get_eff_addr_sib(9)

💅 get_eff_addr_sib — from the Kernel API Manual, bestie

okay so picture this: you're deep in the kernel, you've got an instruction, you've got registers, and you need the actual effective address that the SIB byte is pointing at. That's literally this function. It's giving "decode my vibe" but for memory operands. 🎀

---

✨ NAME ✨

get_eff_addr_sib — obtains the referenced effective address via SIB. Yes, SIB as in Scale-Index-Base, the little byte that keeps x86 addressing feeling like a whole personality. 💅

---

🌸 SYNOPSIS 🌸

int get_eff_addr_sib (struct insn *insn , struct pt_regs *regs , int
*base_offset , long *eff_addr );

---

🦋 ARGUMENTS 🦋

• insn — the instruction. Must be valid, no cap. If it's not valid, this is not the moment. 🫶
• regs — register values as seen when entering kernel mode. Like, the state of the world at the door.
• base_offset — the obtained operand offset, in pt_regs, associated with the segment. It's the receipt that tells you which segment showed up to the party. 🧚
• eff_addr — the obtained effective address. The main character, fr fr. 👑

---

💖 DESCRIPTION 💖

So what this does: it obtains the effective address referenced by the SIB byte of insn. ✨

Once it's identified the registers involved in the indexed, register-indirect memory reference, it gets that value from the operands in regs. The computed address gets stored in eff_addr. Also — and this part is iconic — the register operand that indicates the associated segment is stored in base_offset. You can literally use that parameter later to determine such segment. Teamwork, honestly. 🫶

• 0 on success. eff_addr will have the referenced effective address. base_offset will have a register, as an offset from the base of pt_regs, that can be used to resolve the associated segment. Slay. 💅
• Negative value on error. 😭 Not every decode is a win, bestie.

---

🌈 SEE ALSO 🌈

Kernel file ./arch/x86/lib/insn-eval.c — plus the whole friend group, and I mean the whole friend group:

• is_string_insn(9)
• insn_has_rep_prefix(9)
• get_seg_reg_override_idx(9)
• check_seg_overrides(9)
• resolve_default_seg(9)
• resolve_seg_reg(9)
• get_segment_selector(9)
• get_reg_offset_16(9)
• get_desc(9)
• insn_get_seg_base(9)
• get_seg_limit(9)
• insn_get_code_seg_params(9)
• insn_get_modrm_rm_off(9)
• insn_get_modrm_reg_off(9)
• insn_get_modrm_reg_ptr(9)
• get_seg_base_limit(9)
• get_eff_addr_reg(9)
• get_eff_addr_modrm(9)
• get_eff_addr_modrm_16(9)
• get_addr_ref_16(9)
• get_addr_ref_32(9)
• get_addr_ref_64(9)
• insn_get_addr_ref(9)
• insn_fetch_from_user(9)
• insn_fetch_from_user_inatomic(9)
• insn_decode_from_regs(9)
• insn_decode_mmio(9)

---

ngl, if you're reading all of these in a row, hydrate. 💧 This is a lot of decoding and you deserve a little treat. 🍓

---

mwah 💜 this page came to you from ./arch/x86/lib, dated October 2026 — go forth and resolve those segments, bestie, you've got this fr fr 🦋✨