTMDB,
+	ARM_INS_VSTMIA,
+	ARM_INS_VSTR,
+	ARM_INS_VSUB,
+	ARM_INS_VSUBHN,
+	ARM_INS_VSUBL,
+	ARM_INS_VSUBW,
+	ARM_INS_VSWP,
+	ARM_INS_VTBL,
+	ARM_INS_VTBX,
+	ARM_INS_VCVTR,
+	ARM_INS_VTRN,
+	ARM_INS_VTST,
+	ARM_INS_VUZP,
+	ARM_INS_VZIP,
+	ARM_INS_ADDW,
+	ARM_INS_ASR,
+	ARM_INS_DCPS1,
+	ARM_INS_DCPS2,
+	ARM_INS_DCPS3,
+	ARM_INS_IT,
+	ARM_INS_LSL,
+	ARM_INS_LSR,
+	ARM_INS_ORN,
+	ARM_INS_ROR,
+	ARM_INS_RRX,
+	ARM_INS_SUBW,
+	ARM_INS_TBB,
+	ARM_INS_TBH,
+	ARM_INS_CBNZ,
+	ARM_INS_CBZ,
+	ARM_INS_POP,
+	ARM_INS_PUSH,
+
+	// special instructions
+	ARM_INS_NOP,
+	ARM_INS_YIELD,
+	ARM_INS_WFE,
+	ARM_INS_WFI,
+	ARM_INS_SEV,
+	ARM_INS_SEVL,
+	ARM_INS_VPUSH,
+	ARM_INS_VPOP,
+
+	ARM_INS_ENDING,	// <-- mark the end of the list of instructions
+} arm_insn;
+
+/// Group of ARM instructions
+typedef enum arm_insn_group {
+	ARM_GRP_INVALID = 0, ///< = CS_GRP_INVALID
+
+	// Generic groups
+	// all jump instructions (conditional+direct+indirect jumps)
+	ARM_GRP_JUMP,	///< = CS_GRP_JUMP
+	ARM_GRP_CALL,	///< = CS_GRP_CALL
+	ARM_GRP_INT = 4, ///< = CS_GRP_INT
+	ARM_GRP_PRIVILEGE = 6, ///< = CS_GRP_PRIVILEGE
+	ARM_GRP_BRANCH_RELATIVE, ///< = CS_GRP_BRANCH_RELATIVE
+
+	// Architecture-specific groups
+	ARM_GRP_CRYPTO = 128,
+	ARM_GRP_DATABARRIER,
+	ARM_GRP_DIVIDE,
+	ARM_GRP_FPARMV8,
+	ARM_GRP_MULTPRO,
+	ARM_GRP_NEON,
+	ARM_GRP_T2EXTRACTPACK,
+	ARM_GRP_THUMB2DSP,
+	ARM_GRP_TRUSTZONE,
+	ARM_GRP_V4T,
+	ARM_GRP_V5T,
+	ARM_GRP_V5TE,
+	ARM_GRP_V6,
+	ARM_GRP_V6T2,
+	ARM_GRP_V7,
+	ARM_GRP_V8,
+	ARM_GRP_VFP2,
+	ARM_GRP_VFP3,
+	ARM_GRP_VFP4,
+	ARM_GRP_ARM,
+	ARM_GRP_MCLASS,
+	ARM_GRP_NOTMCLASS,
+	ARM_GRP_THUMB,
+	ARM_GRP_THUMB1ONLY,
+	ARM_GRP_THUMB2,
+	ARM_GRP_PREV8,
+	ARM_GRP_FPVMLX,
+	ARM_GRP_MULOPS,
+	ARM_GRP_CRC,
+	ARM_GRP_DPVFP,
+	ARM_GRP_V6M,
+	ARM_GRP_VIRTUALIZATION,
+
+	ARM_GRP_ENDING,
+} arm_insn_group;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

ai_anti_malware/capstone/include/capstone/capstone.h

@@ -0,0 +1,766 @@
+#ifndef CAPSTONE_ENGINE_H
+#define CAPSTONE_ENGINE_H
+
+/* Capstone Disassembly Engine */
+/* By Nguyen Anh Quynh <aquynh@gmail.com>, 2013-2016 */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stdarg.h>
+
+#if defined(CAPSTONE_HAS_OSXKERNEL)
+#include <libkern/libkern.h>
+#else
+#include <stdlib.h>
+#include <stdio.h>
+#endif
+
+#include "platform.h"
+
+#ifdef _MSC_VER
+#pragma warning(disable:4201)
+#pragma warning(disable:4100)
+#define CAPSTONE_API __cdecl
+#ifdef CAPSTONE_SHARED
+#define CAPSTONE_EXPORT __declspec(dllexport)
+#else    // defined(CAPSTONE_STATIC)
+#define CAPSTONE_EXPORT
+#endif
+#else
+#define CAPSTONE_API
+#if defined(__GNUC__) && !defined(CAPSTONE_STATIC)
+#define CAPSTONE_EXPORT __attribute__((visibility("default")))
+#else    // defined(CAPSTONE_STATIC)
+#define CAPSTONE_EXPORT
+#endif
+#endif
+
+#ifdef __GNUC__
+#define CAPSTONE_DEPRECATED __attribute__((deprecated))
+#elif defined(_MSC_VER)
+#define CAPSTONE_DEPRECATED __declspec(deprecated)
+#else
+#pragma message("WARNING: You need to implement CAPSTONE_DEPRECATED for this compiler")
+#define CAPSTONE_DEPRECATED
+#endif
+
+// Capstone API version
+#define CS_API_MAJOR 4
+#define CS_API_MINOR 0
+
+// Version for bleeding edge code of the Github's "next" branch.
+// Use this if you want the absolutely latest development code.
+// This version number will be bumped up whenever we have a new major change.
+#define CS_NEXT_VERSION 5
+
+// Capstone package version
+#define CS_VERSION_MAJOR CS_API_MAJOR
+#define CS_VERSION_MINOR CS_API_MINOR
+#define CS_VERSION_EXTRA 2
+
+/// Macro to create combined version which can be compared to
+/// result of cs_version() API.
+#define CS_MAKE_VERSION(major, minor) ((major << 8) + minor)
+
+/// Maximum size of an instruction mnemonic string.
+#define CS_MNEMONIC_SIZE 32
+
+// Handle using with all API
+typedef size_t csh;
+
+/// Architecture type
+typedef enum cs_arch {
+	CS_ARCH_ARM = 0,	///< ARM architecture (including Thumb, Thumb-2)
+	CS_ARCH_ARM64,		///< ARM-64, also called AArch64
+	CS_ARCH_MIPS,		///< Mips architecture
+	CS_ARCH_X86,		///< X86 architecture (including x86 & x86-64)
+	CS_ARCH_PPC,		///< PowerPC architecture
+	CS_ARCH_SPARC,		///< Sparc architecture
+	CS_ARCH_SYSZ,		///< SystemZ architecture
+	CS_ARCH_XCORE,		///< XCore architecture
+	CS_ARCH_M68K,		///< 68K architecture
+	CS_ARCH_TMS320C64X,	///< TMS320C64x architecture
+	CS_ARCH_M680X,		///< 680X architecture
+	CS_ARCH_EVM,		///< Ethereum architecture
+	CS_ARCH_MAX,
+	CS_ARCH_ALL = 0xFFFF, // All architectures - for cs_support()
+} cs_arch;
+
+// Support value to verify diet mode of the engine.
+// If cs_support(CS_SUPPORT_DIET) return True, the engine was compiled
+// in diet mode.
+#define CS_SUPPORT_DIET (CS_ARCH_ALL + 1)
+
+// Support value to verify X86 reduce mode of the engine.
+// If cs_support(CS_SUPPORT_X86_REDUCE) return True, the engine was compiled
+// in X86 reduce mode.
+#define CS_SUPPORT_X86_REDUCE (CS_ARCH_ALL + 2)
+
+/// Mode type
+typedef enum cs_mode {
+	CS_MODE_LITTLE_ENDIAN = 0,	///< little-endian mode (default mode)
+	CS_MODE_ARM = 0,	///< 32-bit ARM
+	CS_MODE_16 = 1 << 1,	///< 16-bit mode (X86)
+	CS_MODE_32 = 1 << 2,	///< 32-bit mode (X86)
+	CS_MODE_64 = 1 << 3,	///< 64-bit mode (X86, PPC)
+	CS_MODE_THUMB = 1 << 4,	///< ARM's Thumb mode, including Thumb-2
+	CS_MODE_MCLASS = 1 << 5,	///< ARM's Cortex-M series
+	CS_MODE_V8 = 1 << 6,	///< ARMv8 A32 encodings for ARM
+	CS_MODE_MICRO = 1 << 4, ///< MicroMips mode (MIPS)
+	CS_MODE_MIPS3 = 1 << 5, ///< Mips III ISA
+	CS_MODE_MIPS32R6 = 1 << 6, ///< Mips32r6 ISA
+	CS_MODE_MIPS2 = 1 << 7, ///< Mips II ISA
+	CS_MODE_V9 = 1 << 4, ///< SparcV9 mode (Sparc)
+	CS_MODE_QPX = 1 << 4, ///< Quad Processing eXtensions mode (PPC)
+	CS_MODE_M68K_000 = 1 << 1, ///< M68K 68000 mode
+	CS_MODE_M68K_010 = 1 << 2, ///< M68K 68010 mode
+	CS_MODE_M68K_020 = 1 << 3, ///< M68K 68020 mode
+	CS_MODE_M68K_030 = 1 << 4, ///< M68K 68030 mode
+	CS_MODE_M68K_040 = 1 << 5, ///< M68K 68040 mode
+	CS_MODE_M68K_060 = 1 << 6, ///< M68K 68060 mode
+	CS_MODE_BIG_ENDIAN = 1 << 31,	///< big-endian mode
+	CS_MODE_MIPS32 = CS_MODE_32,	///< Mips32 ISA (Mips)
+	CS_MODE_MIPS64 = CS_MODE_64,	///< Mips64 ISA (Mips)
+	CS_MODE_M680X_6301 = 1 << 1, ///< M680X Hitachi 6301,6303 mode
+	CS_MODE_M680X_6309 = 1 << 2, ///< M680X Hitachi 6309 mode
+	CS_MODE_M680X_6800 = 1 << 3, ///< M680X Motorola 6800,6802 mode
+	CS_MODE_M680X_6801 = 1 << 4, ///< M680X Motorola 6801,6803 mode
+	CS_MODE_M680X_6805 = 1 << 5, ///< M680X Motorola/Freescale 6805 mode
+	CS_MODE_M680X_6808 = 1 << 6, ///< M680X Motorola/Freescale/NXP 68HC08 mode
+	CS_MODE_M680X_6809 = 1 << 7, ///< M680X Motorola 6809 mode
+	CS_MODE_M680X_6811 = 1 << 8, ///< M680X Motorola/Freescale/NXP 68HC11 mode
+	CS_MODE_M680X_CPU12 = 1 << 9, ///< M680X Motorola/Freescale/NXP CPU12
+					///< used on M68HC12/HCS12
+	CS_MODE_M680X_HCS08 = 1 << 10, ///< M680X Freescale/NXP HCS08 mode
+} cs_mode;
+
+typedef void* (CAPSTONE_API *cs_malloc_t)(size_t size);
+typedef void* (CAPSTONE_API *cs_calloc_t)(size_t nmemb, size_t size);
+typedef void* (CAPSTONE_API *cs_realloc_t)(void *ptr, size_t size);
+typedef void (CAPSTONE_API *cs_free_t)(void *ptr);
+typedef int (CAPSTONE_API *cs_vsnprintf_t)(char *str, size_t size, const char *format, va_list ap);
+
+
+/// User-defined dynamic memory related functions: malloc/calloc/realloc/free/vsnprintf()
+/// By default, Capstone uses system's malloc(), calloc(), realloc(), free() & vsnprintf().
+typedef struct cs_opt_mem {
+	cs_malloc_t malloc;
+	cs_calloc_t calloc;
+	cs_realloc_t realloc;
+	cs_free_t free;
+	cs_vsnprintf_t vsnprintf;
+} cs_opt_mem;
+
+/// Customize mnemonic for instructions with alternative name.
+/// To reset existing customized instruction to its default mnemonic,
+/// call cs_option(CS_OPT_MNEMONIC) again with the same @id and NULL value
+/// for @mnemonic.
+typedef struct cs_opt_mnem {
+	/// ID of instruction to be customized.
+	unsigned int id;
+	/// Customized instruction mnemonic.
+	const char *mnemonic;
+} cs_opt_mnem;
+
+/// Runtime option for the disassembled engine
+typedef enum cs_opt_type {
+	CS_OPT_INVALID = 0,	///< No option specified
+	CS_OPT_SYNTAX,	///< Assembly output syntax
+	CS_OPT_DETAIL,	///< Break down instruction structure into details
+	CS_OPT_MODE,	///< Change engine's mode at run-time
+	CS_OPT_MEM,	///< User-defined dynamic memory related functions
+	CS_OPT_SKIPDATA, ///< Skip data when disassembling. Then engine is in SKIPDATA mode.
+	CS_OPT_SKIPDATA_SETUP, ///< Setup user-defined function for SKIPDATA option
+	CS_OPT_MNEMONIC, ///< Customize instruction mnemonic
+	CS_OPT_UNSIGNED, ///< print immediate operands in unsigned form
+} cs_opt_type;
+
+/// Runtime option value (associated with option type above)
+typedef enum cs_opt_value {
+	CS_OPT_OFF = 0,  ///< Turn OFF an option - default for CS_OPT_DETAIL, CS_OPT_SKIPDATA, CS_OPT_UNSIGNED.
+	CS_OPT_ON = 3, ///< Turn ON an option (CS_OPT_DETAIL, CS_OPT_SKIPDATA).
+	CS_OPT_SYNTAX_DEFAULT = 0, ///< Default asm syntax (CS_OPT_SYNTAX).
+	CS_OPT_SYNTAX_INTEL, ///< X86 Intel asm syntax - default on X86 (CS_OPT_SYNTAX).
+	CS_OPT_SYNTAX_ATT,   ///< X86 ATT asm syntax (CS_OPT_SYNTAX).
+	CS_OPT_SYNTAX_NOREGNAME, ///< Prints register name with only number (CS_OPT_SYNTAX)
+	CS_OPT_SYNTAX_MASM, ///< X86 Intel Masm syntax (CS_OPT_SYNTAX).
+} cs_opt_value;
+
+/// Common instruction operand types - to be consistent across all architectures.
+typedef enum cs_op_type {
+	CS_OP_INVALID = 0,  ///< uninitialized/invalid operand.
+	CS_OP_REG,          ///< Register operand.
+	CS_OP_IMM,          ///< Immediate operand.
+	CS_OP_MEM,          ///< Memory operand.
+	CS_OP_FP,           ///< Floating-Point operand.
+} cs_op_type;
+
+/// Common instruction operand access types - to be consistent across all architectures.
+/// It is possible to combine access types, for example: CS_AC_READ | CS_AC_WRITE
+typedef enum cs_ac_type {
+	CS_AC_INVALID = 0,        ///< Uninitialized/invalid access type.
+	CS_AC_READ    = 1 << 0,   ///< Operand read from memory or register.
+	CS_AC_WRITE   = 1 << 1,   ///< Operand write to memory or register.
+} cs_ac_type;
+
+/// Common instruction groups - to be consistent across all architectures.
+typedef enum cs_group_type {
+	CS_GRP_INVALID = 0,  ///< uninitialized/invalid group.
+	CS_GRP_JUMP,    ///< all jump instructions (conditional+direct+indirect jumps)
+	CS_GRP_CALL,    ///< all call instructions
+	CS_GRP_RET,     ///< all return instructions
+	CS_GRP_INT,     ///< all interrupt instructions (int+syscall)
+	CS_GRP_IRET,    ///< all interrupt return instructions
+	CS_GRP_PRIVILEGE,    ///< all privileged instructions
+	CS_GRP_BRANCH_RELATIVE, ///< all relative branching instructions
+} cs_group_type;
+
+/**
+ User-defined callback function for SKIPDATA option.
+ See tests/test_skipdata.c for sample code demonstrating this API.
+
+ @code: the input buffer containing code to be disassembled.
+        This is the same buffer passed to cs_disasm().
+ @code_size: size (in bytes) of the above @code buffer.
+ @offset: the position of the currently-examining byte in the input
+      buffer @code mentioned above.
+ @user_data: user-data passed to cs_option() via @user_data field in
+      cs_opt_skipdata struct below.
+
+ @return: return number of bytes to skip, or 0 to immediately stop disassembling.
+*/
+typedef size_t (CAPSTONE_API *cs_skipdata_cb_t)(const uint8_t *code, size_t code_size, size_t offset, void *user_data);
+
+/// User-customized setup for SKIPDATA option
+typedef struct cs_opt_skipdata {
+	/// Capstone considers data to skip as special "instructions".
+	/// User can specify the string for this instruction's "mnemonic" here.
+	/// By default (if @mnemonic is NULL), Capstone use ".byte".
+	const char *mnemonic;
+
+	/// User-defined callback function to be called when Capstone hits data.
+	/// If the returned value from this callback is positive (>0), Capstone
+	/// will skip exactly that number of bytes & continue. Otherwise, if
+	/// the callback returns 0, Capstone stops disassembling and returns
+	/// immediately from cs_disasm()
+	/// NOTE: if this callback pointer is NULL, Capstone would skip a number
+	/// of bytes depending on architectures, as following:
+	/// Arm:     2 bytes (Thumb mode) or 4 bytes.
+	/// Arm64:   4 bytes.
+	/// Mips:    4 bytes.
+	/// M680x:   1 byte.
+	/// PowerPC: 4 bytes.
+	/// Sparc:   4 bytes.
+	/// SystemZ: 2 bytes.
+	/// X86:     1 bytes.
+	/// XCore:   2 bytes.
+	/// EVM:     1 bytes.
+	cs_skipdata_cb_t callback; 	// default value is NULL
+
+	/// User-defined data to be passed to @callback function pointer.
+	void *user_data;
+} cs_opt_skipdata;
+
+
+#include "arm.h"
+#include "arm64.h"
+#include "m68k.h"
+#include "mips.h"
+#include "ppc.h"
+#include "sparc.h"
+#include "systemz.h"
+#include "x86.h"
+#include "xcore.h"
+#include "tms320c64x.h"
+#include "m680x.h"
+#include "evm.h"
+
+/// NOTE: All information in cs_detail is only available when CS_OPT_DETAIL = CS_OPT_ON
+/// Initialized as memset(., 0, offsetof(cs_detail, ARCH)+sizeof(cs_ARCH))
+/// by ARCH_getInstruction in arch/ARCH/ARCHDisassembler.c
+/// if cs_detail changes, in particular if a field is added after the union,
+/// then update arch/ARCH/ARCHDisassembler.c accordingly
+typedef struct cs_detail {
+	uint16_t regs_read[12]; ///< list of implicit registers read by this insn
+	uint8_t regs_read_count; ///< number of implicit registers read by this insn
+
+	uint16_t regs_write[20]; ///< list of implicit registers modified by this insn
+	uint8_t regs_write_count; ///< number of implicit registers modified by this insn
+
+	uint8_t groups[8]; ///< list of group this instruction belong to
+	uint8_t groups_count; ///< number of groups this insn belongs to
+
+	/// Architecture-specific instruction info
+	union {
+		cs_x86 x86;     ///< X86 architecture, including 16-bit, 32-bit & 64-bit mode
+		cs_arm64 arm64; ///< ARM64 architecture (aka AArch64)
+		cs_arm arm;     ///< ARM architecture (including Thumb/Thumb2)
+		cs_m68k m68k;   ///< M68K architecture
+		cs_mips mips;   ///< MIPS architecture
+		cs_ppc ppc;	    ///< PowerPC architecture
+		cs_sparc sparc; ///< Sparc architecture
+		cs_sysz sysz;   ///< SystemZ architecture
+		cs_xcore xcore; ///< XCore architecture
+		cs_tms320c64x tms320c64x;  ///< TMS320C64x architecture
+		cs_m680x m680x; ///< M680X architecture
+		cs_evm evm;	    ///< Ethereum architecture
+	};
+} cs_detail;
+
+/// Detail information of disassembled instruction
+typedef struct cs_insn {
+	/// Instruction ID (basically a numeric ID for the instruction mnemonic)
+	/// Find the instruction id in the '[ARCH]_insn' enum in the header file
+	/// of corresponding architecture, such as 'arm_insn' in arm.h for ARM,
+	/// 'x86_insn' in x86.h for X86, etc...
+	/// This information is available even when CS_OPT_DETAIL = CS_OPT_OFF
+	/// NOTE: in Skipdata mode, "data" instruction has 0 for this id field.
+	unsigned int id;
+
+	/// Address (EIP) of this instruction
+	/// This information is available even when CS_OPT_DETAIL = CS_OPT_OFF
+	uint64_t address;
+
+	/// Size of this instruction
+	/// This information is available even when CS_OPT_DETAIL = CS_OPT_OFF
+	uint16_t size;
+
+	/// Machine bytes of this instruction, with number of bytes indicated by @size above
+	/// This information is available even when CS_OPT_DETAIL = CS_OPT_OFF
+	uint8_t bytes[16];
+
+	/// Ascii text of instruction mnemonic
+	/// This information is available even when CS_OPT_DETAIL = CS_OPT_OFF
+	char mnemonic[CS_MNEMONIC_SIZE];
+
+	/// Ascii text of instruction operands
+	/// This information is available even when CS_OPT_DETAIL = CS_OPT_OFF
+	char op_str[160];
+
+	/// Pointer to cs_detail.
+	/// NOTE: detail pointer is only valid when both requirements below are met:
+	/// (1) CS_OP_DETAIL = CS_OPT_ON
+	/// (2) Engine is not in Skipdata mode (CS_OP_SKIPDATA option set to CS_OPT_ON)
+	///
+	/// NOTE 2: when in Skipdata mode, or when detail mode is OFF, even if this pointer
+	///     is not NULL, its content is still irrelevant.
+	cs_detail *detail;
+} cs_insn;
+
+
+/// Calculate the offset of a disassembled instruction in its buffer, given its position
+/// in its array of disassembled insn
+/// NOTE: this macro works with position (>=1), not index
+#define CS_INSN_OFFSET(insns, post) (insns[post - 1].address - insns[0].address)
+
+
+/// All type of errors encountered by Capstone API.
+/// These are values returned by cs_errno()
+typedef enum cs_err {
+	CS_ERR_OK = 0,   ///< No error: everything was fine
+	CS_ERR_MEM,      ///< Out-Of-Memory error: cs_open(), cs_disasm(), cs_disasm_iter()
+	CS_ERR_ARCH,     ///< Unsupported architecture: cs_open()
+	CS_ERR_HANDLE,   ///< Invalid handle: cs_op_count(), cs_op_index()
+	CS_ERR_CSH,      ///< Invalid csh argument: cs_close(), cs_errno(), cs_option()
+	CS_ERR_MODE,     ///< Invalid/unsupported mode: cs_open()
+	CS_ERR_OPTION,   ///< Invalid/unsupported option: cs_option()
+	CS_ERR_DETAIL,   ///< Information is unavailable because detail option is OFF
+	CS_ERR_MEMSETUP, ///< Dynamic memory management uninitialized (see CS_OPT_MEM)
+	CS_ERR_VERSION,  ///< Unsupported version (bindings)
+	CS_ERR_DIET,     ///< Access irrelevant data in "diet" engine
+	CS_ERR_SKIPDATA, ///< Access irrelevant data for "data" instruction in SKIPDATA mode
+	CS_ERR_X86_ATT,  ///< X86 AT&T syntax is unsupported (opt-out at compile time)
+	CS_ERR_X86_INTEL, ///< X86 Intel syntax is unsupported (opt-out at compile time)
+	CS_ERR_X86_MASM, ///< X86 Masm syntax is unsupported (opt-out at compile time)
+} cs_err;
+
+/**
+ Return combined API version & major and minor version numbers.
+
+ @major: major number of API version
+ @minor: minor number of API version
+
+ @return hexical number as (major << 8 | minor), which encodes both
+	 major & minor versions.
+	 NOTE: This returned value can be compared with version number made
+	 with macro CS_MAKE_VERSION
+
+ For example, second API version would return 1 in @major, and 1 in @minor
+ The return value would be 0x0101
+
+ NOTE: if you only care about returned value, but not major and minor values,
+ set both @major & @minor arguments to NULL.
+*/
+CAPSTONE_EXPORT
+unsigned int CAPSTONE_API cs_version(int *major, int *minor);
+
+
+/**
+ This API can be used to either ask for archs supported by this library,
+ or check to see if the library was compile with 'diet' option (or called
+ in 'diet' mode).
+
+ To check if a particular arch is supported by this library, set @query to
+ arch mode (CS_ARCH_* value).
+ To verify if this library supports all the archs, use CS_ARCH_ALL.
+
+ To check if this library is in 'diet' mode, set @query to CS_SUPPORT_DIET.
+
+ @return True if this library supports the given arch, or in 'diet' mode.
+*/
+CAPSTONE_EXPORT
+bool CAPSTONE_API cs_support(int query);
+
+/**
+ Initialize CS handle: this must be done before any usage of CS.
+
+ @arch: architecture type (CS_ARCH_*)
+ @mode: hardware mode. This is combined of CS_MODE_*
+ @handle: pointer to handle, which will be updated at return time
+
+ @return CS_ERR_OK on success, or other value on failure (refer to cs_err enum
+ for detailed error).
+*/
+CAPSTONE_EXPORT
+cs_err CAPSTONE_API cs_open(cs_arch arch, cs_mode mode, csh *handle);
+
+/**
+ Close CS handle: MUST do to release the handle when it is not used anymore.
+ NOTE: this must be only called when there is no longer usage of Capstone,
+ not even access to cs_insn array. The reason is the this API releases some
+ cached memory, thus access to any Capstone API after cs_close() might crash
+ your application.
+
+ In fact,this API invalidate @handle by ZERO out its value (i.e *handle = 0).
+
+ @handle: pointer to a handle returned by cs_open()
+
+ @return CS_ERR_OK on success, or other value on failure (refer to cs_err enum
+ for detailed error).
+*/
+CAPSTONE_EXPORT
+cs_err CAPSTONE_API cs_close(csh *handle);
+
+/**
+ Set option for disassembling engine at runtime
+
+ @handle: handle returned by cs_open()
+ @type: type of option to be set
+ @value: option value corresponding with @type
+
+ @return: CS_ERR_OK on success, or other value on failure.
+ Refer to cs_err enum for detailed error.
+
+ NOTE: in the case of CS_OPT_MEM, handle's value can be anything,
+ so that cs_option(handle, CS_OPT_MEM, value) can (i.e must) be called
+ even before cs_open()
+*/
+CAPSTONE_EXPORT
+cs_err CAPSTONE_API cs_option(csh handle, cs_opt_type type, size_t value);
+
+/**
+ Report the last error number when some API function fail.
+ Like glibc's errno, cs_errno might not retain its old value once accessed.
+
+ @handle: handle returned by cs_open()
+
+ @return: error code of cs_err enum type (CS_ERR_*, see above)
+*/
+CAPSTONE_EXPORT
+cs_err CAPSTONE_API cs_errno(csh handle);
+
+
+/**
+ Return a string describing given error code.
+
+ @code: error code (see CS_ERR_* above)
+
+ @return: returns a pointer to a string that describes the error code
+	passed in the argument @code
+*/
+CAPSTONE_EXPORT
+const char * CAPSTONE_API cs_strerror(cs_err code);
+
+/**
+ Disassemble binary code, given the code buffer, size, address and number
+ of instructions to be decoded.
+ This API dynamically allocate memory to contain disassembled instruction.
+ Resulting instructions will be put into @*insn
+
+ NOTE 1: this API will automatically determine memory needed to contain
+ output disassembled instructions in @insn.
+
+ NOTE 2: caller must free the allocated memory itself to avoid memory leaking.
+
+ NOTE 3: for system with scarce memory to be dynamically allocated such as
+ OS kernel or firmware, the API cs_disasm_iter() might be a better choice than
+ cs_disasm(). The reason is that with cs_disasm(), based on limited available
+ memory, we have to calculate in advance how many instructions to be disassembled,
+ which complicates things. This is especially troublesome for the case @count=0,
+ when cs_disasm() runs uncontrollably (until either end of input buffer, or
+ when it encounters an invalid instruction).
+ 
+ @handle: handle returned by cs_open()
+ @code: buffer containing raw binary code to be disassembled.
+ @code_size: size of the above code buffer.
+ @address: address of the first instruction in given raw code buffer.
+ @insn: array of instructions filled in by this API.
+	   NOTE: @insn will be allocated by this function, and should be freed
+	   with cs_free() API.
+ @count: number of instructions to be disassembled, or 0 to get all of them
+
+ @return: the number of successfully disassembled instructions,
+ or 0 if this function failed to disassemble the given code
+
+ On failure, call cs_errno() for error code.
+*/
+CAPSTONE_EXPORT
+size_t CAPSTONE_API cs_disasm(csh handle,
+		const uint8_t *code, size_t code_size,
+		uint64_t address,
+		size_t count,
+		cs_insn **insn);
+
+/**
+  Deprecated function - to be retired in the next version!
+  Use cs_disasm() instead of cs_disasm_ex()
+*/
+CAPSTONE_EXPORT
+CAPSTONE_DEPRECATED
+size_t CAPSTONE_API cs_disasm_ex(csh handle,
+		const uint8_t *code, size_t code_size,
+		uint64_t address,
+		size_t count,
+		cs_insn **insn);
+
+/**
+ Free memory allocated by cs_malloc() or cs_disasm() (argument @insn)
+
+ @insn: pointer returned by @insn argument in cs_disasm() or cs_malloc()
+ @count: number of cs_insn structures returned by cs_disasm(), or 1
+     to free memory allocated by cs_malloc().
+*/
+CAPSTONE_EXPORT
+void CAPSTONE_API cs_free(cs_insn *insn, size_t count);
+
+
+/**
+ Allocate memory for 1 instruction to be used by cs_disasm_iter().
+
+ @handle: handle returned by cs_open()
+
+ NOTE: when no longer in use, you can reclaim the memory allocated for
+ this instruction with cs_free(insn, 1)
+*/
+CAPSTONE_EXPORT
+cs_insn * CAPSTONE_API cs_malloc(csh handle);
+
+/**
+ Fast API to disassemble binary code, given the code buffer, size, address
+ and number of instructions to be decoded.
+ This API puts the resulting instruction into a given cache in @insn.
+ See tests/test_iter.c for sample code demonstrating this API.
+
+ NOTE 1: this API will update @code, @size & @address to point to the next
+ instruction in the input buffer. Therefore, it is convenient to use
+ cs_disasm_iter() inside a loop to quickly iterate all the instructions.
+ While decoding one instruction at a time can also be achieved with
+ cs_disasm(count=1), some benchmarks shown that cs_disasm_iter() can be 30%
+ faster on random input.
+
+ NOTE 2: the cache in @insn can be created with cs_malloc() API.
+
+ NOTE 3: for system with scarce memory to be dynamically allocated such as
+ OS kernel or firmware, this API is recommended over cs_disasm(), which
+ allocates memory based on the number of instructions to be disassembled.
+ The reason is that with cs_disasm(), based on limited available memory,
+ we have to calculate in advance how many instructions to be disassembled,
+ which complicates things. This is especially troublesome for the case
+ @count=0, when cs_disasm() runs uncontrollably (until either end of input
+ buffer, or when it encounters an invalid instruction).
+ 
+ @handle: handle returned by cs_open()
+ @code: buffer containing raw binary code to be disassembled
+ @size: size of above code
+ @address: address of the first insn in given raw code buffer
+ @insn: pointer to instruction to be filled in by this API.
+
+ @return: true if this API successfully decode 1 instruction,
+ or false otherwise.
+
+ On failure, call cs_errno() for error code.
+*/
+CAPSTONE_EXPORT
+bool CAPSTONE_API cs_disasm_iter(csh handle,
+	const uint8_t **code, size_t *size,
+	uint64_t *address, cs_insn *insn);
+
+/**
+ Return friendly name of register in a string.
+ Find the instruction id from header file of corresponding architecture (arm.h for ARM,
+ x86.h for X86, ...)
+
+ WARN: when in 'diet' mode, this API is irrelevant because engine does not
+ store register name.
+
+ @handle: handle returned by cs_open()
+ @reg_id: register id
+
+ @return: string name of the register, or NULL if @reg_id is invalid.
+*/
+CAPSTONE_EXPORT
+const char * CAPSTONE_API cs_reg_name(csh handle, unsigned int reg_id);
+
+/**
+ Return friendly name of an instruction in a string.
+ Find the instruction id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+
+ WARN: when in 'diet' mode, this API is irrelevant because the engine does not
+ store instruction name.
+
+ @handle: handle returned by cs_open()
+ @insn_id: instruction id
+
+ @return: string name of the instruction, or NULL if @insn_id is invalid.
+*/
+CAPSTONE_EXPORT
+const char * CAPSTONE_API cs_insn_name(csh handle, unsigned int insn_id);
+
+/**
+ Return friendly name of a group id (that an instruction can belong to)
+ Find the group id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+
+ WARN: when in 'diet' mode, this API is irrelevant because the engine does not
+ store group name.
+
+ @handle: handle returned by cs_open()
+ @group_id: group id
+
+ @return: string name of the group, or NULL if @group_id is invalid.
+*/
+CAPSTONE_EXPORT
+const char * CAPSTONE_API cs_group_name(csh handle, unsigned int group_id);
+
+/**
+ Check if a disassembled instruction belong to a particular group.
+ Find the group id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+ Internally, this simply verifies if @group_id matches any member of insn->groups array.
+
+ NOTE: this API is only valid when detail option is ON (which is OFF by default).
+
+ WARN: when in 'diet' mode, this API is irrelevant because the engine does not
+ update @groups array.
+
+ @handle: handle returned by cs_open()
+ @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
+ @group_id: group that you want to check if this instruction belong to.
+
+ @return: true if this instruction indeed belongs to the given group, or false otherwise.
+*/
+CAPSTONE_EXPORT
+bool CAPSTONE_API cs_insn_group(csh handle, const cs_insn *insn, unsigned int group_id);
+
+/**
+ Check if a disassembled instruction IMPLICITLY used a particular register.
+ Find the register id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+ Internally, this simply verifies if @reg_id matches any member of insn->regs_read array.
+
+ NOTE: this API is only valid when detail option is ON (which is OFF by default)
+
+ WARN: when in 'diet' mode, this API is irrelevant because the engine does not
+ update @regs_read array.
+
+ @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
+ @reg_id: register that you want to check if this instruction used it.
+
+ @return: true if this instruction indeed implicitly used the given register, or false otherwise.
+*/
+CAPSTONE_EXPORT
+bool CAPSTONE_API cs_reg_read(csh handle, const cs_insn *insn, unsigned int reg_id);
+
+/**
+ Check if a disassembled instruction IMPLICITLY modified a particular register.
+ Find the register id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+ Internally, this simply verifies if @reg_id matches any member of insn->regs_write array.
+
+ NOTE: this API is only valid when detail option is ON (which is OFF by default)
+
+ WARN: when in 'diet' mode, this API is irrelevant because the engine does not
+ update @regs_write array.
+
+ @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
+ @reg_id: register that you want to check if this instruction modified it.
+
+ @return: true if this instruction indeed implicitly modified the given register, or false otherwise.
+*/
+CAPSTONE_EXPORT
+bool CAPSTONE_API cs_reg_write(csh handle, const cs_insn *insn, unsigned int reg_id);
+
+/**
+ Count the number of operands of a given type.
+ Find the operand type in header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+
+ NOTE: this API is only valid when detail option is ON (which is OFF by default)
+
+ @handle: handle returned by cs_open()
+ @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
+ @op_type: Operand type to be found.
+
+ @return: number of operands of given type @op_type in instruction @insn,
+ or -1 on failure.
+*/
+CAPSTONE_EXPORT
+int CAPSTONE_API cs_op_count(csh handle, const cs_insn *insn, unsigned int op_type);
+
+/**
+ Retrieve the position of operand of given type in <arch>.operands[] array.
+ Later, the operand can be accessed using the returned position.
+ Find the operand type in header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+
+ NOTE: this API is only valid when detail option is ON (which is OFF by default)
+
+ @handle: handle returned by cs_open()
+ @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
+ @op_type: Operand type to be found.
+ @position: position of the operand to be found. This must be in the range
+			[1, cs_op_count(handle, insn, op_type)]
+
+ @return: index of operand of given type @op_type in <arch>.operands[] array
+ in instruction @insn, or -1 on failure.
+*/
+CAPSTONE_EXPORT
+int CAPSTONE_API cs_op_index(csh handle, const cs_insn *insn, unsigned int op_type,
+		unsigned int position);
+
+/// Type of array to keep the list of registers
+typedef uint16_t cs_regs[64];
+
+/**
+ Retrieve all the registers accessed by an instruction, either explicitly or
+ implicitly.
+
+ WARN: when in 'diet' mode, this API is irrelevant because engine does not
+ store registers.
+
+ @handle: handle returned by cs_open()
+ @insn: disassembled instruction structure returned from cs_disasm() or cs_disasm_iter()
+ @regs_read: on return, this array contains all registers read by instruction.
+ @regs_read_count: number of registers kept inside @regs_read array.
+ @regs_write: on return, this array contains all registers written by instruction.
+ @regs_write_count: number of registers kept inside @regs_write array.
+
+ @return CS_ERR_OK on success, or other value on failure (refer to cs_err enum
+ for detailed error).
+*/
+CAPSTONE_EXPORT
+cs_err CAPSTONE_API cs_regs_access(csh handle, const cs_insn *insn,
+		cs_regs regs_read, uint8_t *regs_read_count,
+		cs_regs regs_write, uint8_t *regs_write_count);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

