spnow / zyan-disassembler-engine

Fast and lightweight x86/x86-64 disassembler library.

Zyan Disassembler Engine (Zydis)

Fast and lightweight x86/x86-64 disassembler library.

Features

• Supports all x86 and x86-64 (AMD64) General purpose and System instructions.
• Supported ISA extensions:
• MMX, FPU (x87), AMD 3DNow
• SSE, SSE2, SSE3, SSSE3, SSE4.1, SSE4.2, AES,
• AMD-V, INTEL-VMX, SMX
• Optimized for high performance
• Very small overhead compared to other common disassembler libraries (about 60KiB)
• Abstract formatter and symbol-resolver classes for custom syntax implementations.
• Intel syntax is implemented by default
• Complete doxygen documentation

Quick Example

The following example program uses Zydis to disassemble a given memory buffer and prints the output to the console.

#include <iostream>
#include <iomanip>
#include <stdint.h>
#include <Zydis.hpp>

int main()
{
    uint8_t data[] =
    {
        0x51, 0x8D, 0x45, 0xFF, 0x50, 0xFF, 0x75, 0x0C, 0xFF, 0x75, 
        0x08, 0xFF, 0x15, 0xA0, 0xA5, 0x48, 0x76, 0x85, 0xC0, 0x0F, 
        0x88, 0xFC, 0xDA, 0x02, 0x00
    };

    Zydis::MemoryInput input(&data[0], sizeof(data));
    Zydis::InstructionInfo info;
    Zydis::InstructionDecoder decoder;
    decoder.setDisassemblerMode(Zydis::DisassemblerMode::M32BIT);
    decoder.setDataSource(&input);
    decoder.setInstructionPointer(0x00400000);
    Zydis::IntelInstructionFormatter formatter;

    while (decoder.decodeInstruction(info))
    {
        std::cout << std::hex << std::setw(8) << std::setfill('0') 
                  << std::uppercase << info.instrAddress << " "; 

        if (info.flags & Zydis::IF_ERROR_MASK)
        {
            std::cout << "db " << std::setw(2) 
                      << static_cast<int>(info.data[0]) 
                      << std::endl;    
        } 
        else
        {
            std::cout << formatter.formatInstruction(info) << std::endl;
        }
    }
}

Sample Output

The above example program generates the following output:

00400000 push ecx
00400001 lea eax, [ebp-01]
00400004 push eax
00400005 push dword ptr [ebp+0C]
00400008 push dword ptr [ebp+08]
0040000B call dword ptr [7648A5A0]
00400011 test eax, eax
00400013 js 0042DB15

Compilation

Zydis builds cleanly on most platforms without any external dependencies. You can use CMake to generate project files for your favorite C++14 compiler.

Documentation

The HTML Doxygen documentation is automatically built from master every 12 hours.

License

Zyan Disassembler Engine is licensed under the MIT License. Dependencies are under their respective licenses.