mithreindeir / dynzasm

X86/X64/ARM/MIPS Assembler/Disassembler/Decomposer Library

Dynzasm

Dynzasm is a fast lightweight disassembly library written in c99 code with no external dependencies. Disassembly is structured as trees with arbitrary formatting strings, allowing detailed disassembly information and making it easy to support custom syntaxes.

ARCH	Disassembly SUPPORT	Assembler Support
X86	Most (excluding extensions)	Partial (No fp, or isa ext)
X64	Most (excluding extensions)	Partial (No fp, or isa ext)
ARM	Partial	None (WIP)
MIPS	Most	None (WIP)

Includes sample commandline utility

./dynzasm --help
Usage: ./dynzasm options filename
	--arch=<architecture> Set architecture to be disassembled (x86, arm, or mips
	--mode=<mode> Set the architecture mode (32 or 64)
	--entry=<addr> Set a starting address
	-a convert ascii to hex
	-A Assemble
If no file is specified stdin will be used
Must specify architecture and mode

echo "55 48 89 e5 48 83 ec 70" | ./dynzasm --arch=x86 --mode=64 -a --addr=0x2172 
0x002172:	55                            	push	rbp
0x002173:	48 89 e5                      	mov	rbp, rsp
0x002176:	48 83 ec 70                   	sub	rsp, 0x70

An example of using the assembler from stdin, and piping it into the disassembler.

./dynzasm --arch=x86 --mode=64 -A | ./dynzasm --arch=x86 --mode=64 -a
push rbp
mov rbp, rsp
mov eax, 0
ret
00000000:	55                            	push	rbp
0x000001:	48 8b ec                      	mov	rbp, rsp
0x000004:	b8 00 00 00 00                	mov	eax, 0
0x000009:	c3                            	ret

It is also very easy to use as a library. Detailed semantics from disassembly for easy analysis coming soon.

#include "disas.h"

int main()
{
	
  struct disassembler *ds = ds_init(X86_ARCH, MODE_64B);
  unsigned char bytes[] =  "\x55\x48\x89\xe5\xb8\x00\x00\x00\x00\xc3";

  ds_decode(ds, bytes, sizeof(bytes)-1, 0x0);
  struct dis *dis = NULL;
  
  DS_FOREACH(ds, dis) {
    printf("%#08lx:\t%s\t%s\n", dis->address, dis->mnemonic, dis->op_squash);
  }
  
  ds_destroy(ds);
  return 0;
}

dynzasm's Issues

The "lea" instruction is not disassembled correctly

Hello friend!: Thank you for your code. The "lea" instruction is not disassembled correctly. I was reviewing the code and it's a matter of modifying line 174 of the file /src/arch/x86/x86.ins, instead of
"8d lea Gv", modify by "8d lea Gv Av". That is, it was only necessary to place the letters that identify the memory operators: Av.
Enough with that to decode the machine code well in 32 and 64 bits, so I guess it was just a little oversight.

Invalid assemble list for x64

Hello Mithreindeir,

This is a very good product, thanks for you developing it.
Now I can't find the root cause, I faced the following disassemble code.

00:   4c 8d 44 24 20                    lea     r8, [rsp+0x00000020]
05:   49 83 00 01 4d                    add     qword [r9], 0x4d
0a:   8b 00                             mov     eax, dword [rax]

But I expected it as below, and it works as I expected.

00:   4c 8d 44 24 20                    lea     r8, [rsp+0x00000020]
05:   49 83 00 01                       add     qword [r8], 0x01
09:   4d 8b 00                          mov     r8, qword [r8]

What is wrong do you know?
Can you please advise me?

Thank you very much in advance.