ai_anti_malware/capstone/include/capstone/evm.h

@@ -0,0 +1,188 @@
+#ifndef CAPSTONE_EVM_H
+#define CAPSTONE_EVM_H
+
+/* Capstone Disassembly Engine */
+/* By Nguyen Anh Quynh <aquynh@gmail.com>, 2013-2018 */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "platform.h"
+
+#ifdef _MSC_VER
+#pragma warning(disable:4201)
+#endif
+
+/// Instruction structure
+typedef struct cs_evm {
+    unsigned char pop;    ///< number of items popped from the stack
+    unsigned char push;   ///< number of items pushed into the stack
+    unsigned int  fee;    ///< gas fee for the instruction
+} cs_evm;
+
+/// EVM instruction
+typedef enum evm_insn {
+	EVM_INS_STOP = 0,
+	EVM_INS_ADD = 1,
+	EVM_INS_MUL = 2,
+	EVM_INS_SUB = 3,
+	EVM_INS_DIV = 4,
+	EVM_INS_SDIV = 5,
+	EVM_INS_MOD = 6,
+	EVM_INS_SMOD = 7,
+	EVM_INS_ADDMOD = 8,
+	EVM_INS_MULMOD = 9,
+	EVM_INS_EXP = 10,
+	EVM_INS_SIGNEXTEND = 11,
+	EVM_INS_LT = 16,
+	EVM_INS_GT = 17,
+	EVM_INS_SLT = 18,
+	EVM_INS_SGT = 19,
+	EVM_INS_EQ = 20,
+	EVM_INS_ISZERO = 21,
+	EVM_INS_AND = 22,
+	EVM_INS_OR = 23,
+	EVM_INS_XOR = 24,
+	EVM_INS_NOT = 25,
+	EVM_INS_BYTE = 26,
+	EVM_INS_SHA3 = 32,
+	EVM_INS_ADDRESS = 48,
+	EVM_INS_BALANCE = 49,
+	EVM_INS_ORIGIN = 50,
+	EVM_INS_CALLER = 51,
+	EVM_INS_CALLVALUE = 52,
+	EVM_INS_CALLDATALOAD = 53,
+	EVM_INS_CALLDATASIZE = 54,
+	EVM_INS_CALLDATACOPY = 55,
+	EVM_INS_CODESIZE = 56,
+	EVM_INS_CODECOPY = 57,
+	EVM_INS_GASPRICE = 58,
+	EVM_INS_EXTCODESIZE = 59,
+	EVM_INS_EXTCODECOPY = 60,
+	EVM_INS_RETURNDATASIZE = 61,
+	EVM_INS_RETURNDATACOPY = 62,
+	EVM_INS_BLOCKHASH = 64,
+	EVM_INS_COINBASE = 65,
+	EVM_INS_TIMESTAMP = 66,
+	EVM_INS_NUMBER = 67,
+	EVM_INS_DIFFICULTY = 68,
+	EVM_INS_GASLIMIT = 69,
+	EVM_INS_POP = 80,
+	EVM_INS_MLOAD = 81,
+	EVM_INS_MSTORE = 82,
+	EVM_INS_MSTORE8 = 83,
+	EVM_INS_SLOAD = 84,
+	EVM_INS_SSTORE = 85,
+	EVM_INS_JUMP = 86,
+	EVM_INS_JUMPI = 87,
+	EVM_INS_PC = 88,
+	EVM_INS_MSIZE = 89,
+	EVM_INS_GAS = 90,
+	EVM_INS_JUMPDEST = 91,
+	EVM_INS_PUSH1 = 96,
+	EVM_INS_PUSH2 = 97,
+	EVM_INS_PUSH3 = 98,
+	EVM_INS_PUSH4 = 99,
+	EVM_INS_PUSH5 = 100,
+	EVM_INS_PUSH6 = 101,
+	EVM_INS_PUSH7 = 102,
+	EVM_INS_PUSH8 = 103,
+	EVM_INS_PUSH9 = 104,
+	EVM_INS_PUSH10 = 105,
+	EVM_INS_PUSH11 = 106,
+	EVM_INS_PUSH12 = 107,
+	EVM_INS_PUSH13 = 108,
+	EVM_INS_PUSH14 = 109,
+	EVM_INS_PUSH15 = 110,
+	EVM_INS_PUSH16 = 111,
+	EVM_INS_PUSH17 = 112,
+	EVM_INS_PUSH18 = 113,
+	EVM_INS_PUSH19 = 114,
+	EVM_INS_PUSH20 = 115,
+	EVM_INS_PUSH21 = 116,
+	EVM_INS_PUSH22 = 117,
+	EVM_INS_PUSH23 = 118,
+	EVM_INS_PUSH24 = 119,
+	EVM_INS_PUSH25 = 120,
+	EVM_INS_PUSH26 = 121,
+	EVM_INS_PUSH27 = 122,
+	EVM_INS_PUSH28 = 123,
+	EVM_INS_PUSH29 = 124,
+	EVM_INS_PUSH30 = 125,
+	EVM_INS_PUSH31 = 126,
+	EVM_INS_PUSH32 = 127,
+	EVM_INS_DUP1 = 128,
+	EVM_INS_DUP2 = 129,
+	EVM_INS_DUP3 = 130,
+	EVM_INS_DUP4 = 131,
+	EVM_INS_DUP5 = 132,
+	EVM_INS_DUP6 = 133,
+	EVM_INS_DUP7 = 134,
+	EVM_INS_DUP8 = 135,
+	EVM_INS_DUP9 = 136,
+	EVM_INS_DUP10 = 137,
+	EVM_INS_DUP11 = 138,
+	EVM_INS_DUP12 = 139,
+	EVM_INS_DUP13 = 140,
+	EVM_INS_DUP14 = 141,
+	EVM_INS_DUP15 = 142,
+	EVM_INS_DUP16 = 143,
+	EVM_INS_SWAP1 = 144,
+	EVM_INS_SWAP2 = 145,
+	EVM_INS_SWAP3 = 146,
+	EVM_INS_SWAP4 = 147,
+	EVM_INS_SWAP5 = 148,
+	EVM_INS_SWAP6 = 149,
+	EVM_INS_SWAP7 = 150,
+	EVM_INS_SWAP8 = 151,
+	EVM_INS_SWAP9 = 152,
+	EVM_INS_SWAP10 = 153,
+	EVM_INS_SWAP11 = 154,
+	EVM_INS_SWAP12 = 155,
+	EVM_INS_SWAP13 = 156,
+	EVM_INS_SWAP14 = 157,
+	EVM_INS_SWAP15 = 158,
+	EVM_INS_SWAP16 = 159,
+	EVM_INS_LOG0 = 160,
+	EVM_INS_LOG1 = 161,
+	EVM_INS_LOG2 = 162,
+	EVM_INS_LOG3 = 163,
+	EVM_INS_LOG4 = 164,
+	EVM_INS_CREATE = 240,
+	EVM_INS_CALL = 241,
+	EVM_INS_CALLCODE = 242,
+	EVM_INS_RETURN = 243,
+	EVM_INS_DELEGATECALL = 244,
+	EVM_INS_CALLBLACKBOX = 245,
+	EVM_INS_STATICCALL = 250,
+	EVM_INS_REVERT = 253,
+	EVM_INS_SUICIDE = 255,
+
+	EVM_INS_INVALID = 512,
+	EVM_INS_ENDING,   // <-- mark the end of the list of instructions
+} evm_insn;
+
+/// Group of EVM instructions
+typedef enum evm_insn_group {
+	EVM_GRP_INVALID = 0, ///< = CS_GRP_INVALID
+
+	EVM_GRP_JUMP,          ///< all jump instructions
+
+	EVM_GRP_MATH = 8,      ///< math instructions
+	EVM_GRP_STACK_WRITE,   ///< instructions write to stack
+	EVM_GRP_STACK_READ,    ///< instructions read from stack
+	EVM_GRP_MEM_WRITE,     ///< instructions write to memory
+	EVM_GRP_MEM_READ,      ///< instructions read from memory
+	EVM_GRP_STORE_WRITE,   ///< instructions write to storage
+	EVM_GRP_STORE_READ,    ///< instructions read from storage
+	EVM_GRP_HALT,    ///< instructions halt execution
+
+	EVM_GRP_ENDING,   ///< <-- mark the end of the list of groups
+} evm_insn_group;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

