Jump to content
Tuts 4 You

DbgDisasmAt - Other Method


Recommended Posts


I'm currently working on a plugin for x32dbg and I was wondering if there is another way to disassemble a function where I can receive information like the opcode as char so I don't have to work with the char array to see what kind of instruction I'm dealing with. And I also want to know if there is a way to see if the argument from the DISASM_INSTR array is a register, pointer, memory value/constant or such also without dealing with the char array.



Link to comment

DbgDisasmFastAt uses a BASIC_INSTRUCTION_INFO structure:

BRIDGE_IMPEXP void DbgDisasmFastAt(duint addr, BASIC_INSTRUCTION_INFO* basicinfo); 

and you can then access the returned BASIC_INSTRUCTION_INFO structure to read information such as type, branch etc:

typedef struct
    duint value; //displacement / addrvalue (rip-relative)
    MEMORY_SIZE size; //byte/word/dword/qword
    char mnemonic[MAX_MNEMONIC_SIZE];

typedef struct
    duint value;
    VALUE_SIZE size;

//definitions for BASIC_INSTRUCTION_INFO.type
#define TYPE_VALUE 1
#define TYPE_MEMORY 2
#define TYPE_ADDR 4

typedef struct
    DWORD type; //value|memory|addr
    VALUE_INFO value; //immediat
    MEMORY_INFO memory;
    duint addr; //addrvalue (jumps + calls)
    bool branch; //jumps/calls
    bool call; //instruction is a call
    int size;
    char instruction[MAX_MNEMONIC_SIZE * 4];

The xAnalyzer plugin makes use of this: https://github.com/ThunderCls/xAnalyzer/blob/master/xAnalyzer/xanalyzer.cpp#L329

Hope that helps.



  • Like 2
Link to comment

Thanks for your response!

But I was looking for a more "abstract" way instead of dealing with strings. But I wrote a small parser which handles the diassembled instruction which works fine for now.

  • Like 2
Link to comment

You don't really have to deal with strings.

Use DISASM_ARG.type to see if it's memory or a number/register. Then you can use DISASM_ARG.const to get the imm value or DISASM_ARG.value to get the register value. If isdigit(DISASM_ARG.mnemonic) is true you know that it's a constant. However probably you are looking for capstone, it has exact details on the instruction data. This function is only used by the GUI to provide context-sensitive operations.

  • Like 2
Link to comment

I think my main problem was/is to handle instructions like this:

mov eax,dword ptr ds:[ebx]		; 1)
mov eax,dword ptr ds:[486486]		; 2)
mov eax,dword ptr ds:[ecx+EA]		; 3)
mov eax,dword ptr ds:[ebx+ecx*4]	; 4)
mov eax,dword ptr ds:[ecx*4+486486]	; 5)
mov eax,dword ptr ds:[ebx+ecx]		; 6)

1) and 2) are easy to solve, but I was struggeling with the rest because my goal was to cut that argument down into pieces so I can change for example in 5) the scale *4, in 4) ecx into another register or in 3) the EA into another value. My ugly solution is to use regular expressions.

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...