Looking for low level x86 dissasembler code c++

[CodeExplorer]

Looking for low level x86 dissasembler code c++

I want it at low level with knowing everything is going on, altrought information from libraries may bring usefull information.

In the end I want to grab all operands, but that's final step.

 

[atom0s]

There's a wiki that covers a list of various disassemblers here:
https://en.wikibooks.org/wiki/X86_Disassembly/Disassemblers_and_Decompilers

Some open source projects:
https://github.com/capstone-engine/capstone
https://github.com/zyantific/zydis
https://github.com/icedland/iced
https://www.ollydbg.de/disasm.zip - Engine used in OllyDbg

Lot of other ones on GitHub and around the web as well. 

[CodeExplorer]

https://usermanual.wiki/Document/Encoding20Real20x8620Instructions.403814632/help

https://sourceforge.net/projects/custard/files/libdisasm/

https://github.com/capstone-engine/capstone/blob/master/arch/X86/X86Disassembler.h

http://ref.x86asm.net/coder32.html
https://chromium.googlesource.com/external/dynamorio/+/1d0b9451537ca047afd01b982d4b585039895031/core/arch/x86/decode.c

https://usermanual.wiki/Document/Encoding20Real20x8620Instructions.403814632/help

I wanna implement my own code and not just use a library, to be frankly steps are unknowned to me at this moment. 

Edited May 23, 2023 by CodeExplorer

[CodeExplorer]

After lot of search I found instruction length function https://stackoverflow.com/questions/23788236/get-size-of-assembly-instructions/23843450#23843450

Wandering how to decode instructions now.

[ra1n]

AFAIK, you'd need to write an entire system for decoding each x86 instruction. This includes things such as interpreting the MODR/M byte. I suggest you just use Zydis, otherwise good luck!

[jackyjask]

why reinvent the wheel?

there are dozens of bullet - proof industry strength disam engines...

 

dont trust 1st liked post on stackoverflow

 

[atom0s]

15 hours ago, CodeExplorer said:

I wanna implement my own code and not just use a library, to be frankly steps are unknowned to me at this moment. 

Would suggest reading/referencing the Intel/AMD x86 documentation then on how instructions are encoded and such. Those docs will cover all the information you need to be able to write your own engine. 

There are several other sites that put similar information into a faster-to-read/lookup format such as:

http://ref.x86asm.net/coder32.html

https://www.felixcloutier.com/x86/

Or reference existing engines on how things can be setup in cleaner table formats to be used in various coding languages.

I know you generally code in C#, so you can also look at C#/.NET related projects such as:

https://github.com/justinstenning/SharpDisasm

https://github.com/icedland/iced

[CodeExplorer]

7 hours ago, jackyjask said:

why reinvent the wheel?

there are dozens of bullet - proof industry strength disam engines...

 

dont trust 1st liked post on stackoverflow

 

For one project I will make you are right: there is no reason to reinvent the wheel. But here is the question: any disasm engine supporting Visual C++ 6.0? That's the language I'm currently using.

For the second project I need to get operands used by instruction. I don't know any dissasembler supporting this. Or I am suppose to get operands from decoded string instruction, what about speed in this case?

[atom0s]

15 hours ago, CodeExplorer said:

Visual C++ 6.0

Is there a reason you are making use of such an old version of C++ tooling/compiler? VC6 is long dead and deprecated. All of the modern versions of Visual Studio have completely free community editions which contain the full modern C++ featuresets. If you are going to use C++, you should honestly use modern tooling.

15 hours ago, CodeExplorer said:

For the second project I need to get operands used by instruction. I don't know any dissasembler supporting this. Or I am suppose to get operands from decoded string instruction, what about speed in this case?

There are various libraries for this kind of thing too. In some cases you may need to combine an assembler and another library to re-disassemble back into a more AST like setup in regards to reading specifics about each opcode and such.

https://github.com/keystone-engine/keystone
https://github.com/StanfordPL/x64asm
https://github.com/herumi/xbyak
https://github.com/asmjit/asmjit

Along with a handful of other similar projects / examples on GitHub:
https://github.com/search?q=x86+assembler+language%3AC%2B%2B&type=repositories

A commonly used library in the game hacking scene for this kind of thing is also FASM being compiled and imported into projects to be used as an on-the-fly runtime assembler.

http://flatassembler.net/

There are various examples of making use of FASM in all kinds of languages. The most popular in regards to embedding it has generally been C#, but the means to do it were just building a basic C++/CLI wrapper around FASM to be used in C#. You can just import the library into C++ directly instead and not need to have the CLI layer/wrapper.

[CodeExplorer]

What about any dissasm library beeing compatible with Visual Studio 2010 profesional?

Edited May 25, 2023 by CodeExplorer

[jackyjask]

there is even better SW - Visual Studio 6.0 SP4!

it is one of the fastest ever developed by MS!

it also has got as a bonus fo ryou so called feature packs

 

[fearless]

On 5/24/2023 at 4:55 AM, CodeExplorer said:

But here is the question: any disasm engine supporting Visual C++ 6.0

I have used the precompiled Capstone library with masm so i think it should be fine to call its functions from visual c++ 6.0

[CodeExplorer]

Adapted https://www.ollydbg.de/disasm.zip - Engine used in OllyDbg
to work under Visual C++ 6.0; project attached, for the one interested.
 

 

Dasm_SrcVC6.rar