ai_anti_malware/capstone/include/capstone/m680x.h

@@ -0,0 +1,537 @@
+#ifndef CAPSTONE_M680X_H
+#define CAPSTONE_M680X_H
+
+/* Capstone Disassembly Engine */
+/* M680X Backend by Wolfgang Schwotzer <wolfgang.schwotzer@gmx.net> 2017 */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "platform.h"
+
+#ifdef _MSC_VER
+#pragma warning(disable:4201)
+#endif
+
+#define M680X_OPERAND_COUNT 9
+
+/// M680X registers and special registers
+typedef enum m680x_reg {
+	M680X_REG_INVALID = 0,
+
+	M680X_REG_A, ///< M6800/1/2/3/9, HD6301/9
+	M680X_REG_B, ///< M6800/1/2/3/9, HD6301/9
+	M680X_REG_E, ///< HD6309
+	M680X_REG_F, ///< HD6309
+	M680X_REG_0, ///< HD6309
+
+	M680X_REG_D, ///< M6801/3/9, HD6301/9
+	M680X_REG_W, ///< HD6309
+
+	M680X_REG_CC, ///< M6800/1/2/3/9, M6301/9
+	M680X_REG_DP, ///< M6809/M6309
+	M680X_REG_MD, ///< M6309
+
+	M680X_REG_HX, ///< M6808
+	M680X_REG_H, ///< M6808
+	M680X_REG_X, ///< M6800/1/2/3/9, M6301/9
+	M680X_REG_Y, ///< M6809/M6309
+	M680X_REG_S, ///< M6809/M6309
+	M680X_REG_U, ///< M6809/M6309
+	M680X_REG_V, ///< M6309
+
+	M680X_REG_Q, ///< M6309
+
+	M680X_REG_PC, ///< M6800/1/2/3/9, M6301/9
+
+	M680X_REG_TMP2, ///< CPU12
+	M680X_REG_TMP3, ///< CPU12
+
+	M680X_REG_ENDING,   ///< <-- mark the end of the list of registers
+} m680x_reg;
+
+/// Operand type for instruction's operands
+typedef enum m680x_op_type {
+	M680X_OP_INVALID = 0, ///< = CS_OP_INVALID (Uninitialized).
+	M680X_OP_REGISTER,    ///< = Register operand.
+	M680X_OP_IMMEDIATE,   ///< = Immediate operand.
+	M680X_OP_INDEXED,     ///< = Indexed addressing operand.
+	M680X_OP_EXTENDED,    ///< = Extended addressing operand.
+	M680X_OP_DIRECT,      ///< = Direct addressing operand.
+	M680X_OP_RELATIVE,    ///< = Relative addressing operand.
+	M680X_OP_CONSTANT,    ///< = constant operand (Displayed as number only).
+				///< Used e.g. for a bit index or page number.
+} m680x_op_type;
+
+// Supported bit values for mem.idx.offset_bits
+#define M680X_OFFSET_NONE      0
+#define M680X_OFFSET_BITS_5    5
+#define M680X_OFFSET_BITS_8    8
+#define M680X_OFFSET_BITS_9    9
+#define M680X_OFFSET_BITS_16  16
+
+// Supported bit flags for mem.idx.flags
+// These flags can be combined
+#define M680X_IDX_INDIRECT     1
+#define M680X_IDX_NO_COMMA     2
+#define M680X_IDX_POST_INC_DEC 4
+
+/// Instruction's operand referring to indexed addressing
+typedef struct m680x_op_idx {
+	m680x_reg base_reg;	///< base register (or M680X_REG_INVALID if
+				///< irrelevant)
+	m680x_reg offset_reg;	///< offset register (or M680X_REG_INVALID if
+				///< irrelevant)
+	int16_t offset;		///< 5-,8- or 16-bit offset. See also offset_bits.
+	uint16_t offset_addr;	///< = offset addr. if base_reg == M680X_REG_PC.
+				///< calculated as offset + PC
+	uint8_t offset_bits;	///< offset width in bits for indexed addressing
+	int8_t inc_dec;		///< inc. or dec. value:
+				///<    0: no inc-/decrement
+				///<    1 .. 8: increment by 1 .. 8
+				///<    -1 .. -8: decrement by 1 .. 8
+				///< if flag M680X_IDX_POST_INC_DEC set it is post
+				///< inc-/decrement otherwise pre inc-/decrement
+	uint8_t flags;		///< 8-bit flags (see above)
+} m680x_op_idx;
+
+/// Instruction's memory operand referring to relative addressing (Bcc/LBcc)
+typedef struct m680x_op_rel {
+	uint16_t address;	///< The absolute address.
+				///< calculated as PC + offset. PC is the first
+				///< address after the instruction.
+	int16_t offset;		///< the offset/displacement value
+} m680x_op_rel;
+
+/// Instruction's operand referring to extended addressing
+typedef struct m680x_op_ext {
+	uint16_t address;      ///< The absolute address
+	bool indirect;         ///< true if extended indirect addressing
+} m680x_op_ext;
+
+/// Instruction operand
+typedef struct cs_m680x_op {
+	m680x_op_type type;
+	union {
+		int32_t imm;		///< immediate value for IMM operand
+		m680x_reg reg;		///< register value for REG operand
+		m680x_op_idx idx;	///< Indexed addressing operand
+		m680x_op_rel rel;	///< Relative address. operand (Bcc/LBcc)
+		m680x_op_ext ext;	///< Extended address
+		uint8_t direct_addr;	///<</ Direct address (lower 8-bit)
+		uint8_t const_val;	///< constant value (bit index, page nr.)
+	};
+	uint8_t size;			///< size of this operand (in bytes)
+	/// How is this operand accessed? (READ, WRITE or READ|WRITE)
+	/// This field is combined of cs_ac_type.
+	/// NOTE: this field is irrelevant if engine is compiled in DIET 
+	uint8_t access;
+} cs_m680x_op;
+
+/// Group of M680X instructions
+typedef enum m680x_group_type {
+	M680X_GRP_INVALID = 0,	/// = CS_GRP_INVALID
+	// Generic groups
+	// all jump instructions (conditional+direct+indirect jumps)
+	M680X_GRP_JUMP,		///< = CS_GRP_JUMP
+	// all call instructions
+	M680X_GRP_CALL,		///< = CS_GRP_CALL
+	// all return instructions
+	M680X_GRP_RET,		///< = CS_GRP_RET
+	// all interrupt instructions (int+syscall)
+	M680X_GRP_INT,		///< = CS_GRP_INT
+	// all interrupt return instructions
+	M680X_GRP_IRET,		///< = CS_GRP_IRET
+	// all privileged instructions
+	M680X_GRP_PRIV,		///< = CS_GRP_PRIVILEDGE; not used
+	// all relative branching instructions
+	M680X_GRP_BRAREL,	///< = CS_GRP_BRANCH_RELATIVE
+
+	// Architecture-specific groups
+	M680X_GRP_ENDING,	// <-- mark the end of the list of groups
+} m680x_group_type;
+
+// M680X instruction flags:
+
+/// The first (register) operand is part of the
+/// instruction mnemonic
+#define M680X_FIRST_OP_IN_MNEM    1
+/// The second (register) operand is part of the
+/// instruction mnemonic
+#define M680X_SECOND_OP_IN_MNEM   2
+
+/// The M680X instruction and it's operands
+typedef struct cs_m680x {
+	uint8_t flags;		///< See: M680X instruction flags
+	uint8_t op_count;	///< number of operands for the instruction or 0
+	cs_m680x_op operands[M680X_OPERAND_COUNT]; ///< operands for this insn.
+} cs_m680x;
+
+/// M680X instruction IDs
+typedef enum m680x_insn {
+	M680X_INS_INVLD = 0,
+	M680X_INS_ABA, ///< M6800/1/2/3
+	M680X_INS_ABX,
+	M680X_INS_ABY,
+	M680X_INS_ADC,
+	M680X_INS_ADCA,
+	M680X_INS_ADCB,
+	M680X_INS_ADCD,
+	M680X_INS_ADCR,
+	M680X_INS_ADD,
+	M680X_INS_ADDA,
+	M680X_INS_ADDB,
+	M680X_INS_ADDD,
+	M680X_INS_ADDE,
+	M680X_INS_ADDF,
+	M680X_INS_ADDR,
+	M680X_INS_ADDW,
+	M680X_INS_AIM,
+	M680X_INS_AIS,
+	M680X_INS_AIX,
+	M680X_INS_AND,
+	M680X_INS_ANDA,
+	M680X_INS_ANDB,
+	M680X_INS_ANDCC,
+	M680X_INS_ANDD,
+	M680X_INS_ANDR,
+	M680X_INS_ASL,
+	M680X_INS_ASLA,
+	M680X_INS_ASLB,
+	M680X_INS_ASLD, ///< or LSLD
+	M680X_INS_ASR,
+	M680X_INS_ASRA,
+	M680X_INS_ASRB,
+	M680X_INS_ASRD,
+	M680X_INS_ASRX,
+	M680X_INS_BAND,
+	M680X_INS_BCC, ///< or BHS
+	M680X_INS_BCLR,
+	M680X_INS_BCS, ///< or BLO
+	M680X_INS_BEOR,
+	M680X_INS_BEQ,
+	M680X_INS_BGE,
+	M680X_INS_BGND,
+	M680X_INS_BGT,
+	M680X_INS_BHCC,
+	M680X_INS_BHCS,
+	M680X_INS_BHI,
+	M680X_INS_BIAND,
+	M680X_INS_BIEOR,
+	M680X_INS_BIH,
+	M680X_INS_BIL,
+	M680X_INS_BIOR,
+	M680X_INS_BIT,
+	M680X_INS_BITA,
+	M680X_INS_BITB,
+	M680X_INS_BITD,
+	M680X_INS_BITMD,
+	M680X_INS_BLE,
+	M680X_INS_BLS,
+	M680X_INS_BLT,
+	M680X_INS_BMC,
+	M680X_INS_BMI,
+	M680X_INS_BMS,
+	M680X_INS_BNE,
+	M680X_INS_BOR,
+	M680X_INS_BPL,
+	M680X_INS_BRCLR,
+	M680X_INS_BRSET,
+	M680X_INS_BRA,
+	M680X_INS_BRN,
+	M680X_INS_BSET,
+	M680X_INS_BSR,
+	M680X_INS_BVC,
+	M680X_INS_BVS,
+	M680X_INS_CALL,
+	M680X_INS_CBA, ///< M6800/1/2/3
+	M680X_INS_CBEQ,
+	M680X_INS_CBEQA,
+	M680X_INS_CBEQX,
+	M680X_INS_CLC, ///< M6800/1/2/3
+	M680X_INS_CLI, ///< M6800/1/2/3
+	M680X_INS_CLR,
+	M680X_INS_CLRA,
+	M680X_INS_CLRB,
+	M680X_INS_CLRD,
+	M680X_INS_CLRE,
+	M680X_INS_CLRF,
+	M680X_INS_CLRH,
+	M680X_INS_CLRW,
+	M680X_INS_CLRX,
+	M680X_INS_CLV, ///< M6800/1/2/3
+	M680X_INS_CMP,
+	M680X_INS_CMPA,
+	M680X_INS_CMPB,
+	M680X_INS_CMPD,
+	M680X_INS_CMPE,
+	M680X_INS_CMPF,
+	M680X_INS_CMPR,
+	M680X_INS_CMPS,
+	M680X_INS_CMPU,
+	M680X_INS_CMPW,
+	M680X_INS_CMPX,
+	M680X_INS_CMPY,
+	M680X_INS_COM,
+	M680X_INS_COMA,
+	M680X_INS_COMB,
+	M680X_INS_COMD,
+	M680X_INS_COME,
+	M680X_INS_COMF,
+	M680X_INS_COMW,
+	M680X_INS_COMX,
+	M680X_INS_CPD,
+	M680X_INS_CPHX,
+	M680X_INS_CPS,
+	M680X_INS_CPX, ///< M6800/1/2/3
+	M680X_INS_CPY,
+	M680X_INS_CWAI,
+	M680X_INS_DAA,
+	M680X_INS_DBEQ,
+	M680X_INS_DBNE,
+	M680X_INS_DBNZ,
+	M680X_INS_DBNZA,
+	M680X_INS_DBNZX,
+	M680X_INS_DEC,
+	M680X_INS_DECA,
+	M680X_INS_DECB,
+	M680X_INS_DECD,
+	M680X_INS_DECE,
+	M680X_INS_DECF,
+	M680X_INS_DECW,
+	M680X_INS_DECX,
+	M680X_INS_DES, ///< M6800/1/2/3
+	M680X_INS_DEX, ///< M6800/1/2/3
+	M680X_INS_DEY,
+	M680X_INS_DIV,
+	M680X_INS_DIVD,
+	M680X_INS_DIVQ,
+	M680X_INS_EDIV,
+	M680X_INS_EDIVS,
+	M680X_INS_EIM,
+	M680X_INS_EMACS,
+	M680X_INS_EMAXD,
+	M680X_INS_EMAXM,
+	M680X_INS_EMIND,
+	M680X_INS_EMINM,
+	M680X_INS_EMUL,
+	M680X_INS_EMULS,
+	M680X_INS_EOR,
+	M680X_INS_EORA,
+	M680X_INS_EORB,
+	M680X_INS_EORD,
+	M680X_INS_EORR,
+	M680X_INS_ETBL,
+	M680X_INS_EXG,
+	M680X_INS_FDIV,
+	M680X_INS_IBEQ,
+	M680X_INS_IBNE,
+	M680X_INS_IDIV,
+	M680X_INS_IDIVS,
+	M680X_INS_ILLGL,
+	M680X_INS_INC,
+	M680X_INS_INCA,
+	M680X_INS_INCB,
+	M680X_INS_INCD,
+	M680X_INS_INCE,
+	M680X_INS_INCF,
+	M680X_INS_INCW,
+	M680X_INS_INCX,
+	M680X_INS_INS, ///< M6800/1/2/3
+	M680X_INS_INX, ///< M6800/1/2/3
+	M680X_INS_INY,
+	M680X_INS_JMP,
+	M680X_INS_JSR,
+	M680X_INS_LBCC, ///< or LBHS
+	M680X_INS_LBCS, ///< or LBLO
+	M680X_INS_LBEQ,
+	M680X_INS_LBGE,
+	M680X_INS_LBGT,
+	M680X_INS_LBHI,
+	M680X_INS_LBLE,
+	M680X_INS_LBLS,
+	M680X_INS_LBLT,
+	M680X_INS_LBMI,
+	M680X_INS_LBNE,
+	M680X_INS_LBPL,
+	M680X_INS_LBRA,
+	M680X_INS_LBRN,
+	M680X_INS_LBSR,
+	M680X_INS_LBVC,
+	M680X_INS_LBVS,
+	M680X_INS_LDA,
+	M680X_INS_LDAA, ///< M6800/1/2/3
+	M680X_INS_LDAB, ///< M6800/1/2/3
+	M680X_INS_LDB,
+	M680X_INS_LDBT,
+	M680X_INS_LDD,
+	M680X_INS_LDE,
+	M680X_INS_LDF,
+	M680X_INS_LDHX,
+	M680X_INS_LDMD,
+	M680X_INS_LDQ,
+	M680X_INS_LDS,
+	M680X_INS_LDU,
+	M680X_INS_LDW,
+	M680X_INS_LDX,
+	M680X_INS_LDY,
+	M680X_INS_LEAS,
+	M680X_INS_LEAU,
+	M680X_INS_LEAX,
+	M680X_INS_LEAY,
+	M680X_INS_LSL,
+	M680X_INS_LSLA,
+	M680X_INS_LSLB,
+	M680X_INS_LSLD,
+	M680X_INS_LSLX,
+	M680X_INS_LSR,
+	M680X_INS_LSRA,
+	M680X_INS_LSRB,
+	M680X_INS_LSRD, ///< or ASRD
+	M680X_INS_LSRW,
+	M680X_INS_LSRX,
+	M680X_INS_MAXA,
+	M680X_INS_MAXM,
+	M680X_INS_MEM,
+	M680X_INS_MINA,
+	M680X_INS_MINM,
+	M680X_INS_MOV,
+	M680X_INS_MOVB,
+	M680X_INS_MOVW,
+	M680X_INS_MUL,
+	M680X_INS_MULD,
+	M680X_INS_NEG,
+	M680X_INS_NEGA,
+	M680X_INS_NEGB,
+	M680X_INS_NEGD,
+	M680X_INS_NEGX,
+	M680X_INS_NOP,
+	M680X_INS_NSA,
+	M680X_INS_OIM,
+	M680X_INS_ORA,
+	M680X_INS_ORAA, ///< M6800/1/2/3
+	M680X_INS_ORAB, ///< M6800/1/2/3
+	M680X_INS_ORB,
+	M680X_INS_ORCC,
+	M680X_INS_ORD,
+	M680X_INS_ORR,
+	M680X_INS_PSHA, ///< M6800/1/2/3
+	M680X_INS_PSHB, ///< M6800/1/2/3
+	M680X_INS_PSHC,
+	M680X_INS_PSHD,
+	M680X_INS_PSHH,
+	M680X_INS_PSHS,
+	M680X_INS_PSHSW,
+	M680X_INS_PSHU,
+	M680X_INS_PSHUW,
+	M680X_INS_PSHX, ///< M6800/1/2/3
+	M680X_INS_PSHY,
+	M680X_INS_PULA, ///< M6800/1/2/3
+	M680X_INS_PULB, ///< M6800/1/2/3
+	M680X_INS_PULC,
+	M680X_INS_PULD,
+	M680X_INS_PULH,
+	M680X_INS_PULS,
+	M680X_INS_PULSW,
+	M680X_INS_PULU,
+	M680X_INS_PULUW,
+	M680X_INS_PULX, ///< M6800/1/2/3
+	M680X_INS_PULY,
+	M680X_INS_REV,
+	M680X_INS_REVW,
+	M680X_INS_ROL,
+	M680X_INS_ROLA,
+	M680X_INS_ROLB,
+	M680X_INS_ROLD,
+	M680X_INS_ROLW,
+	M680X_INS_ROLX,
+	M680X_INS_ROR,
+	M680X_INS_RORA,
+	M680X_INS_RORB,
+	M680X_INS_RORD,
+	M680X_INS_RORW,
+	M680X_INS_RORX,
+	M680X_INS_RSP,
+	M680X_INS_RTC,
+	M680X_INS_RTI,
+	M680X_INS_RTS,
+	M680X_INS_SBA, ///< M6800/1/2/3
+	M680X_INS_SBC,
+	M680X_INS_SBCA,
+	M680X_INS_SBCB,
+	M680X_INS_SBCD,
+	M680X_INS_SBCR,
+	M680X_INS_SEC,
+	M680X_INS_SEI,
+	M680X_INS_SEV,
+	M680X_INS_SEX,
+	M680X_INS_SEXW,
+	M680X_INS_SLP,
+	M680X_INS_STA,
+	M680X_INS_STAA, ///< M6800/1/2/3
+	M680X_INS_STAB, ///< M6800/1/2/3
+	M680X_INS_STB,
+	M680X_INS_STBT,
+	M680X_INS_STD,
+	M680X_INS_STE,
+	M680X_INS_STF,
+	M680X_INS_STOP,
+	M680X_INS_STHX,
+	M680X_INS_STQ,
+	M680X_INS_STS,
+	M680X_INS_STU,
+	M680X_INS_STW,
+	M680X_INS_STX,
+	M680X_INS_STY,
+	M680X_INS_SUB,
+	M680X_INS_SUBA,
+	M680X_INS_SUBB,
+	M680X_INS_SUBD,
+	M680X_INS_SUBE,
+	M680X_INS_SUBF,
+	M680X_INS_SUBR,
+	M680X_INS_SUBW,
+	M680X_INS_SWI,
+	M680X_INS_SWI2,
+	M680X_INS_SWI3,
+	M680X_INS_SYNC,
+	M680X_INS_TAB, ///< M6800/1/2/3
+	M680X_INS_TAP, ///< M6800/1/2/3
+	M680X_INS_TAX,
+	M680X_INS_TBA, ///< M6800/1/2/3
+	M680X_INS_TBEQ,
+	M680X_INS_TBL,
+	M680X_INS_TBNE,
+	M680X_INS_TEST,
+	M680X_INS_TFM,
+	M680X_INS_TFR,
+	M680X_INS_TIM,
+	M680X_INS_TPA, ///< M6800/1/2/3
+	M680X_INS_TST,
+	M680X_INS_TSTA,
+	M680X_INS_TSTB,
+	M680X_INS_TSTD,
+	M680X_INS_TSTE,
+	M680X_INS_TSTF,
+	M680X_INS_TSTW,
+	M680X_INS_TSTX,
+	M680X_INS_TSX, ///< M6800/1/2/3
+	M680X_INS_TSY,
+	M680X_INS_TXA,
+	M680X_INS_TXS, ///< M6800/1/2/3
+	M680X_INS_TYS,
+	M680X_INS_WAI, ///< M6800/1/2/3
+	M680X_INS_WAIT,
+	M680X_INS_WAV,
+	M680X_INS_WAVR,
+	M680X_INS_XGDX, ///< HD6301
+	M680X_INS_XGDY,
+	M680X_INS_ENDING,   // <-- mark the end of the list of instructions
+} m680x_insn;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

ai_anti_malware/capstone/include/capstone/m68k.h

@@ -0,0 +1,613 @@
+#ifndef CAPSTONE_M68K_H
+#define CAPSTONE_M68K_H
+
+/* Capstone Disassembly Engine */
+/* By Daniel Collin <daniel@collin.com>, 2015-2016 */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "platform.h"
+
+#ifdef _MSC_VER
+#pragma warning(disable:4201)
+#endif
+
+#define M68K_OPERAND_COUNT 4
+
+/// M68K registers and special registers
+typedef enum m68k_reg {
+	M68K_REG_INVALID = 0,
+
+	M68K_REG_D0,
+	M68K_REG_D1,
+	M68K_REG_D2,
+	M68K_REG_D3,
+	M68K_REG_D4,
+	M68K_REG_D5,
+	M68K_REG_D6,
+	M68K_REG_D7,
+
+	M68K_REG_A0,
+	M68K_REG_A1,
+	M68K_REG_A2,
+	M68K_REG_A3,
+	M68K_REG_A4,
+	M68K_REG_A5,
+	M68K_REG_A6,
+	M68K_REG_A7,
+
+	M68K_REG_FP0,
+	M68K_REG_FP1,
+	M68K_REG_FP2,
+	M68K_REG_FP3,
+	M68K_REG_FP4,
+	M68K_REG_FP5,
+	M68K_REG_FP6,
+	M68K_REG_FP7,
+
+	M68K_REG_PC,
+
+	M68K_REG_SR,
+	M68K_REG_CCR,
+	M68K_REG_SFC,
+	M68K_REG_DFC,
+	M68K_REG_USP,
+	M68K_REG_VBR,
+	M68K_REG_CACR,
+	M68K_REG_CAAR,
+	M68K_REG_MSP,
+	M68K_REG_ISP,
+	M68K_REG_TC,
+	M68K_REG_ITT0,
+	M68K_REG_ITT1,
+	M68K_REG_DTT0,
+	M68K_REG_DTT1,
+	M68K_REG_MMUSR,
+	M68K_REG_URP,
+	M68K_REG_SRP,
+
+	M68K_REG_FPCR,
+	M68K_REG_FPSR,
+	M68K_REG_FPIAR,
+
+	M68K_REG_ENDING,   // <-- mark the end of the list of registers
+} m68k_reg;
+
+/// M68K Addressing Modes
+typedef enum m68k_address_mode {
+	M68K_AM_NONE = 0,			///< No address mode.
+
+	M68K_AM_REG_DIRECT_DATA,		///< Register Direct - Data
+	M68K_AM_REG_DIRECT_ADDR,		///< Register Direct - Address
+
+	M68K_AM_REGI_ADDR,				///< Register Indirect - Address
+	M68K_AM_REGI_ADDR_POST_INC,		///< Register Indirect - Address with Postincrement
+	M68K_AM_REGI_ADDR_PRE_DEC,		///< Register Indirect - Address with Predecrement
+	M68K_AM_REGI_ADDR_DISP,			///< Register Indirect - Address with Displacement
+
+	M68K_AM_AREGI_INDEX_8_BIT_DISP,	///< Address Register Indirect With Index- 8-bit displacement
+	M68K_AM_AREGI_INDEX_BASE_DISP,	///< Address Register Indirect With Index- Base displacement
+
+	M68K_AM_MEMI_POST_INDEX,		///< Memory indirect - Postindex
+	M68K_AM_MEMI_PRE_INDEX,			///< Memory indirect - Preindex
+
+	M68K_AM_PCI_DISP,				///< Program Counter Indirect - with Displacement
+
+	M68K_AM_PCI_INDEX_8_BIT_DISP,	///< Program Counter Indirect with Index - with 8-Bit Displacement
+	M68K_AM_PCI_INDEX_BASE_DISP,	///< Program Counter Indirect with Index - with Base Displacement
+
+	M68K_AM_PC_MEMI_POST_INDEX,		///< Program Counter Memory Indirect - Postindexed
+	M68K_AM_PC_MEMI_PRE_INDEX,		///< Program Counter Memory Indirect - Preindexed
+
+	M68K_AM_ABSOLUTE_DATA_SHORT,	///< Absolute Data Addressing  - Short
+	M68K_AM_ABSOLUTE_DATA_LONG,		///< Absolute Data Addressing  - Long
+	M68K_AM_IMMEDIATE,              ///< Immediate value
+
+	M68K_AM_BRANCH_DISPLACEMENT,    ///< Address as displacement from (PC+2) used by branches
+} m68k_address_mode;
+
+/// Operand type for instruction's operands
+typedef enum m68k_op_type {
+	M68K_OP_INVALID = 0, ///< = CS_OP_INVALID (Uninitialized).
+	M68K_OP_REG,         ///< = CS_OP_REG (Register operand).
+	M68K_OP_IMM,         ///< = CS_OP_IMM (Immediate operand).
+	M68K_OP_MEM,         ///< = CS_OP_MEM (Memory operand).
+	M68K_OP_FP_SINGLE,   ///< single precision Floating-Point operand
+	M68K_OP_FP_DOUBLE,   ///< double precision Floating-Point operand
+	M68K_OP_REG_BITS,    ///< Register bits move
+	M68K_OP_REG_PAIR,    ///< Register pair in the same op (upper 4 bits for first reg, lower for second)
+	M68K_OP_BR_DISP,     ///< Branch displacement
+} m68k_op_type;
+
+/// Instruction's operand referring to memory
+/// This is associated with M68K_OP_MEM operand type above
+typedef struct m68k_op_mem {
+	m68k_reg base_reg;      ///< base register (or M68K_REG_INVALID if irrelevant)
+	m68k_reg index_reg;     ///< index register (or M68K_REG_INVALID if irrelevant)
+	m68k_reg in_base_reg;   ///< indirect base register (or M68K_REG_INVALID if irrelevant)
+	uint32_t in_disp; 	    ///< indirect displacement
+	uint32_t out_disp;      ///< other displacement
+	int16_t disp;	        ///< displacement value
+	uint8_t scale;	        ///< scale for index register
+	uint8_t bitfield;       ///< set to true if the two values below should be used
+	uint8_t width;	        ///< used for bf* instructions
+	uint8_t offset;	        ///< used for bf* instructions
+	uint8_t index_size;     ///< 0 = w, 1 = l
+} m68k_op_mem;
+
+/// Operand type for instruction's operands
+typedef enum m68k_op_br_disp_size {
+	M68K_OP_BR_DISP_SIZE_INVALID = 0, ///< = CS_OP_INVALID (Uninitialized).
+	M68K_OP_BR_DISP_SIZE_BYTE = 1,    ///< signed 8-bit displacement
+	M68K_OP_BR_DISP_SIZE_WORD = 2,    ///< signed 16-bit displacement
+	M68K_OP_BR_DISP_SIZE_LONG = 4,    ///< signed 32-bit displacement
+} m68k_op_br_disp_size;
+
+typedef struct m68k_op_br_disp {
+	int32_t disp;	        ///< displacement value
+	uint8_t disp_size;		///< Size from m68k_op_br_disp_size type above
+} m68k_op_br_disp;
+
+/// Register pair in one operand.
+typedef struct cs_m68k_op_reg_pair {
+	m68k_reg reg_0;
+	m68k_reg reg_1;
+} cs_m68k_op_reg_pair;
+
+/// Instruction operand
+typedef struct cs_m68k_op {
+	union {
+		uint64_t imm;               ///< immediate value for IMM operand
+		double dimm; 		    ///< double imm
+		float simm; 		    ///< float imm
+		m68k_reg reg;		    ///< register value for REG operand
+		cs_m68k_op_reg_pair reg_pair; ///< register pair in one operand
+	};
+
+	m68k_op_mem mem; 	    ///< data when operand is targeting memory
+	m68k_op_br_disp br_disp; ///< data when operand is a branch displacement
+	uint32_t register_bits; ///< register bits for movem etc. (always in d0-d7, a0-a7, fp0 - fp7 order)
+	m68k_op_type type;
+	m68k_address_mode address_mode;	///< M68K addressing mode for this op
+} cs_m68k_op;
+
+/// Operation size of the CPU instructions
+typedef enum m68k_cpu_size {
+	M68K_CPU_SIZE_NONE = 0,		///< unsized or unspecified
+	M68K_CPU_SIZE_BYTE = 1,		///< 1 byte in size
+	M68K_CPU_SIZE_WORD = 2,		///< 2 bytes in size
+	M68K_CPU_SIZE_LONG = 4,		///< 4 bytes in size
+} m68k_cpu_size;
+
+/// Operation size of the FPU instructions (Notice that FPU instruction can also use CPU sizes if needed)
+typedef enum m68k_fpu_size {
+	M68K_FPU_SIZE_NONE = 0,		///< unsized like fsave/frestore
+	M68K_FPU_SIZE_SINGLE = 4,		///< 4 byte in size (single float)
+	M68K_FPU_SIZE_DOUBLE = 8,		///< 8 byte in size (double)
+	M68K_FPU_SIZE_EXTENDED = 12,	///< 12 byte in size (extended real format)
+} m68k_fpu_size;
+
+/// Type of size that is being used for the current instruction
+typedef enum m68k_size_type {
+	M68K_SIZE_TYPE_INVALID = 0,
+
+	M68K_SIZE_TYPE_CPU,
+	M68K_SIZE_TYPE_FPU,
+} m68k_size_type;
+
+/// Operation size of the current instruction (NOT the actually size of instruction)
+typedef struct m68k_op_size {
+	m68k_size_type type;
+	union {
+		m68k_cpu_size cpu_size;
+		m68k_fpu_size fpu_size;
+	};
+} m68k_op_size;
+
+/// The M68K instruction and it's operands
+typedef struct cs_m68k {
+	// Number of operands of this instruction or 0 when instruction has no operand.
+	cs_m68k_op operands[M68K_OPERAND_COUNT]; ///< operands for this instruction.
+	m68k_op_size op_size;	///< size of data operand works on in bytes (.b, .w, .l, etc)
+	uint8_t op_count; ///< number of operands for the instruction
+} cs_m68k;
+
+/// M68K instruction
+typedef enum m68k_insn {
+	M68K_INS_INVALID = 0,
+
+	M68K_INS_ABCD,
+	M68K_INS_ADD,
+	M68K_INS_ADDA,
+	M68K_INS_ADDI,
+	M68K_INS_ADDQ,
+	M68K_INS_ADDX,
+	M68K_INS_AND,
+	M68K_INS_ANDI,
+	M68K_INS_ASL,
+	M68K_INS_ASR,
+	M68K_INS_BHS,
+	M68K_INS_BLO,
+	M68K_INS_BHI,
+	M68K_INS_BLS,
+	M68K_INS_BCC,
+	M68K_INS_BCS,
+	M68K_INS_BNE,
+	M68K_INS_BEQ,
+	M68K_INS_BVC,
+	M68K_INS_BVS,
+	M68K_INS_BPL,
+	M68K_INS_BMI,
+	M68K_INS_BGE,
+	M68K_INS_BLT,
+	M68K_INS_BGT,
+	M68K_INS_BLE,
+	M68K_INS_BRA,
+	M68K_INS_BSR,
+	M68K_INS_BCHG,
+	M68K_INS_BCLR,
+	M68K_INS_BSET,
+	M68K_INS_BTST,
+	M68K_INS_BFCHG,
+	M68K_INS_BFCLR,
+	M68K_INS_BFEXTS,
+	M68K_INS_BFEXTU,
+	M68K_INS_BFFFO,
+	M68K_INS_BFINS,
+	M68K_INS_BFSET,
+	M68K_INS_BFTST,
+	M68K_INS_BKPT,
+	M68K_INS_CALLM,
+	M68K_INS_CAS,
+	M68K_INS_CAS2,
+	M68K_INS_CHK,
+	M68K_INS_CHK2,
+	M68K_INS_CLR,
+	M68K_INS_CMP,
+	M68K_INS_CMPA,
+	M68K_INS_CMPI,
+	M68K_INS_CMPM,
+	M68K_INS_CMP2,
+	M68K_INS_CINVL,
+	M68K_INS_CINVP,
+	M68K_INS_CINVA,
+	M68K_INS_CPUSHL,
+	M68K_INS_CPUSHP,
+	M68K_INS_CPUSHA,
+	M68K_INS_DBT,
+	M68K_INS_DBF,
+	M68K_INS_DBHI,
+	M68K_INS_DBLS,
+	M68K_INS_DBCC,
+	M68K_INS_DBCS,
+	M68K_INS_DBNE,
+	M68K_INS_DBEQ,
+	M68K_INS_DBVC,
+	M68K_INS_DBVS,
+	M68K_INS_DBPL,
+	M68K_INS_DBMI,
+	M68K_INS_DBGE,
+	M68K_INS_DBLT,
+	M68K_INS_DBGT,
+	M68K_INS_DBLE,
+	M68K_INS_DBRA,
+	M68K_INS_DIVS,
+	M68K_INS_DIVSL,
+	M68K_INS_DIVU,
+	M68K_INS_DIVUL,
+	M68K_INS_EOR,
+	M68K_INS_EORI,
+	M68K_INS_EXG,
+	M68K_INS_EXT,
+	M68K_INS_EXTB,
+	M68K_INS_FABS,
+	M68K_INS_FSABS,
+	M68K_INS_FDABS,
+	M68K_INS_FACOS,
+	M68K_INS_FADD,
+	M68K_INS_FSADD,
+	M68K_INS_FDADD,
+	M68K_INS_FASIN,
+	M68K_INS_FATAN,
+	M68K_INS_FATANH,
+	M68K_INS_FBF,
+	M68K_INS_FBEQ,
+	M68K_INS_FBOGT,
+	M68K_INS_FBOGE,
+	M68K_INS_FBOLT,
+	M68K_INS_FBOLE,
+	M68K_INS_FBOGL,
+	M68K_INS_FBOR,
+	M68K_INS_FBUN,
+	M68K_INS_FBUEQ,
+	M68K_INS_FBUGT,
+	M68K_INS_FBUGE,
+	M68K_INS_FBULT,
+	M68K_INS_FBULE,
+	M68K_INS_FBNE,
+	M68K_INS_FBT,
+	M68K_INS_FBSF,
+	M68K_INS_FBSEQ,
+	M68K_INS_FBGT,
+	M68K_INS_FBGE,
+	M68K_INS_FBLT,
+	M68K_INS_FBLE,
+	M68K_INS_FBGL,
+	M68K_INS_FBGLE,
+	M68K_INS_FBNGLE,
+	M68K_INS_FBNGL,
+	M68K_INS_FBNLE,
+	M68K_INS_FBNLT,
+	M68K_INS_FBNGE,
+	M68K_INS_FBNGT,
+	M68K_INS_FBSNE,
+	M68K_INS_FBST,
+	M68K_INS_FCMP,
+	M68K_INS_FCOS,
+	M68K_INS_FCOSH,
+	M68K_INS_FDBF,
+	M68K_INS_FDBEQ,
+	M68K_INS_FDBOGT,
+	M68K_INS_FDBOGE,
+	M68K_INS_FDBOLT,
+	M68K_INS_FDBOLE,
+	M68K_INS_FDBOGL,
+	M68K_INS_FDBOR,
+	M68K_INS_FDBUN,
+	M68K_INS_FDBUEQ,
+	M68K_INS_FDBUGT,
+	M68K_INS_FDBUGE,
+	M68K_INS_FDBULT,
+	M68K_INS_FDBULE,
+	M68K_INS_FDBNE,
+	M68K_INS_FDBT,
+	M68K_INS_FDBSF,
+	M68K_INS_FDBSEQ,
+	M68K_INS_FDBGT,
+	M68K_INS_FDBGE,
+	M68K_INS_FDBLT,
+	M68K_INS_FDBLE,
+	M68K_INS_FDBGL,
+	M68K_INS_FDBGLE,
+	M68K_INS_FDBNGLE,
+	M68K_INS_FDBNGL,
+	M68K_INS_FDBNLE,
+	M68K_INS_FDBNLT,
+	M68K_INS_FDBNGE,
+	M68K_INS_FDBNGT,
+	M68K_INS_FDBSNE,
+	M68K_INS_FDBST,
+	M68K_INS_FDIV,
+	M68K_INS_FSDIV,
+	M68K_INS_FDDIV,
+	M68K_INS_FETOX,
+	M68K_INS_FETOXM1,
+	M68K_INS_FGETEXP,
+	M68K_INS_FGETMAN,
+	M68K_INS_FINT,
+	M68K_INS_FINTRZ,
+	M68K_INS_FLOG10,
+	M68K_INS_FLOG2,
+	M68K_INS_FLOGN,
+	M68K_INS_FLOGNP1,
+	M68K_INS_FMOD,
+	M68K_INS_FMOVE,
+	M68K_INS_FSMOVE,
+	M68K_INS_FDMOVE,
+	M68K_INS_FMOVECR,
+	M68K_INS_FMOVEM,
+	M68K_INS_FMUL,
+	M68K_INS_FSMUL,
+	M68K_INS_FDMUL,
+	M68K_INS_FNEG,
+	M68K_INS_FSNEG,
+	M68K_INS_FDNEG,
+	M68K_INS_FNOP,
+	M68K_INS_FREM,
+	M68K_INS_FRESTORE,
+	M68K_INS_FSAVE,
+	M68K_INS_FSCALE,
+	M68K_INS_FSGLDIV,
+	M68K_INS_FSGLMUL,
+	M68K_INS_FSIN,
+	M68K_INS_FSINCOS,
+	M68K_INS_FSINH,
+	M68K_INS_FSQRT,
+	M68K_INS_FSSQRT,
+	M68K_INS_FDSQRT,
+	M68K_INS_FSF,
+	M68K_INS_FSBEQ,
+	M68K_INS_FSOGT,
+	M68K_INS_FSOGE,
+	M68K_INS_FSOLT,
+	M68K_INS_FSOLE,
+	M68K_INS_FSOGL,
+	M68K_INS_FSOR,
+	M68K_INS_FSUN,
+	M68K_INS_FSUEQ,
+	M68K_INS_FSUGT,
+	M68K_INS_FSUGE,
+	M68K_INS_FSULT,
+	M68K_INS_FSULE,
+	M68K_INS_FSNE,
+	M68K_INS_FST,
+	M68K_INS_FSSF,
+	M68K_INS_FSSEQ,
+	M68K_INS_FSGT,
+	M68K_INS_FSGE,
+	M68K_INS_FSLT,
+	M68K_INS_FSLE,
+	M68K_INS_FSGL,
+	M68K_INS_FSGLE,
+	M68K_INS_FSNGLE,
+	M68K_INS_FSNGL,
+	M68K_INS_FSNLE,
+	M68K_INS_FSNLT,
+	M68K_INS_FSNGE,
+	M68K_INS_FSNGT,
+	M68K_INS_FSSNE,
+	M68K_INS_FSST,
+	M68K_INS_FSUB,
+	M68K_INS_FSSUB,
+	M68K_INS_FDSUB,
+	M68K_INS_FTAN,
+	M68K_INS_FTANH,
+	M68K_INS_FTENTOX,
+	M68K_INS_FTRAPF,
+	M68K_INS_FTRAPEQ,
+	M68K_INS_FTRAPOGT,
+	M68K_INS_FTRAPOGE,
+	M68K_INS_FTRAPOLT,
+	M68K_INS_FTRAPOLE,
+	M68K_INS_FTRAPOGL,
+	M68K_INS_FTRAPOR,
+	M68K_INS_FTRAPUN,
+	M68K_INS_FTRAPUEQ,
+	M68K_INS_FTRAPUGT,
+	M68K_INS_FTRAPUGE,
+	M68K_INS_FTRAPULT,
+	M68K_INS_FTRAPULE,
+	M68K_INS_FTRAPNE,
+	M68K_INS_FTRAPT,
+	M68K_INS_FTRAPSF,
+	M68K_INS_FTRAPSEQ,
+	M68K_INS_FTRAPGT,
+	M68K_INS_FTRAPGE,
+	M68K_INS_FTRAPLT,
+	M68K_INS_FTRAPLE,
+	M68K_INS_FTRAPGL,
+	M68K_INS_FTRAPGLE,
+	M68K_INS_FTRAPNGLE,
+	M68K_INS_FTRAPNGL,
+	M68K_INS_FTRAPNLE,
+	M68K_INS_FTRAPNLT,
+	M68K_INS_FTRAPNGE,
+	M68K_INS_FTRAPNGT,
+	M68K_INS_FTRAPSNE,
+	M68K_INS_FTRAPST,
+	M68K_INS_FTST,
+	M68K_INS_FTWOTOX,
+	M68K_INS_HALT,
+	M68K_INS_ILLEGAL,
+	M68K_INS_JMP,
+	M68K_INS_JSR,
+	M68K_INS_LEA,
+	M68K_INS_LINK,
+	M68K_INS_LPSTOP,
+	M68K_INS_LSL,
+	M68K_INS_LSR,
+	M68K_INS_MOVE,
+	M68K_INS_MOVEA,
+	M68K_INS_MOVEC,
+	M68K_INS_MOVEM,
+	M68K_INS_MOVEP,
+	M68K_INS_MOVEQ,
+	M68K_INS_MOVES,
+	M68K_INS_MOVE16,
+	M68K_INS_MULS,
+	M68K_INS_MULU,
+	M68K_INS_NBCD,
+	M68K_INS_NEG,
+	M68K_INS_NEGX,
+	M68K_INS_NOP,
+	M68K_INS_NOT,
+	M68K_INS_OR,
+	M68K_INS_ORI,
+	M68K_INS_PACK,
+	M68K_INS_PEA,
+	M68K_INS_PFLUSH,
+	M68K_INS_PFLUSHA,
+	M68K_INS_PFLUSHAN,
+	M68K_INS_PFLUSHN,
+	M68K_INS_PLOADR,
+	M68K_INS_PLOADW,
+	M68K_INS_PLPAR,
+	M68K_INS_PLPAW,
+	M68K_INS_PMOVE,
+	M68K_INS_PMOVEFD,
+	M68K_INS_PTESTR,
+	M68K_INS_PTESTW,
+	M68K_INS_PULSE,
+	M68K_INS_REMS,
+	M68K_INS_REMU,
+	M68K_INS_RESET,
+	M68K_INS_ROL,
+	M68K_INS_ROR,
+	M68K_INS_ROXL,
+	M68K_INS_ROXR,
+	M68K_INS_RTD,
+	M68K_INS_RTE,
+	M68K_INS_RTM,
+	M68K_INS_RTR,
+	M68K_INS_RTS,
+	M68K_INS_SBCD,
+	M68K_INS_ST,
+	M68K_INS_SF,
+	M68K_INS_SHI,
+	M68K_INS_SLS,
+	M68K_INS_SCC,
+	M68K_INS_SHS,
+	M68K_INS_SCS,
+	M68K_INS_SLO,
+	M68K_INS_SNE,
+	M68K_INS_SEQ,
+	M68K_INS_SVC,
+	M68K_INS_SVS,
+	M68K_INS_SPL,
+	M68K_INS_SMI,
+	M68K_INS_SGE,
+	M68K_INS_SLT,
+	M68K_INS_SGT,
+	M68K_INS_SLE,
+	M68K_INS_STOP,
+	M68K_INS_SUB,
+	M68K_INS_SUBA,
+	M68K_INS_SUBI,
+	M68K_INS_SUBQ,
+	M68K_INS_SUBX,
+	M68K_INS_SWAP,
+	M68K_INS_TAS,
+	M68K_INS_TRAP,
+	M68K_INS_TRAPV,
+	M68K_INS_TRAPT,
+	M68K_INS_TRAPF,
+	M68K_INS_TRAPHI,
+	M68K_INS_TRAPLS,
+	M68K_INS_TRAPCC,
+	M68K_INS_TRAPHS,
+	M68K_INS_TRAPCS,
+	M68K_INS_TRAPLO,
+	M68K_INS_TRAPNE,
+	M68K_INS_TRAPEQ,
+	M68K_INS_TRAPVC,
+	M68K_INS_TRAPVS,
+	M68K_INS_TRAPPL,
+	M68K_INS_TRAPMI,
+	M68K_INS_TRAPGE,
+	M68K_INS_TRAPLT,
+	M68K_INS_TRAPGT,
+	M68K_INS_TRAPLE,
+	M68K_INS_TST,
+	M68K_INS_UNLK,
+	M68K_INS_UNPK,
+	M68K_INS_ENDING,   // <-- mark the end of the list of instructions
+} m68k_insn;
+
+/// Group of M68K instructions
+typedef enum m68k_group_type {
+	M68K_GRP_INVALID = 0,  ///< CS_GRUP_INVALID
+	M68K_GRP_JUMP,  ///< = CS_GRP_JUMP
+	M68K_GRP_RET = 3,  ///< = CS_GRP_RET
+	M68K_GRP_IRET = 5, ///< = CS_GRP_IRET
+	M68K_GRP_BRANCH_RELATIVE = 7, ///< = CS_GRP_BRANCH_RELATIVE
+
+	M68K_GRP_ENDING,// <-- mark the end of the list of groups
+} m68k_group_type;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

