This lightweight library aims at providing x86-64 disassembling features while being compact and simple to understand and fix. There are no dependencies other than the C standard library, which can also be avoided with slight modifications, depending on the compilation options. It does not use any dynamic memory allocation.
It is programmed entirely in C99 and supports all x86 and x86-64/AMD64 instructions and most ISA extensions (e.g. AVX512 is currently not supported).
Compilation switches that can optionally be defined:
X86_DASM_DEBUGto enable verbose debug outputX86_DASM_NOFMTto disable all the instruction formatting (no strings)
make all
x86_dasm_context_t x86_dctx = {0};
uint8_t code[] = {
0xeb, 0xfe
};
x86_set_buffer(&x86_dctx, code);
x86_set_dmode(&x86_dctx, X86_DMODE_64BIT);
x86_set_ip(&x86_dctx, 0x7ffe0000);
if(x86_dasm(&x86_dctx) == 0)
printf("%s", x86_dctx.inst_str);0000 | 6A 60 | push 60
0002 | 5A | pop rdx
0003 | 68 63 61 6C 63 | push 636C6163
0008 | 54 | push rsp
0009 | 59 | pop rcx
000A | 48 29 D4 | sub rsp, rdx
000D | 65 48 8B 32 | mov rsi, qword ptr gs:[rdx]
0011 | 48 8B 76 18 | mov rsi, qword ptr ds:[rsi+18]
0015 | 48 8B 76 10 | mov rsi, qword ptr ds:[rsi+10]
0019 | 48 AD | lodsq rax, qword ptr ds:[rsi]
001B | 48 8B 30 | mov rsi, qword ptr ds:[rax]
001E | 48 8B 7E 30 | mov rdi, qword ptr ds:[rsi+30]
0022 | 03 57 3C | add edx, dword ptr ds:[rdi+3C]
0025 | 8B 5C 17 28 | mov ebx, dword ptr ds:[rdi+rdx+28]
0029 | 8B 74 1F 20 | mov esi, dword ptr ds:[rdi+rbx+20]
002D | 48 01 FE | add rsi, rdi
0030 | 8B 54 1F 24 | mov edx, dword ptr ds:[rdi+rbx+24]
0034 | 0F B7 2C 17 | movzx ebp, word ptr ds:[rdi+rdx]
0038 | 8D 52 02 | lea edx, ds:[rdx+2]
003B | AD | lodsd eax, dword ptr ds:[rsi]
003C | 81 3C 07 57 69 6E 45 | cmp dword ptr ds:[rdi+rax], 456E6957
0043 | 75 EF | jnz short 34
0045 | 8B 74 1F 1C | mov esi, dword ptr ds:[rdi+rbx+1C]
0049 | 48 01 FE | add rsi, rdi
004C | 8B 34 AE | mov esi, dword ptr ds:[rsi+rbp*4]
004F | 48 01 F7 | add rdi, rsi
0052 | 99 | cdq
0053 | FF D7 | call rdi
#include "x86_dasm_macros.h"
// ...
if(x86_dasm(&x86_dctx) == 0)
{
if(X86M(&x86_dctx, ANY, REG(), REG()))
printf("Matched an instruction with two register operands");
if(X86M(&x86_dctx, MOV, REG(), MEXPR()))
printf("Matched: mov reg, mem");
if(X86M(&x86_dctx, CALL, REG(EDI)))
printf("Matched: call edi");
}x86_dasm is licensed under the Apache License, Version 2.0
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent