Module table 

Unicorn-shaped hooks: callbacks the machine calls from inside Vm::run.

Each registration installs a Hook whose interrupt carries a code from a reserved range, and files the callback under it. When a run reaches such an interrupt the callback runs with the machine stopped at the site, the machine resumes, and the run goes on — unless the callback asks to stop, in which case the run returns VmExit::HookStop. Interrupts with any other code, and every other exit, come back to the caller as before.

Several hooks may watch the same site. They fire in registration order, each from its own interrupt, and a stop ends the run before the later ones run: Unicorn’s chain with Qiling’s veto.

Instruction hooks are different in kind: they answer an architecture user op the interpreter has no semantics for — syscall, rdtsc, cpuid — and so must supply its result. InsnAction::Handled carries that.

Structs

HookId

A registered hook, for hook_del.

MemAccess

A guest memory access a hook observes.

Enums

HookAction

What a code or memory hook wants the run to do next.

InsnAction

What an instruction hook did about the user op it was called for.

Constants

TABLE_CODES

Interrupt codes the table owns. Anything at or above this is a table hook’s; user injectors keep their codes below it.