ai_anti_malware/capstone/include/capstone/mips.h

@@ -0,0 +1,956 @@
+#ifndef CAPSTONE_MIPS_H
+#define CAPSTONE_MIPS_H
+
+/* Capstone Disassembly Engine */
+/* By Nguyen Anh Quynh <aquynh@gmail.com>, 2013-2015 */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "platform.h"
+
+// GCC MIPS toolchain has a default macro called "mips" which breaks
+// compilation
+#undef mips
+
+#ifdef _MSC_VER
+#pragma warning(disable:4201)
+#endif
+
+/// Operand type for instruction's operands
+typedef enum mips_op_type {
+	MIPS_OP_INVALID = 0, ///< = CS_OP_INVALID (Uninitialized).
+	MIPS_OP_REG, ///< = CS_OP_REG (Register operand).
+	MIPS_OP_IMM, ///< = CS_OP_IMM (Immediate operand).
+	MIPS_OP_MEM, ///< = CS_OP_MEM (Memory operand).
+} mips_op_type;
+
+/// MIPS registers
+typedef enum mips_reg {
+	MIPS_REG_INVALID = 0,
+	// General purpose registers
+	MIPS_REG_PC,
+
+	MIPS_REG_0,
+	MIPS_REG_1,
+	MIPS_REG_2,
+	MIPS_REG_3,
+	MIPS_REG_4,
+	MIPS_REG_5,
+	MIPS_REG_6,
+	MIPS_REG_7,
+	MIPS_REG_8,
+	MIPS_REG_9,
+	MIPS_REG_10,
+	MIPS_REG_11,
+	MIPS_REG_12,
+	MIPS_REG_13,
+	MIPS_REG_14,
+	MIPS_REG_15,
+	MIPS_REG_16,
+	MIPS_REG_17,
+	MIPS_REG_18,
+	MIPS_REG_19,
+	MIPS_REG_20,
+	MIPS_REG_21,
+	MIPS_REG_22,
+	MIPS_REG_23,
+	MIPS_REG_24,
+	MIPS_REG_25,
+	MIPS_REG_26,
+	MIPS_REG_27,
+	MIPS_REG_28,
+	MIPS_REG_29,
+	MIPS_REG_30,
+	MIPS_REG_31,
+
+	// DSP registers
+	MIPS_REG_DSPCCOND,
+	MIPS_REG_DSPCARRY,
+	MIPS_REG_DSPEFI,
+	MIPS_REG_DSPOUTFLAG,
+	MIPS_REG_DSPOUTFLAG16_19,
+	MIPS_REG_DSPOUTFLAG20,
+	MIPS_REG_DSPOUTFLAG21,
+	MIPS_REG_DSPOUTFLAG22,
+	MIPS_REG_DSPOUTFLAG23,
+	MIPS_REG_DSPPOS,
+	MIPS_REG_DSPSCOUNT,
+
+	// ACC registers
+	MIPS_REG_AC0,
+	MIPS_REG_AC1,
+	MIPS_REG_AC2,
+	MIPS_REG_AC3,
+
+	// COP registers
+	MIPS_REG_CC0,
+	MIPS_REG_CC1,
+	MIPS_REG_CC2,
+	MIPS_REG_CC3,
+	MIPS_REG_CC4,
+	MIPS_REG_CC5,
+	MIPS_REG_CC6,
+	MIPS_REG_CC7,
+
+	// FPU registers
+	MIPS_REG_F0,
+	MIPS_REG_F1,
+	MIPS_REG_F2,
+	MIPS_REG_F3,
+	MIPS_REG_F4,
+	MIPS_REG_F5,
+	MIPS_REG_F6,
+	MIPS_REG_F7,
+	MIPS_REG_F8,
+	MIPS_REG_F9,
+	MIPS_REG_F10,
+	MIPS_REG_F11,
+	MIPS_REG_F12,
+	MIPS_REG_F13,
+	MIPS_REG_F14,
+	MIPS_REG_F15,
+	MIPS_REG_F16,
+	MIPS_REG_F17,
+	MIPS_REG_F18,
+	MIPS_REG_F19,
+	MIPS_REG_F20,
+	MIPS_REG_F21,
+	MIPS_REG_F22,
+	MIPS_REG_F23,
+	MIPS_REG_F24,
+	MIPS_REG_F25,
+	MIPS_REG_F26,
+	MIPS_REG_F27,
+	MIPS_REG_F28,
+	MIPS_REG_F29,
+	MIPS_REG_F30,
+	MIPS_REG_F31,
+
+	MIPS_REG_FCC0,
+	MIPS_REG_FCC1,
+	MIPS_REG_FCC2,
+	MIPS_REG_FCC3,
+	MIPS_REG_FCC4,
+	MIPS_REG_FCC5,
+	MIPS_REG_FCC6,
+	MIPS_REG_FCC7,
+
+	// AFPR128
+	MIPS_REG_W0,
+	MIPS_REG_W1,
+	MIPS_REG_W2,
+	MIPS_REG_W3,
+	MIPS_REG_W4,
+	MIPS_REG_W5,
+	MIPS_REG_W6,
+	MIPS_REG_W7,
+	MIPS_REG_W8,
+	MIPS_REG_W9,
+	MIPS_REG_W10,
+	MIPS_REG_W11,
+	MIPS_REG_W12,
+	MIPS_REG_W13,
+	MIPS_REG_W14,
+	MIPS_REG_W15,
+	MIPS_REG_W16,
+	MIPS_REG_W17,
+	MIPS_REG_W18,
+	MIPS_REG_W19,
+	MIPS_REG_W20,
+	MIPS_REG_W21,
+	MIPS_REG_W22,
+	MIPS_REG_W23,
+	MIPS_REG_W24,
+	MIPS_REG_W25,
+	MIPS_REG_W26,
+	MIPS_REG_W27,
+	MIPS_REG_W28,
+	MIPS_REG_W29,
+	MIPS_REG_W30,
+	MIPS_REG_W31,
+
+	MIPS_REG_HI,
+	MIPS_REG_LO,
+
+	MIPS_REG_P0,
+	MIPS_REG_P1,
+	MIPS_REG_P2,
+
+	MIPS_REG_MPL0,
+	MIPS_REG_MPL1,
+	MIPS_REG_MPL2,
+
+	MIPS_REG_ENDING,	// <-- mark the end of the list or registers
+
+	// alias registers
+	MIPS_REG_ZERO = MIPS_REG_0,
+	MIPS_REG_AT = MIPS_REG_1,
+	MIPS_REG_V0 = MIPS_REG_2,
+	MIPS_REG_V1 = MIPS_REG_3,
+	MIPS_REG_A0 = MIPS_REG_4,
+	MIPS_REG_A1 = MIPS_REG_5,
+	MIPS_REG_A2 = MIPS_REG_6,
+	MIPS_REG_A3 = MIPS_REG_7,
+	MIPS_REG_T0 = MIPS_REG_8,
+	MIPS_REG_T1 = MIPS_REG_9,
+	MIPS_REG_T2 = MIPS_REG_10,
+	MIPS_REG_T3 = MIPS_REG_11,
+	MIPS_REG_T4 = MIPS_REG_12,
+	MIPS_REG_T5 = MIPS_REG_13,
+	MIPS_REG_T6 = MIPS_REG_14,
+	MIPS_REG_T7 = MIPS_REG_15,
+	MIPS_REG_S0 = MIPS_REG_16,
+	MIPS_REG_S1 = MIPS_REG_17,
+	MIPS_REG_S2 = MIPS_REG_18,
+	MIPS_REG_S3 = MIPS_REG_19,
+	MIPS_REG_S4 = MIPS_REG_20,
+	MIPS_REG_S5 = MIPS_REG_21,
+	MIPS_REG_S6 = MIPS_REG_22,
+	MIPS_REG_S7 = MIPS_REG_23,
+	MIPS_REG_T8 = MIPS_REG_24,
+	MIPS_REG_T9 = MIPS_REG_25,
+	MIPS_REG_K0 = MIPS_REG_26,
+	MIPS_REG_K1 = MIPS_REG_27,
+	MIPS_REG_GP = MIPS_REG_28,
+	MIPS_REG_SP = MIPS_REG_29,
+	MIPS_REG_FP = MIPS_REG_30, MIPS_REG_S8 = MIPS_REG_30,
+	MIPS_REG_RA = MIPS_REG_31,
+
+	MIPS_REG_HI0 = MIPS_REG_AC0,
+	MIPS_REG_HI1 = MIPS_REG_AC1,
+	MIPS_REG_HI2 = MIPS_REG_AC2,
+	MIPS_REG_HI3 = MIPS_REG_AC3,
+
+	MIPS_REG_LO0 = MIPS_REG_HI0,
+	MIPS_REG_LO1 = MIPS_REG_HI1,
+	MIPS_REG_LO2 = MIPS_REG_HI2,
+	MIPS_REG_LO3 = MIPS_REG_HI3,
+} mips_reg;
+
+/// Instruction's operand referring to memory
+/// This is associated with MIPS_OP_MEM operand type above
+typedef struct mips_op_mem {
+	mips_reg base;	///< base register
+	int64_t disp;	///< displacement/offset value
+} mips_op_mem;
+
+/// Instruction operand
+typedef struct cs_mips_op {
+	mips_op_type type;	///< operand type
+	union {
+		mips_reg reg;		///< register value for REG operand
+		int64_t imm;		///< immediate value for IMM operand
+		mips_op_mem mem;	///< base/index/scale/disp value for MEM operand
+	};
+} cs_mips_op;
+
+/// Instruction structure
+typedef struct cs_mips {
+	/// Number of operands of this instruction,
+	/// or 0 when instruction has no operand.
+	uint8_t op_count;
+	cs_mips_op operands[10]; ///< operands for this instruction.
+} cs_mips;
+
+/// MIPS instruction
+typedef enum mips_insn {
+	MIPS_INS_INVALID = 0,
+
+	MIPS_INS_ABSQ_S,
+	MIPS_INS_ADD,
+	MIPS_INS_ADDIUPC,
+	MIPS_INS_ADDIUR1SP,
+	MIPS_INS_ADDIUR2,
+	MIPS_INS_ADDIUS5,
+	MIPS_INS_ADDIUSP,
+	MIPS_INS_ADDQH,
+	MIPS_INS_ADDQH_R,
+	MIPS_INS_ADDQ,
+	MIPS_INS_ADDQ_S,
+	MIPS_INS_ADDSC,
+	MIPS_INS_ADDS_A,
+	MIPS_INS_ADDS_S,
+	MIPS_INS_ADDS_U,
+	MIPS_INS_ADDU16,
+	MIPS_INS_ADDUH,
+	MIPS_INS_ADDUH_R,
+	MIPS_INS_ADDU,
+	MIPS_INS_ADDU_S,
+	MIPS_INS_ADDVI,
+	MIPS_INS_ADDV,
+	MIPS_INS_ADDWC,
+	MIPS_INS_ADD_A,
+	MIPS_INS_ADDI,
+	MIPS_INS_ADDIU,
+	MIPS_INS_ALIGN,
+	MIPS_INS_ALUIPC,
+	MIPS_INS_AND,
+	MIPS_INS_AND16,
+	MIPS_INS_ANDI16,
+	MIPS_INS_ANDI,
+	MIPS_INS_APPEND,
+	MIPS_INS_ASUB_S,
+	MIPS_INS_ASUB_U,
+	MIPS_INS_AUI,
+	MIPS_INS_AUIPC,
+	MIPS_INS_AVER_S,
+	MIPS_INS_AVER_U,
+	MIPS_INS_AVE_S,
+	MIPS_INS_AVE_U,
+	MIPS_INS_B16,
+	MIPS_INS_BADDU,
+	MIPS_INS_BAL,
+	MIPS_INS_BALC,
+	MIPS_INS_BALIGN,
+	MIPS_INS_BBIT0,
+	MIPS_INS_BBIT032,
+	MIPS_INS_BBIT1,
+	MIPS_INS_BBIT132,
+	MIPS_INS_BC,
+	MIPS_INS_BC0F,
+	MIPS_INS_BC0FL,
+	MIPS_INS_BC0T,
+	MIPS_INS_BC0TL,
+	MIPS_INS_BC1EQZ,
+	MIPS_INS_BC1F,
+	MIPS_INS_BC1FL,
+	MIPS_INS_BC1NEZ,
+	MIPS_INS_BC1T,
+	MIPS_INS_BC1TL,
+	MIPS_INS_BC2EQZ,
+	MIPS_INS_BC2F,
+	MIPS_INS_BC2FL,
+	MIPS_INS_BC2NEZ,
+	MIPS_INS_BC2T,
+	MIPS_INS_BC2TL,
+	MIPS_INS_BC3F,
+	MIPS_INS_BC3FL,
+	MIPS_INS_BC3T,
+	MIPS_INS_BC3TL,
+	MIPS_INS_BCLRI,
+	MIPS_INS_BCLR,
+	MIPS_INS_BEQ,
+	MIPS_INS_BEQC,
+	MIPS_INS_BEQL,
+	MIPS_INS_BEQZ16,
+	MIPS_INS_BEQZALC,
+	MIPS_INS_BEQZC,
+	MIPS_INS_BGEC,
+	MIPS_INS_BGEUC,
+	MIPS_INS_BGEZ,
+	MIPS_INS_BGEZAL,
+	MIPS_INS_BGEZALC,
+	MIPS_INS_BGEZALL,
+	MIPS_INS_BGEZALS,
+	MIPS_INS_BGEZC,
+	MIPS_INS_BGEZL,
+	MIPS_INS_BGTZ,
+	MIPS_INS_BGTZALC,
+	MIPS_INS_BGTZC,
+	MIPS_INS_BGTZL,
+	MIPS_INS_BINSLI,
+	MIPS_INS_BINSL,
+	MIPS_INS_BINSRI,
+	MIPS_INS_BINSR,
+	MIPS_INS_BITREV,
+	MIPS_INS_BITSWAP,
+	MIPS_INS_BLEZ,
+	MIPS_INS_BLEZALC,
+	MIPS_INS_BLEZC,
+	MIPS_INS_BLEZL,
+	MIPS_INS_BLTC,
+	MIPS_INS_BLTUC,
+	MIPS_INS_BLTZ,
+	MIPS_INS_BLTZAL,
+	MIPS_INS_BLTZALC,
+	MIPS_INS_BLTZALL,
+	MIPS_INS_BLTZALS,
+	MIPS_INS_BLTZC,
+	MIPS_INS_BLTZL,
+	MIPS_INS_BMNZI,
+	MIPS_INS_BMNZ,
+	MIPS_INS_BMZI,
+	MIPS_INS_BMZ,
+	MIPS_INS_BNE,
+	MIPS_INS_BNEC,
+	MIPS_INS_BNEGI,
+	MIPS_INS_BNEG,
+	MIPS_INS_BNEL,
+	MIPS_INS_BNEZ16,
+	MIPS_INS_BNEZALC,
+	MIPS_INS_BNEZC,
+	MIPS_INS_BNVC,
+	MIPS_INS_BNZ,
+	MIPS_INS_BOVC,
+	MIPS_INS_BPOSGE32,
+	MIPS_INS_BREAK,
+	MIPS_INS_BREAK16,
+	MIPS_INS_BSELI,
+	MIPS_INS_BSEL,
+	MIPS_INS_BSETI,
+	MIPS_INS_BSET,
+	MIPS_INS_BZ,
+	MIPS_INS_BEQZ,
+	MIPS_INS_B,
+	MIPS_INS_BNEZ,
+	MIPS_INS_BTEQZ,
+	MIPS_INS_BTNEZ,
+	MIPS_INS_CACHE,
+	MIPS_INS_CEIL,
+	MIPS_INS_CEQI,
+	MIPS_INS_CEQ,
+	MIPS_INS_CFC1,
+	MIPS_INS_CFCMSA,
+	MIPS_INS_CINS,
+	MIPS_INS_CINS32,
+	MIPS_INS_CLASS,
+	MIPS_INS_CLEI_S,
+	MIPS_INS_CLEI_U,
+	MIPS_INS_CLE_S,
+	MIPS_INS_CLE_U,
+	MIPS_INS_CLO,
+	MIPS_INS_CLTI_S,
+	MIPS_INS_CLTI_U,
+	MIPS_INS_CLT_S,
+	MIPS_INS_CLT_U,
+	MIPS_INS_CLZ,
+	MIPS_INS_CMPGDU,
+	MIPS_INS_CMPGU,
+	MIPS_INS_CMPU,
+	MIPS_INS_CMP,
+	MIPS_INS_COPY_S,
+	MIPS_INS_COPY_U,
+	MIPS_INS_CTC1,
+	MIPS_INS_CTCMSA,
+	MIPS_INS_CVT,
+	MIPS_INS_C,
+	MIPS_INS_CMPI,
+	MIPS_INS_DADD,
+	MIPS_INS_DADDI,
+	MIPS_INS_DADDIU,
+	MIPS_INS_DADDU,
+	MIPS_INS_DAHI,
+	MIPS_INS_DALIGN,
+	MIPS_INS_DATI,
+	MIPS_INS_DAUI,
+	MIPS_INS_DBITSWAP,
+	MIPS_INS_DCLO,
+	MIPS_INS_DCLZ,
+	MIPS_INS_DDIV,
+	MIPS_INS_DDIVU,
+	MIPS_INS_DERET,
+	MIPS_INS_DEXT,
+	MIPS_INS_DEXTM,
+	MIPS_INS_DEXTU,
+	MIPS_INS_DI,
+	MIPS_INS_DINS,
+	MIPS_INS_DINSM,
+	MIPS_INS_DINSU,
+	MIPS_INS_DIV,
+	MIPS_INS_DIVU,
+	MIPS_INS_DIV_S,
+	MIPS_INS_DIV_U,
+	MIPS_INS_DLSA,
+	MIPS_INS_DMFC0,
+	MIPS_INS_DMFC1,
+	MIPS_INS_DMFC2,
+	MIPS_INS_DMOD,
+	MIPS_INS_DMODU,
+	MIPS_INS_DMTC0,
+	MIPS_INS_DMTC1,
+	MIPS_INS_DMTC2,
+	MIPS_INS_DMUH,
+	MIPS_INS_DMUHU,
+	MIPS_INS_DMUL,
+	MIPS_INS_DMULT,
+	MIPS_INS_DMULTU,
+	MIPS_INS_DMULU,
+	MIPS_INS_DOTP_S,
+	MIPS_INS_DOTP_U,
+	MIPS_INS_DPADD_S,
+	MIPS_INS_DPADD_U,
+	MIPS_INS_DPAQX_SA,
+	MIPS_INS_DPAQX_S,
+	MIPS_INS_DPAQ_SA,
+	MIPS_INS_DPAQ_S,
+	MIPS_INS_DPAU,
+	MIPS_INS_DPAX,
+	MIPS_INS_DPA,
+	MIPS_INS_DPOP,
+	MIPS_INS_DPSQX_SA,
+	MIPS_INS_DPSQX_S,
+	MIPS_INS_DPSQ_SA,
+	MIPS_INS_DPSQ_S,
+	MIPS_INS_DPSUB_S,
+	MIPS_INS_DPSUB_U,
+	MIPS_INS_DPSU,
+	MIPS_INS_DPSX,
+	MIPS_INS_DPS,
+	MIPS_INS_DROTR,
+	MIPS_INS_DROTR32,
+	MIPS_INS_DROTRV,
+	MIPS_INS_DSBH,
+	MIPS_INS_DSHD,
+	MIPS_INS_DSLL,
+	MIPS_INS_DSLL32,
+	MIPS_INS_DSLLV,
+	MIPS_INS_DSRA,
+	MIPS_INS_DSRA32,
+	MIPS_INS_DSRAV,
+	MIPS_INS_DSRL,
+	MIPS_INS_DSRL32,
+	MIPS_INS_DSRLV,
+	MIPS_INS_DSUB,
+	MIPS_INS_DSUBU,
+	MIPS_INS_EHB,
+	MIPS_INS_EI,
+	MIPS_INS_ERET,
+	MIPS_INS_EXT,
+	MIPS_INS_EXTP,
+	MIPS_INS_EXTPDP,
+	MIPS_INS_EXTPDPV,
+	MIPS_INS_EXTPV,
+	MIPS_INS_EXTRV_RS,
+	MIPS_INS_EXTRV_R,
+	MIPS_INS_EXTRV_S,
+	MIPS_INS_EXTRV,
+	MIPS_INS_EXTR_RS,
+	MIPS_INS_EXTR_R,
+	MIPS_INS_EXTR_S,
+	MIPS_INS_EXTR,
+	MIPS_INS_EXTS,
+	MIPS_INS_EXTS32,
+	MIPS_INS_ABS,
+	MIPS_INS_FADD,
+	MIPS_INS_FCAF,
+	MIPS_INS_FCEQ,
+	MIPS_INS_FCLASS,
+	MIPS_INS_FCLE,
+	MIPS_INS_FCLT,
+	MIPS_INS_FCNE,
+	MIPS_INS_FCOR,
+	MIPS_INS_FCUEQ,
+	MIPS_INS_FCULE,
+	MIPS_INS_FCULT,
+	MIPS_INS_FCUNE,
+	MIPS_INS_FCUN,
+	MIPS_INS_FDIV,
+	MIPS_INS_FEXDO,
+	MIPS_INS_FEXP2,
+	MIPS_INS_FEXUPL,
+	MIPS_INS_FEXUPR,
+	MIPS_INS_FFINT_S,
+	MIPS_INS_FFINT_U,
+	MIPS_INS_FFQL,
+	MIPS_INS_FFQR,
+	MIPS_INS_FILL,
+	MIPS_INS_FLOG2,
+	MIPS_INS_FLOOR,
+	MIPS_INS_FMADD,
+	MIPS_INS_FMAX_A,
+	MIPS_INS_FMAX,
+	MIPS_INS_FMIN_A,
+	MIPS_INS_FMIN,
+	MIPS_INS_MOV,
+	MIPS_INS_FMSUB,
+	MIPS_INS_FMUL,
+	MIPS_INS_MUL,
+	MIPS_INS_NEG,
+	MIPS_INS_FRCP,
+	MIPS_INS_FRINT,
+	MIPS_INS_FRSQRT,
+	MIPS_INS_FSAF,
+	MIPS_INS_FSEQ,
+	MIPS_INS_FSLE,
+	MIPS_INS_FSLT,
+	MIPS_INS_FSNE,
+	MIPS_INS_FSOR,
+	MIPS_INS_FSQRT,
+	MIPS_INS_SQRT,
+	MIPS_INS_FSUB,
+	MIPS_INS_SUB,
+	MIPS_INS_FSUEQ,
+	MIPS_INS_FSULE,
+	MIPS_INS_FSULT,
+	MIPS_INS_FSUNE,
+	MIPS_INS_FSUN,
+	MIPS_INS_FTINT_S,
+	MIPS_INS_FTINT_U,
+	MIPS_INS_FTQ,
+	MIPS_INS_FTRUNC_S,
+	MIPS_INS_FTRUNC_U,
+	MIPS_INS_HADD_S,
+	MIPS_INS_HADD_U,
+	MIPS_INS_HSUB_S,
+	MIPS_INS_HSUB_U,
+	MIPS_INS_ILVEV,
+	MIPS_INS_ILVL,
+	MIPS_INS_ILVOD,
+	MIPS_INS_ILVR,
+	MIPS_INS_INS,
+	MIPS_INS_INSERT,
+	MIPS_INS_INSV,
+	MIPS_INS_INSVE,
+	MIPS_INS_J,
+	MIPS_INS_JAL,
+	MIPS_INS_JALR,
+	MIPS_INS_JALRS16,
+	MIPS_INS_JALRS,
+	MIPS_INS_JALS,
+	MIPS_INS_JALX,
+	MIPS_INS_JIALC,
+	MIPS_INS_JIC,
+	MIPS_INS_JR,
+	MIPS_INS_JR16,
+	MIPS_INS_JRADDIUSP,
+	MIPS_INS_JRC,
+	MIPS_INS_JALRC,
+	MIPS_INS_LB,
+	MIPS_INS_LBU16,
+	MIPS_INS_LBUX,
+	MIPS_INS_LBU,
+	MIPS_INS_LD,
+	MIPS_INS_LDC1,
+	MIPS_INS_LDC2,
+	MIPS_INS_LDC3,
+	MIPS_INS_LDI,
+	MIPS_INS_LDL,
+	MIPS_INS_LDPC,
+	MIPS_INS_LDR,
+	MIPS_INS_LDXC1,
+	MIPS_INS_LH,
+	MIPS_INS_LHU16,
+	MIPS_INS_LHX,
+	MIPS_INS_LHU,
+	MIPS_INS_LI16,
+	MIPS_INS_LL,
+	MIPS_INS_LLD,
+	MIPS_INS_LSA,
+	MIPS_INS_LUXC1,
+	MIPS_INS_LUI,
+	MIPS_INS_LW,
+	MIPS_INS_LW16,
+	MIPS_INS_LWC1,
+	MIPS_INS_LWC2,
+	MIPS_INS_LWC3,
+	MIPS_INS_LWL,
+	MIPS_INS_LWM16,
+	MIPS_INS_LWM32,
+	MIPS_INS_LWPC,
+	MIPS_INS_LWP,
+	MIPS_INS_LWR,
+	MIPS_INS_LWUPC,
+	MIPS_INS_LWU,
+	MIPS_INS_LWX,
+	MIPS_INS_LWXC1,
+	MIPS_INS_LWXS,
+	MIPS_INS_LI,
+	MIPS_INS_MADD,
+	MIPS_INS_MADDF,
+	MIPS_INS_MADDR_Q,
+	MIPS_INS_MADDU,
+	MIPS_INS_MADDV,
+	MIPS_INS_MADD_Q,
+	MIPS_INS_MAQ_SA,
+	MIPS_INS_MAQ_S,
+	MIPS_INS_MAXA,
+	MIPS_INS_MAXI_S,
+	MIPS_INS_MAXI_U,
+	MIPS_INS_MAX_A,
+	MIPS_INS_MAX,
+	MIPS_INS_MAX_S,
+	MIPS_INS_MAX_U,
+	MIPS_INS_MFC0,
+	MIPS_INS_MFC1,
+	MIPS_INS_MFC2,
+	MIPS_INS_MFHC1,
+	MIPS_INS_MFHI,
+	MIPS_INS_MFLO,
+	MIPS_INS_MINA,
+	MIPS_INS_MINI_S,
+	MIPS_INS_MINI_U,
+	MIPS_INS_MIN_A,
+	MIPS_INS_MIN,
+	MIPS_INS_MIN_S,
+	MIPS_INS_MIN_U,
+	MIPS_INS_MOD,
+	MIPS_INS_MODSUB,
+	MIPS_INS_MODU,
+	MIPS_INS_MOD_S,
+	MIPS_INS_MOD_U,
+	MIPS_INS_MOVE,
+	MIPS_INS_MOVEP,
+	MIPS_INS_MOVF,
+	MIPS_INS_MOVN,
+	MIPS_INS_MOVT,
+	MIPS_INS_MOVZ,
+	MIPS_INS_MSUB,
+	MIPS_INS_MSUBF,
+	MIPS_INS_MSUBR_Q,
+	MIPS_INS_MSUBU,
+	MIPS_INS_MSUBV,
+	MIPS_INS_MSUB_Q,
+	MIPS_INS_MTC0,
+	MIPS_INS_MTC1,
+	MIPS_INS_MTC2,
+	MIPS_INS_MTHC1,
+	MIPS_INS_MTHI,
+	MIPS_INS_MTHLIP,
+	MIPS_INS_MTLO,
+	MIPS_INS_MTM0,
+	MIPS_INS_MTM1,
+	MIPS_INS_MTM2,
+	MIPS_INS_MTP0,
+	MIPS_INS_MTP1,
+	MIPS_INS_MTP2,
+	MIPS_INS_MUH,
+	MIPS_INS_MUHU,
+	MIPS_INS_MULEQ_S,
+	MIPS_INS_MULEU_S,
+	MIPS_INS_MULQ_RS,
+	MIPS_INS_MULQ_S,
+	MIPS_INS_MULR_Q,
+	MIPS_INS_MULSAQ_S,
+	MIPS_INS_MULSA,
+	MIPS_INS_MULT,
+	MIPS_INS_MULTU,
+	MIPS_INS_MULU,
+	MIPS_INS_MULV,
+	MIPS_INS_MUL_Q,
+	MIPS_INS_MUL_S,
+	MIPS_INS_NLOC,
+	MIPS_INS_NLZC,
+	MIPS_INS_NMADD,
+	MIPS_INS_NMSUB,
+	MIPS_INS_NOR,
+	MIPS_INS_NORI,
+	MIPS_INS_NOT16,
+	MIPS_INS_NOT,
+	MIPS_INS_OR,
+	MIPS_INS_OR16,
+	MIPS_INS_ORI,
+	MIPS_INS_PACKRL,
+	MIPS_INS_PAUSE,
+	MIPS_INS_PCKEV,
+	MIPS_INS_PCKOD,
+	MIPS_INS_PCNT,
+	MIPS_INS_PICK,
+	MIPS_INS_POP,
+	MIPS_INS_PRECEQU,
+	MIPS_INS_PRECEQ,
+	MIPS_INS_PRECEU,
+	MIPS_INS_PRECRQU_S,
+	MIPS_INS_PRECRQ,
+	MIPS_INS_PRECRQ_RS,
+	MIPS_INS_PRECR,
+	MIPS_INS_PRECR_SRA,
+	MIPS_INS_PRECR_SRA_R,
+	MIPS_INS_PREF,
+	MIPS_INS_PREPEND,
+	MIPS_INS_RADDU,
+	MIPS_INS_RDDSP,
+	MIPS_INS_RDHWR,
+	MIPS_INS_REPLV,
+	MIPS_INS_REPL,
+	MIPS_INS_RINT,
+	MIPS_INS_ROTR,
+	MIPS_INS_ROTRV,
+	MIPS_INS_ROUND,
+	MIPS_INS_SAT_S,
+	MIPS_INS_SAT_U,
+	MIPS_INS_SB,
+	MIPS_INS_SB16,
+	MIPS_INS_SC,
+	MIPS_INS_SCD,
+	MIPS_INS_SD,
+	MIPS_INS_SDBBP,
+	MIPS_INS_SDBBP16,
+	MIPS_INS_SDC1,
+	MIPS_INS_SDC2,
+	MIPS_INS_SDC3,
+	MIPS_INS_SDL,
+	MIPS_INS_SDR,
+	MIPS_INS_SDXC1,
+	MIPS_INS_SEB,
+	MIPS_INS_SEH,
+	MIPS_INS_SELEQZ,
+	MIPS_INS_SELNEZ,
+	MIPS_INS_SEL,
+	MIPS_INS_SEQ,
+	MIPS_INS_SEQI,
+	MIPS_INS_SH,
+	MIPS_INS_SH16,
+	MIPS_INS_SHF,
+	MIPS_INS_SHILO,
+	MIPS_INS_SHILOV,
+	MIPS_INS_SHLLV,
+	MIPS_INS_SHLLV_S,
+	MIPS_INS_SHLL,
+	MIPS_INS_SHLL_S,
+	MIPS_INS_SHRAV,
+	MIPS_INS_SHRAV_R,
+	MIPS_INS_SHRA,
+	MIPS_INS_SHRA_R,
+	MIPS_INS_SHRLV,
+	MIPS_INS_SHRL,
+	MIPS_INS_SLDI,
+	MIPS_INS_SLD,
+	MIPS_INS_SLL,
+	MIPS_INS_SLL16,
+	MIPS_INS_SLLI,
+	MIPS_INS_SLLV,
+	MIPS_INS_SLT,
+	MIPS_INS_SLTI,
+	MIPS_INS_SLTIU,
+	MIPS_INS_SLTU,
+	MIPS_INS_SNE,
+	MIPS_INS_SNEI,
+	MIPS_INS_SPLATI,
+	MIPS_INS_SPLAT,
+	MIPS_INS_SRA,
+	MIPS_INS_SRAI,
+	MIPS_INS_SRARI,
+	MIPS_INS_SRAR,
+	MIPS_INS_SRAV,
+	MIPS_INS_SRL,
+	MIPS_INS_SRL16,
+	MIPS_INS_SRLI,
+	MIPS_INS_SRLRI,
+	MIPS_INS_SRLR,
+	MIPS_INS_SRLV,
+	MIPS_INS_SSNOP,
+	MIPS_INS_ST,
+	MIPS_INS_SUBQH,
+	MIPS_INS_SUBQH_R,
+	MIPS_INS_SUBQ,
+	MIPS_INS_SUBQ_S,
+	MIPS_INS_SUBSUS_U,
+	MIPS_INS_SUBSUU_S,
+	MIPS_INS_SUBS_S,
+	MIPS_INS_SUBS_U,
+	MIPS_INS_SUBU16,
+	MIPS_INS_SUBUH,
+	MIPS_INS_SUBUH_R,
+	MIPS_INS_SUBU,
+	MIPS_INS_SUBU_S,
+	MIPS_INS_SUBVI,
+	MIPS_INS_SUBV,
+	MIPS_INS_SUXC1,
+	MIPS_INS_SW,
+	MIPS_INS_SW16,
+	MIPS_INS_SWC1,
+	MIPS_INS_SWC2,
+	MIPS_INS_SWC3,
+	MIPS_INS_SWL,
+	MIPS_INS_SWM16,
+	MIPS_INS_SWM32,
+	MIPS_INS_SWP,
+	MIPS_INS_SWR,
+	MIPS_INS_SWXC1,
+	MIPS_INS_SYNC,
+	MIPS_INS_SYNCI,
+	MIPS_INS_SYSCALL,
+	MIPS_INS_TEQ,
+	MIPS_INS_TEQI,
+	MIPS_INS_TGE,
+	MIPS_INS_TGEI,
+	MIPS_INS_TGEIU,
+	MIPS_INS_TGEU,
+	MIPS_INS_TLBP,
+	MIPS_INS_TLBR,
+	MIPS_INS_TLBWI,
+	MIPS_INS_TLBWR,
+	MIPS_INS_TLT,
+	MIPS_INS_TLTI,
+	MIPS_INS_TLTIU,
+	MIPS_INS_TLTU,
+	MIPS_INS_TNE,
+	MIPS_INS_TNEI,
+	MIPS_INS_TRUNC,
+	MIPS_INS_V3MULU,
+	MIPS_INS_VMM0,
+	MIPS_INS_VMULU,
+	MIPS_INS_VSHF,
+	MIPS_INS_WAIT,
+	MIPS_INS_WRDSP,
+	MIPS_INS_WSBH,
+	MIPS_INS_XOR,
+	MIPS_INS_XOR16,
+	MIPS_INS_XORI,
+
+	//> some alias instructions
+	MIPS_INS_NOP,
+	MIPS_INS_NEGU,
+
+	//> special instructions
+	MIPS_INS_JALR_HB,	// jump and link with Hazard Barrier
+	MIPS_INS_JR_HB,		// jump register with Hazard Barrier
+
+	MIPS_INS_ENDING,
+} mips_insn;
+
+/// Group of MIPS instructions
+typedef enum mips_insn_group {
+	MIPS_GRP_INVALID = 0, ///< = CS_GRP_INVALID
+
+	// Generic groups
+	// all jump instructions (conditional+direct+indirect jumps)
+	MIPS_GRP_JUMP,	///< = CS_GRP_JUMP
+	// all call instructions
+	MIPS_GRP_CALL,	///< = CS_GRP_CALL
+	// all return instructions
+	MIPS_GRP_RET,	///< = CS_GRP_RET
+	// all interrupt instructions (int+syscall)
+	MIPS_GRP_INT,	///< = CS_GRP_INT
+	// all interrupt return instructions
+	MIPS_GRP_IRET,	///< = CS_GRP_IRET
+	// all privileged instructions
+	MIPS_GRP_PRIVILEGE,	///< = CS_GRP_PRIVILEGE
+	// all relative branching instructions
+	MIPS_GRP_BRANCH_RELATIVE, ///< = CS_GRP_BRANCH_RELATIVE
+
+	// Architecture-specific groups
+	MIPS_GRP_BITCOUNT = 128,
+	MIPS_GRP_DSP,
+	MIPS_GRP_DSPR2,
+	MIPS_GRP_FPIDX,
+	MIPS_GRP_MSA,
+	MIPS_GRP_MIPS32R2,
+	MIPS_GRP_MIPS64,
+	MIPS_GRP_MIPS64R2,
+	MIPS_GRP_SEINREG,
+	MIPS_GRP_STDENC,
+	MIPS_GRP_SWAP,
+	MIPS_GRP_MICROMIPS,
+	MIPS_GRP_MIPS16MODE,
+	MIPS_GRP_FP64BIT,
+	MIPS_GRP_NONANSFPMATH,
+	MIPS_GRP_NOTFP64BIT,
+	MIPS_GRP_NOTINMICROMIPS,
+	MIPS_GRP_NOTNACL,
+	MIPS_GRP_NOTMIPS32R6,
+	MIPS_GRP_NOTMIPS64R6,
+	MIPS_GRP_CNMIPS,
+	MIPS_GRP_MIPS32,
+	MIPS_GRP_MIPS32R6,
+	MIPS_GRP_MIPS64R6,
+	MIPS_GRP_MIPS2,
+	MIPS_GRP_MIPS3,
+	MIPS_GRP_MIPS3_32,
+	MIPS_GRP_MIPS3_32R2,
+	MIPS_GRP_MIPS4_32,
+	MIPS_GRP_MIPS4_32R2,
+	MIPS_GRP_MIPS5_32R2,
+	MIPS_GRP_GP32BIT,
+	MIPS_GRP_GP64BIT,
+
+	MIPS_GRP_ENDING,
+} mips_insn_group;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

ai_anti_malware/capstone/include/capstone/platform.h

@@ -0,0 +1,122 @@
+/* Capstone Disassembly Engine */
+/* By Axel Souchet & Nguyen Anh Quynh, 2014 */
+
+#ifndef CAPSTONE_PLATFORM_H
+#define CAPSTONE_PLATFORM_H
+
+
+// handle C99 issue (for pre-2013 VisualStudio)
+#if !defined(__CYGWIN__) && !defined(__MINGW32__) && !defined(__MINGW64__) && (defined (WIN32) || defined (WIN64) || defined (_WIN32) || defined (_WIN64))
+// MSVC
+
+// stdbool.h
+#if (_MSC_VER < 1800) || defined(_KERNEL_MODE)
+// this system does not have stdbool.h
+#ifndef __cplusplus
+typedef unsigned char bool;
+#define false 0
+#define true 1
+#endif  // __cplusplus
+
+#else
+// VisualStudio 2013+ -> C99 is supported
+#include <stdbool.h>
+#endif  // (_MSC_VER < 1800) || defined(_KERNEL_MODE)
+
+#else
+// not MSVC -> C99 is supported
+#include <stdbool.h>
+#endif  // !defined(__CYGWIN__) && !defined(__MINGW32__) && !defined(__MINGW64__) && (defined (WIN32) || defined (WIN64) || defined (_WIN32) || defined (_WIN64))
+
+
+// handle inttypes.h / stdint.h compatibility
+#if defined(_WIN32_WCE) && (_WIN32_WCE < 0x800)
+#include "windowsce/stdint.h"
+#endif  // defined(_WIN32_WCE) && (_WIN32_WCE < 0x800)
+
+#if defined(CAPSTONE_HAS_OSXKERNEL) || (defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE)))
+// this system does not have inttypes.h
+
+#if defined(_MSC_VER) && (_MSC_VER <= 1600 || defined(_KERNEL_MODE))
+// this system does not have stdint.h
+typedef signed char  int8_t;
+typedef signed short int16_t;
+typedef signed int   int32_t;
+typedef unsigned char  uint8_t;
+typedef unsigned short uint16_t;
+typedef unsigned int   uint32_t;
+typedef signed long long   int64_t;
+typedef unsigned long long uint64_t;
+#endif  // defined(_MSC_VER) && (_MSC_VER <= 1600 || defined(_KERNEL_MODE))
+
+#if defined(_MSC_VER) && (_MSC_VER < 1600 || defined(_KERNEL_MODE))
+#define INT8_MIN         (-127i8 - 1)
+#define INT16_MIN        (-32767i16 - 1)
+#define INT32_MIN        (-2147483647i32 - 1)
+#define INT64_MIN        (-9223372036854775807i64 - 1)
+#define INT8_MAX         127i8
+#define INT16_MAX        32767i16
+#define INT32_MAX        2147483647i32
+#define INT64_MAX        9223372036854775807i64
+#define UINT8_MAX        0xffui8
+#define UINT16_MAX       0xffffui16
+#define UINT32_MAX       0xffffffffui32
+#define UINT64_MAX       0xffffffffffffffffui64
+#endif  // defined(_MSC_VER) && (_MSC_VER < 1600 || defined(_KERNEL_MODE))
+
+#ifdef CAPSTONE_HAS_OSXKERNEL
+// this system has stdint.h
+#include <stdint.h>
+#endif
+
+#define __PRI_8_LENGTH_MODIFIER__ "hh"
+#define __PRI_64_LENGTH_MODIFIER__ "ll"
+
+#define PRId8         __PRI_8_LENGTH_MODIFIER__ "d"
+#define PRIi8         __PRI_8_LENGTH_MODIFIER__ "i"
+#define PRIo8         __PRI_8_LENGTH_MODIFIER__ "o"
+#define PRIu8         __PRI_8_LENGTH_MODIFIER__ "u"
+#define PRIx8         __PRI_8_LENGTH_MODIFIER__ "x"
+#define PRIX8         __PRI_8_LENGTH_MODIFIER__ "X"
+
+#define PRId16        "hd"
+#define PRIi16        "hi"
+#define PRIo16        "ho"
+#define PRIu16        "hu"
+#define PRIx16        "hx"
+#define PRIX16        "hX"
+
+#if defined(_MSC_VER) && _MSC_VER <= 1700
+#define PRId32        "ld"
+#define PRIi32        "li"
+#define PRIo32        "lo"
+#define PRIu32        "lu"
+#define PRIx32        "lx"
+#define PRIX32        "lX"
+#else	// OSX
+#define PRId32        "d"
+#define PRIi32        "i"
+#define PRIo32        "o"
+#define PRIu32        "u"
+#define PRIx32        "x"
+#define PRIX32        "X"
+#endif  // defined(_MSC_VER) && _MSC_VER <= 1700
+
+#if defined(_MSC_VER) && _MSC_VER <= 1700
+// redefine functions from inttypes.h used in cstool
+#define strtoull _strtoui64
+#endif
+
+#define PRId64        __PRI_64_LENGTH_MODIFIER__ "d"
+#define PRIi64        __PRI_64_LENGTH_MODIFIER__ "i"
+#define PRIo64        __PRI_64_LENGTH_MODIFIER__ "o"
+#define PRIu64        __PRI_64_LENGTH_MODIFIER__ "u"
+#define PRIx64        __PRI_64_LENGTH_MODIFIER__ "x"
+#define PRIX64        __PRI_64_LENGTH_MODIFIER__ "X"
+
+#else
+// this system has inttypes.h by default
+#include <inttypes.h>
+#endif  // defined(CAPSTONE_HAS_OSXKERNEL) || (defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE)))
+
+#endif

ai_anti_malware/capstone/include/capstone/sparc.h

@@ -0,0 +1,520 @@
+#ifndef CAPSTONE_SPARC_H
+#define CAPSTONE_SPARC_H
+
+/* Capstone Disassembly Engine */
+/* By Nguyen Anh Quynh <aquynh@gmail.com>, 2014-2015 */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "platform.h"
+
+// GCC SPARC toolchain has a default macro called "sparc" which breaks
+// compilation
+#undef sparc
+
+#ifdef _MSC_VER
+#pragma warning(disable:4201)
+#endif
+
+/// Enums corresponding to Sparc condition codes, both icc's and fcc's.
+typedef enum sparc_cc {
+	SPARC_CC_INVALID = 0,	///< invalid CC (default)
+	// Integer condition codes
+	SPARC_CC_ICC_A   =  8+256,  ///< Always
+	SPARC_CC_ICC_N   =  0+256,  ///< Never
+	SPARC_CC_ICC_NE  =  9+256,  ///< Not Equal
+	SPARC_CC_ICC_E   =  1+256,  ///< Equal
+	SPARC_CC_ICC_G   = 10+256,  ///< Greater
+	SPARC_CC_ICC_LE  =  2+256,  ///< Less or Equal
+	SPARC_CC_ICC_GE  = 11+256,  ///< Greater or Equal
+	SPARC_CC_ICC_L   =  3+256,  ///< Less
+	SPARC_CC_ICC_GU  = 12+256,  ///< Greater Unsigned
+	SPARC_CC_ICC_LEU =  4+256,  ///< Less or Equal Unsigned
+	SPARC_CC_ICC_CC  = 13+256,  ///< Carry Clear/Great or Equal Unsigned
+	SPARC_CC_ICC_CS  =  5+256,  ///< Carry Set/Less Unsigned
+	SPARC_CC_ICC_POS = 14+256,  ///< Positive
+	SPARC_CC_ICC_NEG =  6+256,  ///< Negative
+	SPARC_CC_ICC_VC  = 15+256,  ///< Overflow Clear
+	SPARC_CC_ICC_VS  =  7+256,  ///< Overflow Set
+
+	// Floating condition codes
+	SPARC_CC_FCC_A   =  8+16+256,  ///< Always
+	SPARC_CC_FCC_N   =  0+16+256,  ///< Never
+	SPARC_CC_FCC_U   =  7+16+256,  ///< Unordered
+	SPARC_CC_FCC_G   =  6+16+256,  ///< Greater
+	SPARC_CC_FCC_UG  =  5+16+256,  ///< Unordered or Greater
+	SPARC_CC_FCC_L   =  4+16+256,  ///< Less
+	SPARC_CC_FCC_UL  =  3+16+256,  ///< Unordered or Less
+	SPARC_CC_FCC_LG  =  2+16+256,  ///< Less or Greater
+	SPARC_CC_FCC_NE  =  1+16+256,  ///< Not Equal
+	SPARC_CC_FCC_E   =  9+16+256,  ///< Equal
+	SPARC_CC_FCC_UE  = 10+16+256,  ///< Unordered or Equal
+	SPARC_CC_FCC_GE  = 11+16+256,  ///< Greater or Equal
+	SPARC_CC_FCC_UGE = 12+16+256,  ///< Unordered or Greater or Equal
+	SPARC_CC_FCC_LE  = 13+16+256,  ///< Less or Equal
+	SPARC_CC_FCC_ULE = 14+16+256,  ///< Unordered or Less or Equal
+	SPARC_CC_FCC_O   = 15+16+256,  ///< Ordered
+} sparc_cc;
+
+/// Branch hint
+typedef enum sparc_hint {
+	SPARC_HINT_INVALID = 0,	///< no hint
+	SPARC_HINT_A	= 1 << 0,	///< annul delay slot instruction
+	SPARC_HINT_PT	= 1 << 1,	///< branch taken
+	SPARC_HINT_PN	= 1 << 2,	///< branch NOT taken
+} sparc_hint;
+
+/// Operand type for instruction's operands
+typedef enum sparc_op_type {
+	SPARC_OP_INVALID = 0, ///< = CS_OP_INVALID (Uninitialized).
+	SPARC_OP_REG, ///< = CS_OP_REG (Register operand).
+	SPARC_OP_IMM, ///< = CS_OP_IMM (Immediate operand).
+	SPARC_OP_MEM, ///< = CS_OP_MEM (Memory operand).
+} sparc_op_type;
+
+/// SPARC registers
+typedef enum sparc_reg {
+	SPARC_REG_INVALID = 0,
+
+	SPARC_REG_F0,
+	SPARC_REG_F1,
+	SPARC_REG_F2,
+	SPARC_REG_F3,
+	SPARC_REG_F4,
+	SPARC_REG_F5,
+	SPARC_REG_F6,
+	SPARC_REG_F7,
+	SPARC_REG_F8,
+	SPARC_REG_F9,
+	SPARC_REG_F10,
+	SPARC_REG_F11,
+	SPARC_REG_F12,
+	SPARC_REG_F13,
+	SPARC_REG_F14,
+	SPARC_REG_F15,
+	SPARC_REG_F16,
+	SPARC_REG_F17,
+	SPARC_REG_F18,
+	SPARC_REG_F19,
+	SPARC_REG_F20,
+	SPARC_REG_F21,
+	SPARC_REG_F22,
+	SPARC_REG_F23,
+	SPARC_REG_F24,
+	SPARC_REG_F25,
+	SPARC_REG_F26,
+	SPARC_REG_F27,
+	SPARC_REG_F28,
+	SPARC_REG_F29,
+	SPARC_REG_F30,
+	SPARC_REG_F31,
+	SPARC_REG_F32,
+	SPARC_REG_F34,
+	SPARC_REG_F36,
+	SPARC_REG_F38,
+	SPARC_REG_F40,
+	SPARC_REG_F42,
+	SPARC_REG_F44,
+	SPARC_REG_F46,
+	SPARC_REG_F48,
+	SPARC_REG_F50,
+	SPARC_REG_F52,
+	SPARC_REG_F54,
+	SPARC_REG_F56,
+	SPARC_REG_F58,
+	SPARC_REG_F60,
+	SPARC_REG_F62,
+	SPARC_REG_FCC0,	// Floating condition codes
+	SPARC_REG_FCC1,
+	SPARC_REG_FCC2,
+	SPARC_REG_FCC3,
+	SPARC_REG_FP,
+	SPARC_REG_G0,
+	SPARC_REG_G1,
+	SPARC_REG_G2,
+	SPARC_REG_G3,
+	SPARC_REG_G4,
+	SPARC_REG_G5,
+	SPARC_REG_G6,
+	SPARC_REG_G7,
+	SPARC_REG_I0,
+	SPARC_REG_I1,
+	SPARC_REG_I2,
+	SPARC_REG_I3,
+	SPARC_REG_I4,
+	SPARC_REG_I5,
+	SPARC_REG_I7,
+	SPARC_REG_ICC,	// Integer condition codes
+	SPARC_REG_L0,
+	SPARC_REG_L1,
+	SPARC_REG_L2,
+	SPARC_REG_L3,
+	SPARC_REG_L4,
+	SPARC_REG_L5,
+	SPARC_REG_L6,
+	SPARC_REG_L7,
+	SPARC_REG_O0,
+	SPARC_REG_O1,
+	SPARC_REG_O2,
+	SPARC_REG_O3,
+	SPARC_REG_O4,
+	SPARC_REG_O5,
+	SPARC_REG_O7,
+	SPARC_REG_SP,
+	SPARC_REG_Y,
+
+	// special register
+	SPARC_REG_XCC,
+
+	SPARC_REG_ENDING,   // <-- mark the end of the list of registers
+
+	// extras
+	SPARC_REG_O6 = SPARC_REG_SP,
+	SPARC_REG_I6 = SPARC_REG_FP,
+} sparc_reg;
+
+/// Instruction's operand referring to memory
+/// This is associated with SPARC_OP_MEM operand type above
+typedef struct sparc_op_mem {
+	uint8_t base;		///< base register, can be safely interpreted as
+				///< a value of type `sparc_reg`, but it is only
+				///< one byte wide
+	uint8_t index;		///< index register, same conditions apply here
+	int32_t disp;		///< displacement/offset value
+} sparc_op_mem;
+
+/// Instruction operand
+typedef struct cs_sparc_op {
+	sparc_op_type type;	///< operand type
+	union {
+		sparc_reg reg;	///< register value for REG operand
+		int64_t imm;		///< immediate value for IMM operand
+		sparc_op_mem mem;		///< base/disp value for MEM operand
+	};
+} cs_sparc_op;
+
+/// Instruction structure
+typedef struct cs_sparc {
+	sparc_cc cc;	///< code condition for this insn
+	sparc_hint hint;	///< branch hint: encoding as bitwise OR of sparc_hint.
+	/// Number of operands of this instruction,
+	/// or 0 when instruction has no operand.
+	uint8_t op_count;
+	cs_sparc_op operands[4]; ///< operands for this instruction.
+} cs_sparc;
+
+/// SPARC instruction
+typedef enum sparc_insn {
+	SPARC_INS_INVALID = 0,
+
+	SPARC_INS_ADDCC,
+	SPARC_INS_ADDX,
+	SPARC_INS_ADDXCC,
+	SPARC_INS_ADDXC,
+	SPARC_INS_ADDXCCC,
+	SPARC_INS_ADD,
+	SPARC_INS_ALIGNADDR,
+	SPARC_INS_ALIGNADDRL,
+	SPARC_INS_ANDCC,
+	SPARC_INS_ANDNCC,
+	SPARC_INS_ANDN,
+	SPARC_INS_AND,
+	SPARC_INS_ARRAY16,
+	SPARC_INS_ARRAY32,
+	SPARC_INS_ARRAY8,
+	SPARC_INS_B,
+	SPARC_INS_JMP,
+	SPARC_INS_BMASK,
+	SPARC_INS_FB,
+	SPARC_INS_BRGEZ,
+	SPARC_INS_BRGZ,
+	SPARC_INS_BRLEZ,
+	SPARC_INS_BRLZ,
+	SPARC_INS_BRNZ,
+	SPARC_INS_BRZ,
+	SPARC_INS_BSHUFFLE,
+	SPARC_INS_CALL,
+	SPARC_INS_CASX,
+	SPARC_INS_CAS,
+	SPARC_INS_CMASK16,
+	SPARC_INS_CMASK32,
+	SPARC_INS_CMASK8,
+	SPARC_INS_CMP,
+	SPARC_INS_EDGE16,
+	SPARC_INS_EDGE16L,
+	SPARC_INS_EDGE16LN,
+	SPARC_INS_EDGE16N,
+	SPARC_INS_EDGE32,
+	SPARC_INS_EDGE32L,
+	SPARC_INS_EDGE32LN,
+	SPARC_INS_EDGE32N,
+	SPARC_INS_EDGE8,
+	SPARC_INS_EDGE8L,
+	SPARC_INS_EDGE8LN,
+	SPARC_INS_EDGE8N,
+	SPARC_INS_FABSD,
+	SPARC_INS_FABSQ,
+	SPARC_INS_FABSS,
+	SPARC_INS_FADDD,
+	SPARC_INS_FADDQ,
+	SPARC_INS_FADDS,
+	SPARC_INS_FALIGNDATA,
+	SPARC_INS_FAND,
+	SPARC_INS_FANDNOT1,
+	SPARC_INS_FANDNOT1S,
+	SPARC_INS_FANDNOT2,
+	SPARC_INS_FANDNOT2S,
+	SPARC_INS_FANDS,
+	SPARC_INS_FCHKSM16,
+	SPARC_INS_FCMPD,
+	SPARC_INS_FCMPEQ16,
+	SPARC_INS_FCMPEQ32,
+	SPARC_INS_FCMPGT16,
+	SPARC_INS_FCMPGT32,
+	SPARC_INS_FCMPLE16,
+	SPARC_INS_FCMPLE32,
+	SPARC_INS_FCMPNE16,
+	SPARC_INS_FCMPNE32,
+	SPARC_INS_FCMPQ,
+	SPARC_INS_FCMPS,
+	SPARC_INS_FDIVD,
+	SPARC_INS_FDIVQ,
+	SPARC_INS_FDIVS,
+	SPARC_INS_FDMULQ,
+	SPARC_INS_FDTOI,
+	SPARC_INS_FDTOQ,
+	SPARC_INS_FDTOS,
+	SPARC_INS_FDTOX,
+	SPARC_INS_FEXPAND,
+	SPARC_INS_FHADDD,
+	SPARC_INS_FHADDS,
+	SPARC_INS_FHSUBD,
+	SPARC_INS_FHSUBS,
+	SPARC_INS_FITOD,
+	SPARC_INS_FITOQ,
+	SPARC_INS_FITOS,
+	SPARC_INS_FLCMPD,
+	SPARC_INS_FLCMPS,
+	SPARC_INS_FLUSHW,
+	SPARC_INS_FMEAN16,
+	SPARC_INS_FMOVD,
+	SPARC_INS_FMOVQ,
+	SPARC_INS_FMOVRDGEZ,
+	SPARC_INS_FMOVRQGEZ,
+	SPARC_INS_FMOVRSGEZ,
+	SPARC_INS_FMOVRDGZ,
+	SPARC_INS_FMOVRQGZ,
+	SPARC_INS_FMOVRSGZ,
+	SPARC_INS_FMOVRDLEZ,
+	SPARC_INS_FMOVRQLEZ,
+	SPARC_INS_FMOVRSLEZ,
+	SPARC_INS_FMOVRDLZ,
+	SPARC_INS_FMOVRQLZ,
+	SPARC_INS_FMOVRSLZ,
+	SPARC_INS_FMOVRDNZ,
+	SPARC_INS_FMOVRQNZ,
+	SPARC_INS_FMOVRSNZ,
+	SPARC_INS_FMOVRDZ,
+	SPARC_INS_FMOVRQZ,
+	SPARC_INS_FMOVRSZ,
+	SPARC_INS_FMOVS,
+	SPARC_INS_FMUL8SUX16,
+	SPARC_INS_FMUL8ULX16,
+	SPARC_INS_FMUL8X16,
+	SPARC_INS_FMUL8X16AL,
+	SPARC_INS_FMUL8X16AU,
+	SPARC_INS_FMULD,
+	SPARC_INS_FMULD8SUX16,
+	SPARC_INS_FMULD8ULX16,
+	SPARC_INS_FMULQ,
+	SPARC_INS_FMULS,
+	SPARC_INS_FNADDD,
+	SPARC_INS_FNADDS,
+	SPARC_INS_FNAND,
+	SPARC_INS_FNANDS,
+	SPARC_INS_FNEGD,
+	SPARC_INS_FNEGQ,
+	SPARC_INS_FNEGS,
+	SPARC_INS_FNHADDD,
+	SPARC_INS_FNHADDS,
+	SPARC_INS_FNOR,
+	SPARC_INS_FNORS,
+	SPARC_INS_FNOT1,
+	SPARC_INS_FNOT1S,
+	SPARC_INS_FNOT2,
+	SPARC_INS_FNOT2S,
+	SPARC_INS_FONE,
+	SPARC_INS_FONES,
+	SPARC_INS_FOR,
+	SPARC_INS_FORNOT1,
+	SPARC_INS_FORNOT1S,
+	SPARC_INS_FORNOT2,
+	SPARC_INS_FORNOT2S,
+	SPARC_INS_FORS,
+	SPARC_INS_FPACK16,
+	SPARC_INS_FPACK32,
+	SPARC_INS_FPACKFIX,
+	SPARC_INS_FPADD16,
+	SPARC_INS_FPADD16S,
+	SPARC_INS_FPADD32,
+	SPARC_INS_FPADD32S,
+	SPARC_INS_FPADD64,
+	SPARC_INS_FPMERGE,
+	SPARC_INS_FPSUB16,
+	SPARC_INS_FPSUB16S,
+	SPARC_INS_FPSUB32,
+	SPARC_INS_FPSUB32S,
+	SPARC_INS_FQTOD,
+	SPARC_INS_FQTOI,
+	SPARC_INS_FQTOS,
+	SPARC_INS_FQTOX,
+	SPARC_INS_FSLAS16,
+	SPARC_INS_FSLAS32,
+	SPARC_INS_FSLL16,
+	SPARC_INS_FSLL32,
+	SPARC_INS_FSMULD,
+	SPARC_INS_FSQRTD,
+	SPARC_INS_FSQRTQ,
+	SPARC_INS_FSQRTS,
+	SPARC_INS_FSRA16,
+	SPARC_INS_FSRA32,
+	SPARC_INS_FSRC1,
+	SPARC_INS_FSRC1S,
+	SPARC_INS_FSRC2,
+	SPARC_INS_FSRC2S,
+	SPARC_INS_FSRL16,
+	SPARC_INS_FSRL32,
+	SPARC_INS_FSTOD,
+	SPARC_INS_FSTOI,
+	SPARC_INS_FSTOQ,
+	SPARC_INS_FSTOX,
+	SPARC_INS_FSUBD,
+	SPARC_INS_FSUBQ,
+	SPARC_INS_FSUBS,
+	SPARC_INS_FXNOR,
+	SPARC_INS_FXNORS,
+	SPARC_INS_FXOR,
+	SPARC_INS_FXORS,
+	SPARC_INS_FXTOD,
+	SPARC_INS_FXTOQ,
+	SPARC_INS_FXTOS,
+	SPARC_INS_FZERO,
+	SPARC_INS_FZEROS,
+	SPARC_INS_JMPL,
+	SPARC_INS_LDD,
+	SPARC_INS_LD,
+	SPARC_INS_LDQ,
+	SPARC_INS_LDSB,
+	SPARC_INS_LDSH,
+	SPARC_INS_LDSW,
+	SPARC_INS_LDUB,
+	SPARC_INS_LDUH,
+	SPARC_INS_LDX,
+	SPARC_INS_LZCNT,
+	SPARC_INS_MEMBAR,
+	SPARC_INS_MOVDTOX,
+	SPARC_INS_MOV,
+	SPARC_INS_MOVRGEZ,
+	SPARC_INS_MOVRGZ,
+	SPARC_INS_MOVRLEZ,
+	SPARC_INS_MOVRLZ,
+	SPARC_INS_MOVRNZ,
+	SPARC_INS_MOVRZ,
+	SPARC_INS_MOVSTOSW,
+	SPARC_INS_MOVSTOUW,
+	SPARC_INS_MULX,
+	SPARC_INS_NOP,
+	SPARC_INS_ORCC,
+	SPARC_INS_ORNCC,
+	SPARC_INS_ORN,
+	SPARC_INS_OR,
+	SPARC_INS_PDIST,
+	SPARC_INS_PDISTN,
+	SPARC_INS_POPC,
+	SPARC_INS_RD,
+	SPARC_INS_RESTORE,
+	SPARC_INS_RETT,
+	SPARC_INS_SAVE,
+	SPARC_INS_SDIVCC,
+	SPARC_INS_SDIVX,
+	SPARC_INS_SDIV,
+	SPARC_INS_SETHI,
+	SPARC_INS_SHUTDOWN,
+	SPARC_INS_SIAM,
+	SPARC_INS_SLLX,
+	SPARC_INS_SLL,
+	SPARC_INS_SMULCC,
+	SPARC_INS_SMUL,
+	SPARC_INS_SRAX,
+	SPARC_INS_SRA,
+	SPARC_INS_SRLX,
+	SPARC_INS_SRL,
+	SPARC_INS_STBAR,
+	SPARC_INS_STB,
+	SPARC_INS_STD,
+	SPARC_INS_ST,
+	SPARC_INS_STH,
+	SPARC_INS_STQ,
+	SPARC_INS_STX,
+	SPARC_INS_SUBCC,
+	SPARC_INS_SUBX,
+	SPARC_INS_SUBXCC,
+	SPARC_INS_SUB,
+	SPARC_INS_SWAP,
+	SPARC_INS_TADDCCTV,
+	SPARC_INS_TADDCC,
+	SPARC_INS_T,
+	SPARC_INS_TSUBCCTV,
+	SPARC_INS_TSUBCC,
+	SPARC_INS_UDIVCC,
+	SPARC_INS_UDIVX,
+	SPARC_INS_UDIV,
+	SPARC_INS_UMULCC,
+	SPARC_INS_UMULXHI,
+	SPARC_INS_UMUL,
+	SPARC_INS_UNIMP,
+	SPARC_INS_FCMPED,
+	SPARC_INS_FCMPEQ,
+	SPARC_INS_FCMPES,
+	SPARC_INS_WR,
+	SPARC_INS_XMULX,
+	SPARC_INS_XMULXHI,
+	SPARC_INS_XNORCC,
+	SPARC_INS_XNOR,
+	SPARC_INS_XORCC,
+	SPARC_INS_XOR,
+
+	// alias instructions
+	SPARC_INS_RET,
+	SPARC_INS_RETL,
+
+	SPARC_INS_ENDING,   // <-- mark the end of the list of instructions
+} sparc_insn;
+
+/// Group of SPARC instructions
+typedef enum sparc_insn_group {
+	SPARC_GRP_INVALID = 0, ///< = CS_GRP_INVALID
+
+	// Generic groups
+	// all jump instructions (conditional+direct+indirect jumps)
+	SPARC_GRP_JUMP,	///< = CS_GRP_JUMP
+
+	// Architecture-specific groups
+	SPARC_GRP_HARDQUAD = 128,
+	SPARC_GRP_V9,
+	SPARC_GRP_VIS,
+	SPARC_GRP_VIS2,
+	SPARC_GRP_VIS3, 
+	SPARC_GRP_32BIT,
+	SPARC_GRP_64BIT,
+
+	SPARC_GRP_ENDING,   // <-- mark the end of the list of groups
+} sparc_insn_group;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

ai_anti_malware/capstone/include/capstone/systemz.h

@@ -0,0 +1,830 @@
+#ifndef CAPSTONE_SYSTEMZ_H
+#define CAPSTONE_SYSTEMZ_H
+
+/* Capstone Disassembly Engine */
+/* By Nguyen Anh Quynh <aquynh@gmail.com>, 2014-2015 */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "platform.h"
+
+#ifdef _MSC_VER
+#pragma warning(disable:4201)
+#endif
+
+/// Enums corresponding to SystemZ condition codes
+typedef enum sysz_cc {
+	SYSZ_CC_INVALID = 0,	///< invalid CC (default)
+
+	SYSZ_CC_O,
+	SYSZ_CC_H,
+	SYSZ_CC_NLE,
+	SYSZ_CC_L,
+	SYSZ_CC_NHE,
+	SYSZ_CC_LH,
+	SYSZ_CC_NE,
+	SYSZ_CC_E,
+	SYSZ_CC_NLH,
+	SYSZ_CC_HE,
+	SYSZ_CC_NL,
+	SYSZ_CC_LE,
+	SYSZ_CC_NH,
+	SYSZ_CC_NO,
+} sysz_cc;
+
+/// Operand type for instruction's operands
+typedef enum sysz_op_type {
+	SYSZ_OP_INVALID = 0, ///< = CS_OP_INVALID (Uninitialized).
+	SYSZ_OP_REG, ///< = CS_OP_REG (Register operand).
+	SYSZ_OP_IMM, ///< = CS_OP_IMM (Immediate operand).
+	SYSZ_OP_MEM, ///< = CS_OP_MEM (Memory operand).
+	SYSZ_OP_ACREG = 64,	///< Access register operand.
+} sysz_op_type;
+
+/// SystemZ registers
+typedef enum sysz_reg {
+	SYSZ_REG_INVALID = 0,
+
+	SYSZ_REG_0, 
+	SYSZ_REG_1, 
+	SYSZ_REG_2, 
+	SYSZ_REG_3, 
+	SYSZ_REG_4, 
+	SYSZ_REG_5, 
+	SYSZ_REG_6, 
+	SYSZ_REG_7, 
+	SYSZ_REG_8, 
+	SYSZ_REG_9, 
+	SYSZ_REG_10,
+	SYSZ_REG_11,
+	SYSZ_REG_12,
+	SYSZ_REG_13,
+	SYSZ_REG_14,
+	SYSZ_REG_15,
+	SYSZ_REG_CC,
+	SYSZ_REG_F0,
+	SYSZ_REG_F1,
+	SYSZ_REG_F2,
+	SYSZ_REG_F3,
+	SYSZ_REG_F4,
+	SYSZ_REG_F5,
+	SYSZ_REG_F6,
+	SYSZ_REG_F7,
+	SYSZ_REG_F8,
+	SYSZ_REG_F9,
+	SYSZ_REG_F10,
+	SYSZ_REG_F11,
+	SYSZ_REG_F12,
+	SYSZ_REG_F13,
+	SYSZ_REG_F14,
+	SYSZ_REG_F15,
+
+	SYSZ_REG_R0L,
+
+	SYSZ_REG_ENDING,
+} sysz_reg;
+
+/// Instruction's operand referring to memory
+/// This is associated with SYSZ_OP_MEM operand type above
+typedef struct sysz_op_mem {
+	uint8_t base;		///< base register, can be safely interpreted as
+				///< a value of type `sysz_reg`, but it is only
+				///< one byte wide
+	uint8_t index;		///< index register, same conditions apply here
+	uint64_t length;	///< BDLAddr operand
+	int64_t disp;	///< displacement/offset value
+} sysz_op_mem;
+
+/// Instruction operand
+typedef struct cs_sysz_op {
+	sysz_op_type type;	///< operand type
+	union {
+		sysz_reg reg;		///< register value for REG operand
+		int64_t imm;		///< immediate value for IMM operand
+		sysz_op_mem mem;	///< base/disp value for MEM operand
+	};
+} cs_sysz_op;
+
+// Instruction structure
+typedef struct cs_sysz {
+	sysz_cc cc;		///< Code condition
+	/// Number of operands of this instruction,
+	/// or 0 when instruction has no operand.
+	uint8_t op_count;
+	cs_sysz_op operands[6]; ///< operands for this instruction.
+} cs_sysz;
+
+/// SystemZ instruction
+typedef enum sysz_insn {
+	SYSZ_INS_INVALID = 0,
+
+	SYSZ_INS_A,
+	SYSZ_INS_ADB,
+	SYSZ_INS_ADBR,
+	SYSZ_INS_AEB,
+	SYSZ_INS_AEBR,
+	SYSZ_INS_AFI,
+	SYSZ_INS_AG,
+	SYSZ_INS_AGF,
+	SYSZ_INS_AGFI,
+	SYSZ_INS_AGFR,
+	SYSZ_INS_AGHI,
+	SYSZ_INS_AGHIK,
+	SYSZ_INS_AGR,
+	SYSZ_INS_AGRK,
+	SYSZ_INS_AGSI,
+	SYSZ_INS_AH,
+	SYSZ_INS_AHI,
+	SYSZ_INS_AHIK,
+	SYSZ_INS_AHY,
+	SYSZ_INS_AIH,
+	SYSZ_INS_AL,
+	SYSZ_INS_ALC,
+	SYSZ_INS_ALCG,
+	SYSZ_INS_ALCGR,
+	SYSZ_INS_ALCR,
+	SYSZ_INS_ALFI,
+	SYSZ_INS_ALG,
+	SYSZ_INS_ALGF,
+	SYSZ_INS_ALGFI,
+	SYSZ_INS_ALGFR,
+	SYSZ_INS_ALGHSIK,
+	SYSZ_INS_ALGR,
+	SYSZ_INS_ALGRK,
+	SYSZ_INS_ALHSIK,
+	SYSZ_INS_ALR,
+	SYSZ_INS_ALRK,
+	SYSZ_INS_ALY,
+	SYSZ_INS_AR,
+	SYSZ_INS_ARK,
+	SYSZ_INS_ASI,
+	SYSZ_INS_AXBR,
+	SYSZ_INS_AY,
+	SYSZ_INS_BCR,
+	SYSZ_INS_BRC,
+	SYSZ_INS_BRCL,
+	SYSZ_INS_CGIJ,
+	SYSZ_INS_CGRJ,
+	SYSZ_INS_CIJ,
+	SYSZ_INS_CLGIJ,
+	SYSZ_INS_CLGRJ,
+	SYSZ_INS_CLIJ,
+	SYSZ_INS_CLRJ,
+	SYSZ_INS_CRJ,
+	SYSZ_INS_BER,
+	SYSZ_INS_JE,
+	SYSZ_INS_JGE,
+	SYSZ_INS_LOCE,
+	SYSZ_INS_LOCGE,
+	SYSZ_INS_LOCGRE,
+	SYSZ_INS_LOCRE,
+	SYSZ_INS_STOCE,
+	SYSZ_INS_STOCGE,
+	SYSZ_INS_BHR,
+	SYSZ_INS_BHER,
+	SYSZ_INS_JHE,
+	SYSZ_INS_JGHE,
+	SYSZ_INS_LOCHE,
+	SYSZ_INS_LOCGHE,
+	SYSZ_INS_LOCGRHE,
+	SYSZ_INS_LOCRHE,
+	SYSZ_INS_STOCHE,
+	SYSZ_INS_STOCGHE,
+	SYSZ_INS_JH,
+	SYSZ_INS_JGH,
+	SYSZ_INS_LOCH,
+	SYSZ_INS_LOCGH,
+	SYSZ_INS_LOCGRH,
+	SYSZ_INS_LOCRH,
+	SYSZ_INS_STOCH,
+	SYSZ_INS_STOCGH,
+	SYSZ_INS_CGIJNLH,
+	SYSZ_INS_CGRJNLH,
+	SYSZ_INS_CIJNLH,
+	SYSZ_INS_CLGIJNLH,
+	SYSZ_INS_CLGRJNLH,
+	SYSZ_INS_CLIJNLH,
+	SYSZ_INS_CLRJNLH,
+	SYSZ_INS_CRJNLH,
+	SYSZ_INS_CGIJE,
+	SYSZ_INS_CGRJE,
+	SYSZ_INS_CIJE,
+	SYSZ_INS_CLGIJE,
+	SYSZ_INS_CLGRJE,
+	SYSZ_INS_CLIJE,
+	SYSZ_INS_CLRJE,
+	SYSZ_INS_CRJE,
+	SYSZ_INS_CGIJNLE,
+	SYSZ_INS_CGRJNLE,
+	SYSZ_INS_CIJNLE,
+	SYSZ_INS_CLGIJNLE,
+	SYSZ_INS_CLGRJNLE,
+	SYSZ_INS_CLIJNLE,
+	SYSZ_INS_CLRJNLE,
+	SYSZ_INS_CRJNLE,
+	SYSZ_INS_CGIJH,
+	SYSZ_INS_CGRJH,
+	SYSZ_INS_CIJH,
+	SYSZ_INS_CLGIJH,
+	SYSZ_INS_CLGRJH,
+	SYSZ_INS_CLIJH,
+	SYSZ_INS_CLRJH,
+	SYSZ_INS_CRJH,
+	SYSZ_INS_CGIJNL,
+	SYSZ_INS_CGRJNL,
+	SYSZ_INS_CIJNL,
+	SYSZ_INS_CLGIJNL,
+	SYSZ_INS_CLGRJNL,
+	SYSZ_INS_CLIJNL,
+	SYSZ_INS_CLRJNL,
+	SYSZ_INS_CRJNL,
+	SYSZ_INS_CGIJHE,
+	SYSZ_INS_CGRJHE,
+	SYSZ_INS_CIJHE,
+	SYSZ_INS_CLGIJHE,
+	SYSZ_INS_CLGRJHE,
+	SYSZ_INS_CLIJHE,
+	SYSZ_INS_CLRJHE,
+	SYSZ_INS_CRJHE,
+	SYSZ_INS_CGIJNHE,
+	SYSZ_INS_CGRJNHE,
+	SYSZ_INS_CIJNHE,
+	SYSZ_INS_CLGIJNHE,
+	SYSZ_INS_CLGRJNHE,
+	SYSZ_INS_CLIJNHE,
+	SYSZ_INS_CLRJNHE,
+	SYSZ_INS_CRJNHE,
+	SYSZ_INS_CGIJL,
+	SYSZ_INS_CGRJL,
+	SYSZ_INS_CIJL,
+	SYSZ_INS_CLGIJL,
+	SYSZ_INS_CLGRJL,
+	SYSZ_INS_CLIJL,
+	SYSZ_INS_CLRJL,
+	SYSZ_INS_CRJL,
+	SYSZ_INS_CGIJNH,
+	SYSZ_INS_CGRJNH,
+	SYSZ_INS_CIJNH,
+	SYSZ_INS_CLGIJNH,
+	SYSZ_INS_CLGRJNH,
+	SYSZ_INS_CLIJNH,
+	SYSZ_INS_CLRJNH,
+	SYSZ_INS_CRJNH,
+	SYSZ_INS_CGIJLE,
+	SYSZ_INS_CGRJLE,
+	SYSZ_INS_CIJLE,
+	SYSZ_INS_CLGIJLE,
+	SYSZ_INS_CLGRJLE,
+	SYSZ_INS_CLIJLE,
+	SYSZ_INS_CLRJLE,
+	SYSZ_INS_CRJLE,
+	SYSZ_INS_CGIJNE,
+	SYSZ_INS_CGRJNE,
+	SYSZ_INS_CIJNE,
+	SYSZ_INS_CLGIJNE,
+	SYSZ_INS_CLGRJNE,
+	SYSZ_INS_CLIJNE,
+	SYSZ_INS_CLRJNE,
+	SYSZ_INS_CRJNE,
+	SYSZ_INS_CGIJLH,
+	SYSZ_INS_CGRJLH,
+	SYSZ_INS_CIJLH,
+	SYSZ_INS_CLGIJLH,
+	SYSZ_INS_CLGRJLH,
+	SYSZ_INS_CLIJLH,
+	SYSZ_INS_CLRJLH,
+	SYSZ_INS_CRJLH,
+	SYSZ_INS_BLR,
+	SYSZ_INS_BLER,
+	SYSZ_INS_JLE,
+	SYSZ_INS_JGLE,
+	SYSZ_INS_LOCLE,
+	SYSZ_INS_LOCGLE,
+	SYSZ_INS_LOCGRLE,
+	SYSZ_INS_LOCRLE,
+	SYSZ_INS_STOCLE,
+	SYSZ_INS_STOCGLE,
+	SYSZ_INS_BLHR,
+	SYSZ_INS_JLH,
+	SYSZ_INS_JGLH,
+	SYSZ_INS_LOCLH,
+	SYSZ_INS_LOCGLH,
+	SYSZ_INS_LOCGRLH,
+	SYSZ_INS_LOCRLH,
+	SYSZ_INS_STOCLH,
+	SYSZ_INS_STOCGLH,
+	SYSZ_INS_JL,
+	SYSZ_INS_JGL,
+	SYSZ_INS_LOCL,
+	SYSZ_INS_LOCGL,
+	SYSZ_INS_LOCGRL,
+	SYSZ_INS_LOCRL,
+	SYSZ_INS_LOC,
+	SYSZ_INS_LOCG,
+	SYSZ_INS_LOCGR,
+	SYSZ_INS_LOCR,
+	SYSZ_INS_STOCL,
+	SYSZ_INS_STOCGL,
+	SYSZ_INS_BNER,
+	SYSZ_INS_JNE,
+	SYSZ_INS_JGNE,
+	SYSZ_INS_LOCNE,
+	SYSZ_INS_LOCGNE,
+	SYSZ_INS_LOCGRNE,
+	SYSZ_INS_LOCRNE,
+	SYSZ_INS_STOCNE,
+	SYSZ_INS_STOCGNE,
+	SYSZ_INS_BNHR,
+	SYSZ_INS_BNHER,
+	SYSZ_INS_JNHE,
+	SYSZ_INS_JGNHE,
+	SYSZ_INS_LOCNHE,
+	SYSZ_INS_LOCGNHE,
+	SYSZ_INS_LOCGRNHE,
+	SYSZ_INS_LOCRNHE,
+	SYSZ_INS_STOCNHE,
+	SYSZ_INS_STOCGNHE,
+	SYSZ_INS_JNH,
+	SYSZ_INS_JGNH,
+	SYSZ_INS_LOCNH,
+	SYSZ_INS_LOCGNH,
+	SYSZ_INS_LOCGRNH,
+	SYSZ_INS_LOCRNH,
+	SYSZ_INS_STOCNH,
+	SYSZ_INS_STOCGNH,
+	SYSZ_INS_BNLR,
+	SYSZ_INS_BNLER,
+	SYSZ_INS_JNLE,
+	SYSZ_INS_JGNLE,
+	SYSZ_INS_LOCNLE,
+	SYSZ_INS_LOCGNLE,
+	SYSZ_INS_LOCGRNLE,
+	SYSZ_INS_LOCRNLE,
+	SYSZ_INS_STOCNLE,
+	SYSZ_INS_STOCGNLE,
+	SYSZ_INS_BNLHR,
+	SYSZ_INS_JNLH,
+	SYSZ_INS_JGNLH,
+	SYSZ_INS_LOCNLH,
+	SYSZ_INS_LOCGNLH,
+	SYSZ_INS_LOCGRNLH,
+	SYSZ_INS_LOCRNLH,
+	SYSZ_INS_STOCNLH,
+	SYSZ_INS_STOCGNLH,
+	SYSZ_INS_JNL,
+	SYSZ_INS_JGNL,
+	SYSZ_INS_LOCNL,
+	SYSZ_INS_LOCGNL,
+	SYSZ_INS_LOCGRNL,
+	SYSZ_INS_LOCRNL,
+	SYSZ_INS_STOCNL,
+	SYSZ_INS_STOCGNL,
+	SYSZ_INS_BNOR,
+	SYSZ_INS_JNO,
+	SYSZ_INS_JGNO,
+	SYSZ_INS_LOCNO,
+	SYSZ_INS_LOCGNO,
+	SYSZ_INS_LOCGRNO,
+	SYSZ_INS_LOCRNO,
+	SYSZ_INS_STOCNO,
+	SYSZ_INS_STOCGNO,
+	SYSZ_INS_BOR,
+	SYSZ_INS_JO,
+	SYSZ_INS_JGO,
+	SYSZ_INS_LOCO,
+	SYSZ_INS_LOCGO,
+	SYSZ_INS_LOCGRO,
+	SYSZ_INS_LOCRO,
+	SYSZ_INS_STOCO,
+	SYSZ_INS_STOCGO,
+	SYSZ_INS_STOC,
+	SYSZ_INS_STOCG,
+	SYSZ_INS_BASR,
+	SYSZ_INS_BR,
+	SYSZ_INS_BRAS,
+	SYSZ_INS_BRASL,
+	SYSZ_INS_J,
+	SYSZ_INS_JG,
+	SYSZ_INS_BRCT,
+	SYSZ_INS_BRCTG,
+	SYSZ_INS_C,
+	SYSZ_INS_CDB,
+	SYSZ_INS_CDBR,
+	SYSZ_INS_CDFBR,
+	SYSZ_INS_CDGBR,
+	SYSZ_INS_CDLFBR,
+	SYSZ_INS_CDLGBR,
+	SYSZ_INS_CEB,
+	SYSZ_INS_CEBR,
+	SYSZ_INS_CEFBR,
+	SYSZ_INS_CEGBR,
+	SYSZ_INS_CELFBR,
+	SYSZ_INS_CELGBR,
+	SYSZ_INS_CFDBR,
+	SYSZ_INS_CFEBR,
+	SYSZ_INS_CFI,
+	SYSZ_INS_CFXBR,
+	SYSZ_INS_CG,
+	SYSZ_INS_CGDBR,
+	SYSZ_INS_CGEBR,
+	SYSZ_INS_CGF,
+	SYSZ_INS_CGFI,
+	SYSZ_INS_CGFR,
+	SYSZ_INS_CGFRL,
+	SYSZ_INS_CGH,
+	SYSZ_INS_CGHI,
+	SYSZ_INS_CGHRL,
+	SYSZ_INS_CGHSI,
+	SYSZ_INS_CGR,
+	SYSZ_INS_CGRL,
+	SYSZ_INS_CGXBR,
+	SYSZ_INS_CH,
+	SYSZ_INS_CHF,
+	SYSZ_INS_CHHSI,
+	SYSZ_INS_CHI,
+	SYSZ_INS_CHRL,
+	SYSZ_INS_CHSI,
+	SYSZ_INS_CHY,
+	SYSZ_INS_CIH,
+	SYSZ_INS_CL,
+	SYSZ_INS_CLC,
+	SYSZ_INS_CLFDBR,
+	SYSZ_INS_CLFEBR,
+	SYSZ_INS_CLFHSI,
+	SYSZ_INS_CLFI,
+	SYSZ_INS_CLFXBR,
+	SYSZ_INS_CLG,
+	SYSZ_INS_CLGDBR,
+	SYSZ_INS_CLGEBR,
+	SYSZ_INS_CLGF,
+	SYSZ_INS_CLGFI,
+	SYSZ_INS_CLGFR,
+	SYSZ_INS_CLGFRL,
+	SYSZ_INS_CLGHRL,
+	SYSZ_INS_CLGHSI,
+	SYSZ_INS_CLGR,
+	SYSZ_INS_CLGRL,
+	SYSZ_INS_CLGXBR,
+	SYSZ_INS_CLHF,
+	SYSZ_INS_CLHHSI,
+	SYSZ_INS_CLHRL,
+	SYSZ_INS_CLI,
+	SYSZ_INS_CLIH,
+	SYSZ_INS_CLIY,
+	SYSZ_INS_CLR,
+	SYSZ_INS_CLRL,
+	SYSZ_INS_CLST,
+	SYSZ_INS_CLY,
+	SYSZ_INS_CPSDR,
+	SYSZ_INS_CR,
+	SYSZ_INS_CRL,
+	SYSZ_INS_CS,
+	SYSZ_INS_CSG,
+	SYSZ_INS_CSY,
+	SYSZ_INS_CXBR,
+	SYSZ_INS_CXFBR,
+	SYSZ_INS_CXGBR,
+	SYSZ_INS_CXLFBR,
+	SYSZ_INS_CXLGBR,
+	SYSZ_INS_CY,
+	SYSZ_INS_DDB,
+	SYSZ_INS_DDBR,
+	SYSZ_INS_DEB,
+	SYSZ_INS_DEBR,
+	SYSZ_INS_DL,
+	SYSZ_INS_DLG,
+	SYSZ_INS_DLGR,
+	SYSZ_INS_DLR,
+	SYSZ_INS_DSG,
+	SYSZ_INS_DSGF,
+	SYSZ_INS_DSGFR,
+	SYSZ_INS_DSGR,
+	SYSZ_INS_DXBR,
+	SYSZ_INS_EAR,
+	SYSZ_INS_FIDBR,
+	SYSZ_INS_FIDBRA,
+	SYSZ_INS_FIEBR,
+	SYSZ_INS_FIEBRA,
+	SYSZ_INS_FIXBR,
+	SYSZ_INS_FIXBRA,
+	SYSZ_INS_FLOGR,
+	SYSZ_INS_IC,
+	SYSZ_INS_ICY,
+	SYSZ_INS_IIHF,
+	SYSZ_INS_IIHH,
+	SYSZ_INS_IIHL,
+	SYSZ_INS_IILF,
+	SYSZ_INS_IILH,
+	SYSZ_INS_IILL,
+	SYSZ_INS_IPM,
+	SYSZ_INS_L,
+	SYSZ_INS_LA,
+	SYSZ_INS_LAA,
+	SYSZ_INS_LAAG,
+	SYSZ_INS_LAAL,
+	SYSZ_INS_LAALG,
+	SYSZ_INS_LAN,
+	SYSZ_INS_LANG,
+	SYSZ_INS_LAO,
+	SYSZ_INS_LAOG,
+	SYSZ_INS_LARL,
+	SYSZ_INS_LAX,
+	SYSZ_INS_LAXG,
+	SYSZ_INS_LAY,
+	SYSZ_INS_LB,
+	SYSZ_INS_LBH,
+	SYSZ_INS_LBR,
+	SYSZ_INS_LCDBR,
+	SYSZ_INS_LCEBR,
+	SYSZ_INS_LCGFR,
+	SYSZ_INS_LCGR,
+	SYSZ_INS_LCR,
+	SYSZ_INS_LCXBR,
+	SYSZ_INS_LD,
+	SYSZ_INS_LDEB,
+	SYSZ_INS_LDEBR,
+	SYSZ_INS_LDGR,
+	SYSZ_INS_LDR,
+	SYSZ_INS_LDXBR,
+	SYSZ_INS_LDXBRA,
+	SYSZ_INS_LDY,
+	SYSZ_INS_LE,
+	SYSZ_INS_LEDBR,
+	SYSZ_INS_LEDBRA,
+	SYSZ_INS_LER,
+	SYSZ_INS_LEXBR,
+	SYSZ_INS_LEXBRA,
+	SYSZ_INS_LEY,
+	SYSZ_INS_LFH,
+	SYSZ_INS_LG,
+	SYSZ_INS_LGB,
+	SYSZ_INS_LGBR,
+	SYSZ_INS_LGDR,
+	SYSZ_INS_LGF,
+	SYSZ_INS_LGFI,
+	SYSZ_INS_LGFR,
+	SYSZ_INS_LGFRL,
+	SYSZ_INS_LGH,
+	SYSZ_INS_LGHI,
+	SYSZ_INS_LGHR,
+	SYSZ_INS_LGHRL,
+	SYSZ_INS_LGR,
+	SYSZ_INS_LGRL,
+	SYSZ_INS_LH,
+	SYSZ_INS_LHH,
+	SYSZ_INS_LHI,
+	SYSZ_INS_LHR,
+	SYSZ_INS_LHRL,
+	SYSZ_INS_LHY,
+	SYSZ_INS_LLC,
+	SYSZ_INS_LLCH,
+	SYSZ_INS_LLCR,
+	SYSZ_INS_LLGC,
+	SYSZ_INS_LLGCR,
+	SYSZ_INS_LLGF,
+	SYSZ_INS_LLGFR,
+	SYSZ_INS_LLGFRL,
+	SYSZ_INS_LLGH,
+	SYSZ_INS_LLGHR,
+	SYSZ_INS_LLGHRL,
+	SYSZ_INS_LLH,
+	SYSZ_INS_LLHH,
+	SYSZ_INS_LLHR,
+	SYSZ_INS_LLHRL,
+	SYSZ_INS_LLIHF,
+	SYSZ_INS_LLIHH,
+	SYSZ_INS_LLIHL,
+	SYSZ_INS_LLILF,
+	SYSZ_INS_LLILH,
+	SYSZ_INS_LLILL,
+	SYSZ_INS_LMG,
+	SYSZ_INS_LNDBR,
+	SYSZ_INS_LNEBR,
+	SYSZ_INS_LNGFR,
+	SYSZ_INS_LNGR,
+	SYSZ_INS_LNR,
+	SYSZ_INS_LNXBR,
+	SYSZ_INS_LPDBR,
+	SYSZ_INS_LPEBR,
+	SYSZ_INS_LPGFR,
+	SYSZ_INS_LPGR,
+	SYSZ_INS_LPR,
+	SYSZ_INS_LPXBR,
+	SYSZ_INS_LR,
+	SYSZ_INS_LRL,
+	SYSZ_INS_LRV,
+	SYSZ_INS_LRVG,
+	SYSZ_INS_LRVGR,
+	SYSZ_INS_LRVR,
+	SYSZ_INS_LT,
+	SYSZ_INS_LTDBR,
+	SYSZ_INS_LTEBR,
+	SYSZ_INS_LTG,
+	SYSZ_INS_LTGF,
+	SYSZ_INS_LTGFR,
+	SYSZ_INS_LTGR,
+	SYSZ_INS_LTR,
+	SYSZ_INS_LTXBR,
+	SYSZ_INS_LXDB,
+	SYSZ_INS_LXDBR,
+	SYSZ_INS_LXEB,
+	SYSZ_INS_LXEBR,
+	SYSZ_INS_LXR,
+	SYSZ_INS_LY,
+	SYSZ_INS_LZDR,
+	SYSZ_INS_LZER,
+	SYSZ_INS_LZXR,
+	SYSZ_INS_MADB,
+	SYSZ_INS_MADBR,
+	SYSZ_INS_MAEB,
+	SYSZ_INS_MAEBR,
+	SYSZ_INS_MDB,
+	SYSZ_INS_MDBR,
+	SYSZ_INS_MDEB,
+	SYSZ_INS_MDEBR,
+	SYSZ_INS_MEEB,
+	SYSZ_INS_MEEBR,
+	SYSZ_INS_MGHI,
+	SYSZ_INS_MH,
+	SYSZ_INS_MHI,
+	SYSZ_INS_MHY,
+	SYSZ_INS_MLG,
+	SYSZ_INS_MLGR,
+	SYSZ_INS_MS,
+	SYSZ_INS_MSDB,
+	SYSZ_INS_MSDBR,
+	SYSZ_INS_MSEB,
+	SYSZ_INS_MSEBR,
+	SYSZ_INS_MSFI,
+	SYSZ_INS_MSG,
+	SYSZ_INS_MSGF,
+	SYSZ_INS_MSGFI,
+	SYSZ_INS_MSGFR,
+	SYSZ_INS_MSGR,
+	SYSZ_INS_MSR,
+	SYSZ_INS_MSY,
+	SYSZ_INS_MVC,
+	SYSZ_INS_MVGHI,
+	SYSZ_INS_MVHHI,
+	SYSZ_INS_MVHI,
+	SYSZ_INS_MVI,
+	SYSZ_INS_MVIY,
+	SYSZ_INS_MVST,
+	SYSZ_INS_MXBR,
+	SYSZ_INS_MXDB,
+	SYSZ_INS_MXDBR,
+	SYSZ_INS_N,
+	SYSZ_INS_NC,
+	SYSZ_INS_NG,
+	SYSZ_INS_NGR,
+	SYSZ_INS_NGRK,
+	SYSZ_INS_NI,
+	SYSZ_INS_NIHF,
+	SYSZ_INS_NIHH,
+	SYSZ_INS_NIHL,
+	SYSZ_INS_NILF,
+	SYSZ_INS_NILH,
+	SYSZ_INS_NILL,
+	SYSZ_INS_NIY,
+	SYSZ_INS_NR,
+	SYSZ_INS_NRK,
+	SYSZ_INS_NY,
+	SYSZ_INS_O,
+	SYSZ_INS_OC,
+	SYSZ_INS_OG,
+	SYSZ_INS_OGR,
+	SYSZ_INS_OGRK,
+	SYSZ_INS_OI,
+	SYSZ_INS_OIHF,
+	SYSZ_INS_OIHH,
+	SYSZ_INS_OIHL,
+	SYSZ_INS_OILF,
+	SYSZ_INS_OILH,
+	SYSZ_INS_OILL,
+	SYSZ_INS_OIY,
+	SYSZ_INS_OR,
+	SYSZ_INS_ORK,
+	SYSZ_INS_OY,
+	SYSZ_INS_PFD,
+	SYSZ_INS_PFDRL,
+	SYSZ_INS_RISBG,
+	SYSZ_INS_RISBHG,
+	SYSZ_INS_RISBLG,
+	SYSZ_INS_RLL,
+	SYSZ_INS_RLLG,
+	SYSZ_INS_RNSBG,
+	SYSZ_INS_ROSBG,
+	SYSZ_INS_RXSBG,
+	SYSZ_INS_S,
+	SYSZ_INS_SDB,
+	SYSZ_INS_SDBR,
+	SYSZ_INS_SEB,
+	SYSZ_INS_SEBR,
+	SYSZ_INS_SG,
+	SYSZ_INS_SGF,
+	SYSZ_INS_SGFR,
+	SYSZ_INS_SGR,
+	SYSZ_INS_SGRK,
+	SYSZ_INS_SH,
+	SYSZ_INS_SHY,
+	SYSZ_INS_SL,
+	SYSZ_INS_SLB,
+	SYSZ_INS_SLBG,
+	SYSZ_INS_SLBR,
+	SYSZ_INS_SLFI,
+	SYSZ_INS_SLG,
+	SYSZ_INS_SLBGR,
+	SYSZ_INS_SLGF,
+	SYSZ_INS_SLGFI,
+	SYSZ_INS_SLGFR,
+	SYSZ_INS_SLGR,
+	SYSZ_INS_SLGRK,
+	SYSZ_INS_SLL,
+	SYSZ_INS_SLLG,
+	SYSZ_INS_SLLK,
+	SYSZ_INS_SLR,
+	SYSZ_INS_SLRK,
+	SYSZ_INS_SLY,
+	SYSZ_INS_SQDB,
+	SYSZ_INS_SQDBR,
+	SYSZ_INS_SQEB,
+	SYSZ_INS_SQEBR,
+	SYSZ_INS_SQXBR,
+	SYSZ_INS_SR,
+	SYSZ_INS_SRA,
+	SYSZ_INS_SRAG,
+	SYSZ_INS_SRAK,
+	SYSZ_INS_SRK,
+	SYSZ_INS_SRL,
+	SYSZ_INS_SRLG,
+	SYSZ_INS_SRLK,
+	SYSZ_INS_SRST,
+	SYSZ_INS_ST,
+	SYSZ_INS_STC,
+	SYSZ_INS_STCH,
+	SYSZ_INS_STCY,
+	SYSZ_INS_STD,
+	SYSZ_INS_STDY,
+	SYSZ_INS_STE,
+	SYSZ_INS_STEY,
+	SYSZ_INS_STFH,
+	SYSZ_INS_STG,
+	SYSZ_INS_STGRL,
+	SYSZ_INS_STH,
+	SYSZ_INS_STHH,
+	SYSZ_INS_STHRL,
+	SYSZ_INS_STHY,
+	SYSZ_INS_STMG,
+	SYSZ_INS_STRL,
+	SYSZ_INS_STRV,
+	SYSZ_INS_STRVG,
+	SYSZ_INS_STY,
+	SYSZ_INS_SXBR,
+	SYSZ_INS_SY,
+	SYSZ_INS_TM,
+	SYSZ_INS_TMHH,
+	SYSZ_INS_TMHL,
+	SYSZ_INS_TMLH,
+	SYSZ_INS_TMLL,
+	SYSZ_INS_TMY,
+	SYSZ_INS_X,
+	SYSZ_INS_XC,
+	SYSZ_INS_XG,
+	SYSZ_INS_XGR,
+	SYSZ_INS_XGRK,
+	SYSZ_INS_XI,
+	SYSZ_INS_XIHF,
+	SYSZ_INS_XILF,
+	SYSZ_INS_XIY,
+	SYSZ_INS_XR,
+	SYSZ_INS_XRK,
+	SYSZ_INS_XY,
+
+	SYSZ_INS_ENDING,   // <-- mark the end of the list of instructions
+} sysz_insn;
+
+/// Group of SystemZ instructions
+typedef enum sysz_insn_group {
+	SYSZ_GRP_INVALID = 0, ///< = CS_GRP_INVALID
+
+	// Generic groups
+	// all jump instructions (conditional+direct+indirect jumps)
+	SYSZ_GRP_JUMP,	///< = CS_GRP_JUMP
+
+	// Architecture-specific groups
+	SYSZ_GRP_DISTINCTOPS = 128,
+	SYSZ_GRP_FPEXTENSION,
+	SYSZ_GRP_HIGHWORD,
+	SYSZ_GRP_INTERLOCKEDACCESS1,
+	SYSZ_GRP_LOADSTOREONCOND,
+
+	SYSZ_GRP_ENDING,   // <-- mark the end of the list of groups
+} sysz_insn_group;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

ai_anti_malware/capstone/include/capstone/tms320c64x.h

@@ -0,0 +1,359 @@
+/* Capstone Disassembly Engine */
+/* TMS320C64x Backend by Fotis Loukos <me@fotisl.com> 2016 */
+
+#ifndef CAPSTONE_TMS320C64X_H
+#define CAPSTONE_TMS320C64X_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stdint.h>
+#include "platform.h"
+
+#ifdef _MSC_VER
+#pragma warning(disable:4201)
+#endif
+
+typedef enum tms320c64x_op_type {
+	TMS320C64X_OP_INVALID = 0, ///< = CS_OP_INVALID (Uninitialized).
+	TMS320C64X_OP_REG, ///< = CS_OP_REG (Register operand).
+	TMS320C64X_OP_IMM, ///< = CS_OP_IMM (Immediate operand).
+	TMS320C64X_OP_MEM, ///< = CS_OP_MEM (Memory operand).
+	TMS320C64X_OP_REGPAIR = 64, ///< Register pair for double word ops
+} tms320c64x_op_type;
+
+typedef enum tms320c64x_mem_disp {
+	TMS320C64X_MEM_DISP_INVALID = 0,
+	TMS320C64X_MEM_DISP_CONSTANT,
+	TMS320C64X_MEM_DISP_REGISTER,
+} tms320c64x_mem_disp;
+
+typedef enum tms320c64x_mem_dir {
+	TMS320C64X_MEM_DIR_INVALID = 0,
+	TMS320C64X_MEM_DIR_FW,
+	TMS320C64X_MEM_DIR_BW,
+} tms320c64x_mem_dir;
+
+typedef enum tms320c64x_mem_mod {
+	TMS320C64X_MEM_MOD_INVALID = 0,
+	TMS320C64X_MEM_MOD_NO,
+	TMS320C64X_MEM_MOD_PRE,
+	TMS320C64X_MEM_MOD_POST,
+} tms320c64x_mem_mod;
+
+typedef struct tms320c64x_op_mem {
+	unsigned int	base;	///< base register
+	unsigned int	disp;	///< displacement/offset value
+	unsigned int	unit;	///< unit of base and offset register
+	unsigned int	scaled;	///< offset scaled
+	unsigned int	disptype;	///< displacement type
+	unsigned int	direction;	///< direction
+	unsigned int	modify;	///< modification
+} tms320c64x_op_mem;
+
+typedef struct cs_tms320c64x_op {
+	tms320c64x_op_type type;	///< operand type
+	union {
+		unsigned int reg;	///< register value for REG operand or first register for REGPAIR operand
+		int32_t imm;		///< immediate value for IMM operand
+		tms320c64x_op_mem mem;		///< base/disp value for MEM operand
+	};
+} cs_tms320c64x_op;
+
+typedef struct cs_tms320c64x {
+	uint8_t op_count;
+	cs_tms320c64x_op operands[8]; ///< operands for this instruction.
+	struct {
+		unsigned int reg;
+		unsigned int zero;
+	} condition;
+	struct {
+		unsigned int unit;
+		unsigned int side;
+		unsigned int crosspath;
+	} funit;
+	unsigned int parallel;
+} cs_tms320c64x;
+
+typedef enum tms320c64x_reg {
+	TMS320C64X_REG_INVALID = 0,
+
+	TMS320C64X_REG_AMR,
+	TMS320C64X_REG_CSR,
+	TMS320C64X_REG_DIER,
+	TMS320C64X_REG_DNUM,
+	TMS320C64X_REG_ECR,
+	TMS320C64X_REG_GFPGFR,
+	TMS320C64X_REG_GPLYA,
+	TMS320C64X_REG_GPLYB,
+	TMS320C64X_REG_ICR,
+	TMS320C64X_REG_IER,
+	TMS320C64X_REG_IERR,
+	TMS320C64X_REG_ILC,
+	TMS320C64X_REG_IRP,
+	TMS320C64X_REG_ISR,
+	TMS320C64X_REG_ISTP,
+	TMS320C64X_REG_ITSR,
+	TMS320C64X_REG_NRP,
+	TMS320C64X_REG_NTSR,
+	TMS320C64X_REG_REP,
+	TMS320C64X_REG_RILC,
+	TMS320C64X_REG_SSR,
+	TMS320C64X_REG_TSCH,
+	TMS320C64X_REG_TSCL,
+	TMS320C64X_REG_TSR,
+	TMS320C64X_REG_A0,
+	TMS320C64X_REG_A1,
+	TMS320C64X_REG_A2,
+	TMS320C64X_REG_A3,
+	TMS320C64X_REG_A4,
+	TMS320C64X_REG_A5,
+	TMS320C64X_REG_A6,
+	TMS320C64X_REG_A7,
+	TMS320C64X_REG_A8,
+	TMS320C64X_REG_A9,
+	TMS320C64X_REG_A10,
+	TMS320C64X_REG_A11,
+	TMS320C64X_REG_A12,
+	TMS320C64X_REG_A13,
+	TMS320C64X_REG_A14,
+	TMS320C64X_REG_A15,
+	TMS320C64X_REG_A16,
+	TMS320C64X_REG_A17,
+	TMS320C64X_REG_A18,
+	TMS320C64X_REG_A19,
+	TMS320C64X_REG_A20,
+	TMS320C64X_REG_A21,
+	TMS320C64X_REG_A22,
+	TMS320C64X_REG_A23,
+	TMS320C64X_REG_A24,
+	TMS320C64X_REG_A25,
+	TMS320C64X_REG_A26,
+	TMS320C64X_REG_A27,
+	TMS320C64X_REG_A28,
+	TMS320C64X_REG_A29,
+	TMS320C64X_REG_A30,
+	TMS320C64X_REG_A31,
+	TMS320C64X_REG_B0,
+	TMS320C64X_REG_B1,
+	TMS320C64X_REG_B2,
+	TMS320C64X_REG_B3,
+	TMS320C64X_REG_B4,
+	TMS320C64X_REG_B5,
+	TMS320C64X_REG_B6,
+	TMS320C64X_REG_B7,
+	TMS320C64X_REG_B8,
+	TMS320C64X_REG_B9,
+	TMS320C64X_REG_B10,
+	TMS320C64X_REG_B11,
+	TMS320C64X_REG_B12,
+	TMS320C64X_REG_B13,
+	TMS320C64X_REG_B14,
+	TMS320C64X_REG_B15,
+	TMS320C64X_REG_B16,
+	TMS320C64X_REG_B17,
+	TMS320C64X_REG_B18,
+	TMS320C64X_REG_B19,
+	TMS320C64X_REG_B20,
+	TMS320C64X_REG_B21,
+	TMS320C64X_REG_B22,
+	TMS320C64X_REG_B23,
+	TMS320C64X_REG_B24,
+	TMS320C64X_REG_B25,
+	TMS320C64X_REG_B26,
+	TMS320C64X_REG_B27,
+	TMS320C64X_REG_B28,
+	TMS320C64X_REG_B29,
+	TMS320C64X_REG_B30,
+	TMS320C64X_REG_B31,
+	TMS320C64X_REG_PCE1,
+
+	TMS320C64X_REG_ENDING,	// <-- mark the end of the list of registers
+
+	// Alias registers
+	TMS320C64X_REG_EFR = TMS320C64X_REG_ECR,
+	TMS320C64X_REG_IFR = TMS320C64X_REG_ISR,
+} tms320c64x_reg;
+
+typedef enum tms320c64x_insn {
+	TMS320C64X_INS_INVALID = 0,
+
+	TMS320C64X_INS_ABS,
+	TMS320C64X_INS_ABS2,
+	TMS320C64X_INS_ADD,
+	TMS320C64X_INS_ADD2,
+	TMS320C64X_INS_ADD4,
+	TMS320C64X_INS_ADDAB,
+	TMS320C64X_INS_ADDAD,
+	TMS320C64X_INS_ADDAH,
+	TMS320C64X_INS_ADDAW,
+	TMS320C64X_INS_ADDK,
+	TMS320C64X_INS_ADDKPC,
+	TMS320C64X_INS_ADDU,
+	TMS320C64X_INS_AND,
+	TMS320C64X_INS_ANDN,
+	TMS320C64X_INS_AVG2,
+	TMS320C64X_INS_AVGU4,
+	TMS320C64X_INS_B,
+	TMS320C64X_INS_BDEC,
+	TMS320C64X_INS_BITC4,
+	TMS320C64X_INS_BNOP,
+	TMS320C64X_INS_BPOS,
+	TMS320C64X_INS_CLR,
+	TMS320C64X_INS_CMPEQ,
+	TMS320C64X_INS_CMPEQ2,
+	TMS320C64X_INS_CMPEQ4,
+	TMS320C64X_INS_CMPGT,
+	TMS320C64X_INS_CMPGT2,
+	TMS320C64X_INS_CMPGTU4,
+	TMS320C64X_INS_CMPLT,
+	TMS320C64X_INS_CMPLTU,
+	TMS320C64X_INS_DEAL,
+	TMS320C64X_INS_DOTP2,
+	TMS320C64X_INS_DOTPN2,
+	TMS320C64X_INS_DOTPNRSU2,
+	TMS320C64X_INS_DOTPRSU2,
+	TMS320C64X_INS_DOTPSU4,
+	TMS320C64X_INS_DOTPU4,
+	TMS320C64X_INS_EXT,
+	TMS320C64X_INS_EXTU,
+	TMS320C64X_INS_GMPGTU,
+	TMS320C64X_INS_GMPY4,
+	TMS320C64X_INS_LDB,
+	TMS320C64X_INS_LDBU,
+	TMS320C64X_INS_LDDW,
+	TMS320C64X_INS_LDH,
+	TMS320C64X_INS_LDHU,
+	TMS320C64X_INS_LDNDW,
+	TMS320C64X_INS_LDNW,
+	TMS320C64X_INS_LDW,
+	TMS320C64X_INS_LMBD,
+	TMS320C64X_INS_MAX2,
+	TMS320C64X_INS_MAXU4,
+	TMS320C64X_INS_MIN2,
+	TMS320C64X_INS_MINU4,
+	TMS320C64X_INS_MPY,
+	TMS320C64X_INS_MPY2,
+	TMS320C64X_INS_MPYH,
+	TMS320C64X_INS_MPYHI,
+	TMS320C64X_INS_MPYHIR,
+	TMS320C64X_INS_MPYHL,
+	TMS320C64X_INS_MPYHLU,
+	TMS320C64X_INS_MPYHSLU,
+	TMS320C64X_INS_MPYHSU,
+	TMS320C64X_INS_MPYHU,
+	TMS320C64X_INS_MPYHULS,
+	TMS320C64X_INS_MPYHUS,
+	TMS320C64X_INS_MPYLH,
+	TMS320C64X_INS_MPYLHU,
+	TMS320C64X_INS_MPYLI,
+	TMS320C64X_INS_MPYLIR,
+	TMS320C64X_INS_MPYLSHU,
+	TMS320C64X_INS_MPYLUHS,
+	TMS320C64X_INS_MPYSU,
+	TMS320C64X_INS_MPYSU4,
+	TMS320C64X_INS_MPYU,
+	TMS320C64X_INS_MPYU4,
+	TMS320C64X_INS_MPYUS,
+	TMS320C64X_INS_MVC,
+	TMS320C64X_INS_MVD,
+	TMS320C64X_INS_MVK,
+	TMS320C64X_INS_MVKL,
+	TMS320C64X_INS_MVKLH,
+	TMS320C64X_INS_NOP,
+	TMS320C64X_INS_NORM,
+	TMS320C64X_INS_OR,
+	TMS320C64X_INS_PACK2,
+	TMS320C64X_INS_PACKH2,
+	TMS320C64X_INS_PACKH4,
+	TMS320C64X_INS_PACKHL2,
+	TMS320C64X_INS_PACKL4,
+	TMS320C64X_INS_PACKLH2,
+	TMS320C64X_INS_ROTL,
+	TMS320C64X_INS_SADD,
+	TMS320C64X_INS_SADD2,
+	TMS320C64X_INS_SADDU4,
+	TMS320C64X_INS_SADDUS2,
+	TMS320C64X_INS_SAT,
+	TMS320C64X_INS_SET,
+	TMS320C64X_INS_SHFL,
+	TMS320C64X_INS_SHL,
+	TMS320C64X_INS_SHLMB,
+	TMS320C64X_INS_SHR,
+	TMS320C64X_INS_SHR2,
+	TMS320C64X_INS_SHRMB,
+	TMS320C64X_INS_SHRU,
+	TMS320C64X_INS_SHRU2,
+	TMS320C64X_INS_SMPY,
+	TMS320C64X_INS_SMPY2,
+	TMS320C64X_INS_SMPYH,
+	TMS320C64X_INS_SMPYHL,
+	TMS320C64X_INS_SMPYLH,
+	TMS320C64X_INS_SPACK2,
+	TMS320C64X_INS_SPACKU4,
+	TMS320C64X_INS_SSHL,
+	TMS320C64X_INS_SSHVL,
+	TMS320C64X_INS_SSHVR,
+	TMS320C64X_INS_SSUB,
+	TMS320C64X_INS_STB,
+	TMS320C64X_INS_STDW,
+	TMS320C64X_INS_STH,
+	TMS320C64X_INS_STNDW,
+	TMS320C64X_INS_STNW,
+	TMS320C64X_INS_STW,
+	TMS320C64X_INS_SUB,
+	TMS320C64X_INS_SUB2,
+	TMS320C64X_INS_SUB4,
+	TMS320C64X_INS_SUBAB,
+	TMS320C64X_INS_SUBABS4,
+	TMS320C64X_INS_SUBAH,
+	TMS320C64X_INS_SUBAW,
+	TMS320C64X_INS_SUBC,
+	TMS320C64X_INS_SUBU,
+	TMS320C64X_INS_SWAP4,
+	TMS320C64X_INS_UNPKHU4,
+	TMS320C64X_INS_UNPKLU4,
+	TMS320C64X_INS_XOR,
+	TMS320C64X_INS_XPND2,
+	TMS320C64X_INS_XPND4,
+	// Aliases
+	TMS320C64X_INS_IDLE,
+	TMS320C64X_INS_MV,
+	TMS320C64X_INS_NEG,
+	TMS320C64X_INS_NOT,
+	TMS320C64X_INS_SWAP2,
+	TMS320C64X_INS_ZERO,
+
+	TMS320C64X_INS_ENDING,   // <-- mark the end of the list of instructions
+} tms320c64x_insn;
+
+typedef enum tms320c64x_insn_group {
+	TMS320C64X_GRP_INVALID = 0, ///< = CS_GRP_INVALID
+
+	TMS320C64X_GRP_JUMP,	///< = CS_GRP_JUMP
+
+	TMS320C64X_GRP_FUNIT_D = 128,
+	TMS320C64X_GRP_FUNIT_L,
+	TMS320C64X_GRP_FUNIT_M,
+	TMS320C64X_GRP_FUNIT_S,
+	TMS320C64X_GRP_FUNIT_NO,
+
+	TMS320C64X_GRP_ENDING,   // <-- mark the end of the list of groups
+} tms320c64x_insn_group;
+
+typedef enum tms320c64x_funit {
+	TMS320C64X_FUNIT_INVALID = 0,
+	TMS320C64X_FUNIT_D,
+	TMS320C64X_FUNIT_L,
+	TMS320C64X_FUNIT_M,
+	TMS320C64X_FUNIT_S,
+	TMS320C64X_FUNIT_NO
+} tms320c64x_funit;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
+

ai_anti_malware/capstone/include/capstone/xcore.h

@@ -0,0 +1,235 @@
+#ifndef CAPSTONE_XCORE_H
+#define CAPSTONE_XCORE_H
+
+/* Capstone Disassembly Engine */
+/* By Nguyen Anh Quynh <aquynh@gmail.com>, 2014-2015 */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "platform.h"
+
+#ifdef _MSC_VER
+#pragma warning(disable:4201)
+#endif
+
+/// Operand type for instruction's operands
+typedef enum xcore_op_type {
+	XCORE_OP_INVALID = 0, ///< = CS_OP_INVALID (Uninitialized).
+	XCORE_OP_REG, ///< = CS_OP_REG (Register operand).
+	XCORE_OP_IMM, ///< = CS_OP_IMM (Immediate operand).
+	XCORE_OP_MEM, ///< = CS_OP_MEM (Memory operand).
+} xcore_op_type;
+
+/// XCore registers
+typedef enum xcore_reg {
+	XCORE_REG_INVALID = 0,
+
+	XCORE_REG_CP,
+	XCORE_REG_DP,
+	XCORE_REG_LR,
+	XCORE_REG_SP,
+	XCORE_REG_R0,
+	XCORE_REG_R1,
+	XCORE_REG_R2,
+	XCORE_REG_R3,
+	XCORE_REG_R4,
+	XCORE_REG_R5,
+	XCORE_REG_R6,
+	XCORE_REG_R7,
+	XCORE_REG_R8,
+	XCORE_REG_R9,
+	XCORE_REG_R10,
+	XCORE_REG_R11,
+
+	// pseudo registers
+	XCORE_REG_PC,	///< pc
+
+	// internal thread registers
+	// see The-XMOS-XS1-Architecture(X7879A).pdf
+	XCORE_REG_SCP,	///< save pc
+	XCORE_REG_SSR,	//< save status
+	XCORE_REG_ET,	//< exception type
+	XCORE_REG_ED,	//< exception data
+	XCORE_REG_SED,	//< save exception data
+	XCORE_REG_KEP,	//< kernel entry pointer
+	XCORE_REG_KSP,	//< kernel stack pointer
+	XCORE_REG_ID,	//< thread ID
+
+	XCORE_REG_ENDING,	// <-- mark the end of the list of registers
+} xcore_reg;
+
+/// Instruction's operand referring to memory
+/// This is associated with XCORE_OP_MEM operand type above
+typedef struct xcore_op_mem {
+	uint8_t base;		///< base register, can be safely interpreted as
+				///< a value of type `xcore_reg`, but it is only
+				///< one byte wide
+	uint8_t index;		///< index register, same conditions apply here
+	int32_t disp;	///< displacement/offset value
+	int     direct;	///< +1: forward, -1: backward
+} xcore_op_mem;
+
+/// Instruction operand
+typedef struct cs_xcore_op {
+	xcore_op_type type;	///< operand type
+	union {
+		xcore_reg reg;	///< register value for REG operand
+		int32_t imm;		///< immediate value for IMM operand
+		xcore_op_mem mem;		///< base/disp value for MEM operand
+	};
+} cs_xcore_op;
+
+/// Instruction structure
+typedef struct cs_xcore {
+	/// Number of operands of this instruction,
+	/// or 0 when instruction has no operand.
+	uint8_t op_count;
+	cs_xcore_op operands[8]; ///< operands for this instruction.
+} cs_xcore;
+
+/// XCore instruction
+typedef enum xcore_insn {
+	XCORE_INS_INVALID = 0,
+
+	XCORE_INS_ADD,
+	XCORE_INS_ANDNOT,
+	XCORE_INS_AND,
+	XCORE_INS_ASHR,
+	XCORE_INS_BAU,
+	XCORE_INS_BITREV,
+	XCORE_INS_BLA,
+	XCORE_INS_BLAT,
+	XCORE_INS_BL,
+	XCORE_INS_BF,
+	XCORE_INS_BT,
+	XCORE_INS_BU,
+	XCORE_INS_BRU,
+	XCORE_INS_BYTEREV,
+	XCORE_INS_CHKCT,
+	XCORE_INS_CLRE,
+	XCORE_INS_CLRPT,
+	XCORE_INS_CLRSR,
+	XCORE_INS_CLZ,
+	XCORE_INS_CRC8,
+	XCORE_INS_CRC32,
+	XCORE_INS_DCALL,
+	XCORE_INS_DENTSP,
+	XCORE_INS_DGETREG,
+	XCORE_INS_DIVS,
+	XCORE_INS_DIVU,
+	XCORE_INS_DRESTSP,
+	XCORE_INS_DRET,
+	XCORE_INS_ECALLF,
+	XCORE_INS_ECALLT,
+	XCORE_INS_EDU,
+	XCORE_INS_EEF,
+	XCORE_INS_EET,
+	XCORE_INS_EEU,
+	XCORE_INS_ENDIN,
+	XCORE_INS_ENTSP,
+	XCORE_INS_EQ,
+	XCORE_INS_EXTDP,
+	XCORE_INS_EXTSP,
+	XCORE_INS_FREER,
+	XCORE_INS_FREET,
+	XCORE_INS_GETD,
+	XCORE_INS_GET,
+	XCORE_INS_GETN,
+	XCORE_INS_GETR,
+	XCORE_INS_GETSR,
+	XCORE_INS_GETST,
+	XCORE_INS_GETTS,
+	XCORE_INS_INCT,
+	XCORE_INS_INIT,
+	XCORE_INS_INPW,
+	XCORE_INS_INSHR,
+	XCORE_INS_INT,
+	XCORE_INS_IN,
+	XCORE_INS_KCALL,
+	XCORE_INS_KENTSP,
+	XCORE_INS_KRESTSP,
+	XCORE_INS_KRET,
+	XCORE_INS_LADD,
+	XCORE_INS_LD16S,
+	XCORE_INS_LD8U,
+	XCORE_INS_LDA16,
+	XCORE_INS_LDAP,
+	XCORE_INS_LDAW,
+	XCORE_INS_LDC,
+	XCORE_INS_LDW,
+	XCORE_INS_LDIVU,
+	XCORE_INS_LMUL,
+	XCORE_INS_LSS,
+	XCORE_INS_LSUB,
+	XCORE_INS_LSU,
+	XCORE_INS_MACCS,
+	XCORE_INS_MACCU,
+	XCORE_INS_MJOIN,
+	XCORE_INS_MKMSK,
+	XCORE_INS_MSYNC,
+	XCORE_INS_MUL,
+	XCORE_INS_NEG,
+	XCORE_INS_NOT,
+	XCORE_INS_OR,
+	XCORE_INS_OUTCT,
+	XCORE_INS_OUTPW,
+	XCORE_INS_OUTSHR,
+	XCORE_INS_OUTT,
+	XCORE_INS_OUT,
+	XCORE_INS_PEEK,
+	XCORE_INS_REMS,
+	XCORE_INS_REMU,
+	XCORE_INS_RETSP,
+	XCORE_INS_SETCLK,
+	XCORE_INS_SET,
+	XCORE_INS_SETC,
+	XCORE_INS_SETD,
+	XCORE_INS_SETEV,
+	XCORE_INS_SETN,
+	XCORE_INS_SETPSC,
+	XCORE_INS_SETPT,
+	XCORE_INS_SETRDY,
+	XCORE_INS_SETSR,
+	XCORE_INS_SETTW,
+	XCORE_INS_SETV,
+	XCORE_INS_SEXT,
+	XCORE_INS_SHL,
+	XCORE_INS_SHR,
+	XCORE_INS_SSYNC,
+	XCORE_INS_ST16,
+	XCORE_INS_ST8,
+	XCORE_INS_STW,
+	XCORE_INS_SUB,
+	XCORE_INS_SYNCR,
+	XCORE_INS_TESTCT,
+	XCORE_INS_TESTLCL,
+	XCORE_INS_TESTWCT,
+	XCORE_INS_TSETMR,
+	XCORE_INS_START,
+	XCORE_INS_WAITEF,
+	XCORE_INS_WAITET,
+	XCORE_INS_WAITEU,
+	XCORE_INS_XOR,
+	XCORE_INS_ZEXT,
+
+	XCORE_INS_ENDING,   // <-- mark the end of the list of instructions
+} xcore_insn;
+
+/// Group of XCore instructions
+typedef enum xcore_insn_group {
+	XCORE_GRP_INVALID = 0, ///< = CS_GRP_INVALID
+
+	// Generic groups
+	// all jump instructions (conditional+direct+indirect jumps)
+	XCORE_GRP_JUMP,	///< = CS_GRP_JUMP
+
+	XCORE_GRP_ENDING,   // <-- mark the end of the list of groups
+} xcore_insn_group;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

ai_anti_malware/capstone/include/platform.h

@@ -0,0 +1,110 @@
+/* Capstone Disassembly Engine */
+/* By Axel Souchet & Nguyen Anh Quynh, 2014 */
+
+#ifndef CAPSTONE_PLATFORM_H
+#define CAPSTONE_PLATFORM_H
+
+// handle C99 issue (for pre-2013 VisualStudio)
+#if !defined(__CYGWIN__) && !defined(__MINGW32__) && !defined(__MINGW64__) && (defined (WIN32) || defined (WIN64) || defined (_WIN32) || defined (_WIN64))
+// MSVC
+
+// stdbool.h
+#if (_MSC_VER < 1800) || defined(_KERNEL_MODE)
+// this system does not have stdbool.h
+#ifndef __cplusplus
+typedef unsigned char bool;
+#define false 0
+#define true 1
+#endif
+
+#else
+// VisualStudio 2013+ -> C99 is supported
+#include <stdbool.h>
+#endif
+
+#else
+// not MSVC -> C99 is supported
+#include <stdbool.h>
+#endif
+
+
+// handle C99 issue (for pre-2013 VisualStudio)
+#if defined(CAPSTONE_HAS_OSXKERNEL) || (defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE)))
+// this system does not have inttypes.h
+
+#if defined(_MSC_VER) && (_MSC_VER < 1600 || defined(_KERNEL_MODE))
+// this system does not have stdint.h
+typedef signed char  int8_t;
+typedef signed short int16_t;
+typedef signed int   int32_t;
+typedef unsigned char  uint8_t;
+typedef unsigned short uint16_t;
+typedef unsigned int   uint32_t;
+typedef signed long long   int64_t;
+typedef unsigned long long uint64_t;
+
+#define INT8_MIN         (-127i8 - 1)
+#define INT16_MIN        (-32767i16 - 1)
+#define INT32_MIN        (-2147483647i32 - 1)
+#define INT64_MIN        (-9223372036854775807i64 - 1)
+#define INT8_MAX         127i8
+#define INT16_MAX        32767i16
+#define INT32_MAX        2147483647i32
+#define INT64_MAX        9223372036854775807i64
+#define UINT8_MAX        0xffui8
+#define UINT16_MAX       0xffffui16
+#define UINT32_MAX       0xffffffffui32
+#define UINT64_MAX       0xffffffffffffffffui64
+#endif
+
+#define __PRI_8_LENGTH_MODIFIER__ "hh"
+#define __PRI_64_LENGTH_MODIFIER__ "ll"
+
+#define PRId8         __PRI_8_LENGTH_MODIFIER__ "d"
+#define PRIi8         __PRI_8_LENGTH_MODIFIER__ "i"
+#define PRIo8         __PRI_8_LENGTH_MODIFIER__ "o"
+#define PRIu8         __PRI_8_LENGTH_MODIFIER__ "u"
+#define PRIx8         __PRI_8_LENGTH_MODIFIER__ "x"
+#define PRIX8         __PRI_8_LENGTH_MODIFIER__ "X"
+
+#define PRId16        "hd"
+#define PRIi16        "hi"
+#define PRIo16        "ho"
+#define PRIu16        "hu"
+#define PRIx16        "hx"
+#define PRIX16        "hX"
+
+#if defined(_MSC_VER) && _MSC_VER <= 1700
+#define PRId32        "ld"
+#define PRIi32        "li"
+#define PRIo32        "lo"
+#define PRIu32        "lu"
+#define PRIx32        "lx"
+#define PRIX32        "lX"
+#else	// OSX
+#define PRId32        "d"
+#define PRIi32        "i"
+#define PRIo32        "o"
+#define PRIu32        "u"
+#define PRIx32        "x"
+#define PRIX32        "X"
+#endif
+
+#if defined(_MSC_VER) && _MSC_VER <= 1700
+// redefine functions from inttypes.h used in cstool
+#define strtoull _strtoui64
+#endif
+
+#define PRId64        __PRI_64_LENGTH_MODIFIER__ "d"
+#define PRIi64        __PRI_64_LENGTH_MODIFIER__ "i"
+#define PRIo64        __PRI_64_LENGTH_MODIFIER__ "o"
+#define PRIu64        __PRI_64_LENGTH_MODIFIER__ "u"
+#define PRIx64        __PRI_64_LENGTH_MODIFIER__ "x"
+#define PRIX64        __PRI_64_LENGTH_MODIFIER__ "X"
+
+#else
+// this system has inttypes.h by default
+#include <inttypes.h>
+#endif
+
+#endif

ai_anti_malware/capstone/include/windowsce/intrin.h

@@ -0,0 +1,12 @@
+
+#if defined(_MSC_VER) && defined(_WIN32_WCE) && (_WIN32_WCE < 0x800) && !defined(__INTRIN_H_) && !defined(_INTRIN)
+#define _STDINT
+
+#ifdef _M_ARM
+#include <armintr.h>
+#if (_WIN32_WCE >= 0x700) && defined(__ARM_ARCH_7__) || defined(__ARM_ARCH_7A__)
+#include <arm_neon.h>
+#endif
+#endif // _M_ARM
+
+#endif

ai_anti_malware/capstone/include/windowsce/stdint.h

@@ -0,0 +1,133 @@
+
+#if defined(_MSC_VER) && defined(_WIN32_WCE) && (_WIN32_WCE < 0x800) && !defined(_STDINT_H_) && !defined(_STDINT)
+#define _STDINT
+
+typedef __int8
+	int8_t,
+	int_least8_t;
+
+typedef __int16
+	int16_t,
+	int_least16_t;
+
+typedef __int32
+	int32_t,
+	int_least32_t,
+	int_fast8_t,
+	int_fast16_t,
+	int_fast32_t;
+	
+typedef __int64
+	int64_t,
+	intmax_t,
+	int_least64_t,
+	int_fast64_t;
+
+typedef unsigned __int8
+	uint8_t,
+	uint_least8_t;
+	
+typedef unsigned __int16
+	uint16_t,
+	uint_least16_t;
+	
+typedef unsigned __int32
+	uint32_t,
+	uint_least32_t,
+	uint_fast8_t,
+	uint_fast16_t,
+	uint_fast32_t;
+	
+typedef unsigned __int64
+	uint64_t,
+	uintmax_t,
+	uint_least64_t,
+	uint_fast64_t;
+
+#ifndef _INTPTR_T_DEFINED
+#define _INTPTR_T_DEFINED
+typedef __int32	intptr_t;
+#endif
+
+#ifndef _UINTPTR_T_DEFINED
+#define _UINTPTR_T_DEFINED
+typedef unsigned __int32	uintptr_t;
+#endif
+
+#define INT8_MIN         (-127i8 - 1)
+#define INT16_MIN        (-32767i16 - 1)
+#define INT32_MIN        (-2147483647i32 - 1)
+#define INT64_MIN        (-9223372036854775807i64 - 1)
+#define INT8_MAX         127i8
+#define INT16_MAX        32767i16
+#define INT32_MAX        2147483647i32
+#define INT64_MAX        9223372036854775807i64
+#define UINT8_MAX        0xffui8
+#define UINT16_MAX       0xffffui16
+#define UINT32_MAX       0xffffffffui32
+#define UINT64_MAX       0xffffffffffffffffui64
+
+#define INT_LEAST8_MIN   INT8_MIN
+#define INT_LEAST16_MIN  INT16_MIN
+#define INT_LEAST32_MIN  INT32_MIN
+#define INT_LEAST64_MIN  INT64_MIN
+#define INT_LEAST8_MAX   INT8_MAX
+#define INT_LEAST16_MAX  INT16_MAX
+#define INT_LEAST32_MAX  INT32_MAX
+#define INT_LEAST64_MAX  INT64_MAX
+#define UINT_LEAST8_MAX  UINT8_MAX
+#define UINT_LEAST16_MAX UINT16_MAX
+#define UINT_LEAST32_MAX UINT32_MAX
+#define UINT_LEAST64_MAX UINT64_MAX
+
+#define INT_FAST8_MIN    INT8_MIN
+#define INT_FAST16_MIN   INT32_MIN
+#define INT_FAST32_MIN   INT32_MIN
+#define INT_FAST64_MIN   INT64_MIN
+#define INT_FAST8_MAX    INT8_MAX
+#define INT_FAST16_MAX   INT32_MAX
+#define INT_FAST32_MAX   INT32_MAX
+#define INT_FAST64_MAX   INT64_MAX
+#define UINT_FAST8_MAX   UINT8_MAX
+#define UINT_FAST16_MAX  UINT32_MAX
+#define UINT_FAST32_MAX  UINT32_MAX
+#define UINT_FAST64_MAX  UINT64_MAX
+
+#define INTPTR_MIN      INT32_MIN
+#define INTPTR_MAX      INT32_MAX
+#define UINTPTR_MAX     UINT32_MAX
+
+#define INTMAX_MIN       INT64_MIN
+#define INTMAX_MAX       INT64_MAX
+#define UINTMAX_MAX      UINT64_MAX
+
+#define PTRDIFF_MIN      INTPTR_MIN
+#define PTRDIFF_MAX      INTPTR_MAX
+
+#ifndef SIZE_MAX
+#define SIZE_MAX        UINTPTR_MAX
+#endif
+
+#define SIG_ATOMIC_MIN   INT32_MIN
+#define SIG_ATOMIC_MAX   INT32_MAX
+
+#define WCHAR_MIN        0x0000
+#define WCHAR_MAX        0xffff
+
+#define WINT_MIN         0x0000
+#define WINT_MAX         0xffff
+
+#define INT8_C(x)    (x)
+#define INT16_C(x)   (x)
+#define INT32_C(x)   (x)
+#define INT64_C(x)   (x ## LL)
+
+#define UINT8_C(x)   (x)
+#define UINT16_C(x)  (x)
+#define UINT32_C(x)  (x ## U)
+#define UINT64_C(x)  (x ## ULL)
+
+#define INTMAX_C(x)  INT64_C(x)
+#define UINTMAX_C(x) UINT64_C(x)
+
+#endif