Hacker Disassembler Engine:

Hacker Disassembler Engine, or HDE, is small disassembler engine, which intend to code analyse. HDE get length of command, prefixes, ModR/M and SIB bytes, opcode, immediate, displacement, relative address, etc. For example, you can use HDE when writing unpackers or decryptors executable files, because more others disassemblers too big, get only disasm listing and aren't intended for code analys, but more simple

length disassemblers usually get too little info. HDE get enough info to analyse, but it has very small size. HDE package include DLL, object, header files and and source.

+ support MMX, SSE, SSE2, SSE3, 3DNow! instructions

+ high-speed & small size (coded in assembler

+ compatibility with most coding language

To disassemble should call hde_disasm function:

   void hde_disasm(
	 void *pCode			   // pointer to code
	 HDE_STRUCT *pHDE_STRUCT   // pointer to structure HDE_STRUCT
	 )

After execute, you get filled structure HDE_STRUCT:

   typedef struct _HDE_STRUCT
   {
	 BYTE	len;		   // length of command
	 BYTE	p_rep;		 // rep/repnz/.. prefix: 0xF2 or 0xF3
	 BYTE	p_lock;		// lock prefix 0xF0
	 BYTE	p_seg;		 // segment prefix: 0x2E, 0x36, 0x3E, 0x26, 0x64, 0x65
	 BYTE	p_66;		  // prefix 0x66
	 BYTE	p_67;		  // prefix 0x67
	 BYTE	opcode;		// opcode
	 BYTE	opcode2;	   // second opcode, if first opcode equal 0x0F
	 BYTE	modrm;		 // ModR/M byte
	 BYTE	modrm_mod;	 //   - mod byte of ModR/M
	 BYTE	modrm_reg;	 //   - reg byte of ModR/M
	 BYTE	modrm_rm;	  //   - r/m byte of ModR/M
	 BYTE	sib;		   // SIB byte
	 BYTE	sib_scale;	 //   - scale (ss) byte of SIB
	 BYTE	sib_index;	 //   - index byte of SIB
	 BYTE	sib_base;	  //   - base byte of SIB
	 BYTE	imm8;		  // immediate imm8
	 WORD	imm16;		 // immediate imm16
	 DWORD   imm32;		 // immediate imm32
	 BYTE	disp8;		 // displacement disp8
	 WORD	disp16;		// displacement disp16, if prefix 0x67 exist
	 DWORD   disp32;		// displacement disp32
	 BYTE	rel8;		  // relative address rel8
	 WORD	rel16;		 // relative address rel16, if prefix 0x66 exist
	 DWORD   rel32;		 // relative address rel32
   } HDE_STRUCT;

Opcode and len fields always exist, others are optional and depend of command. If

field's value equal zero, then it isn't existing.

Note: HDE work only with 32-bit commands of x86 processors !

Improvements, suggestions and bugfixes are welcomed.

Home Page:

http://vxheavens.com/vx.php?id=eh04

Ted.

hde.0.02.zip

hde.0.03.zip

hde28b.zip

hde28c.zip

hde6404c.zip

hde27b.zip

hde27c.zip

Correct english Homepage

http://patkov-site.narod.ru/eng.html

Hacker Disassembler Engine 0.04:

version 0.04 [08.08.2006]

------------------------------------------

+ optimized and small code (~1 kb)

+ some bugfixes

http://rapidshare.de/files/31023129/hde.0.04.zip.html

Enjoy!

Napalm

Oopss! not for me need to practice coding first, but it's a good tool to collect.... Thanks

aNtRoBs

Hacker Disassembler Engine (HDE) v0.06

version 0.06 [03.01.2007]

+ some optimization: changed standard stack frames in procedures to

more optimized enter/leave

+ corrected C/C++ header file

+ added C example

version 0.05 [28.11.2006]

+ fixed bug with displacements (thx: Napalm)

+ fixed bug with length of command

+ added object files in elf32 format

Hacker Disassembler Engine (HDE) version 0.07 - 09.02.2007

- fixed bug with F6 and F7 opcodes

- added support of FPU commands

- optimized and small code

- corrected documentation

Has anyone actually done anything useful with this? I've not really looked at it and was wondering if its worthwhile.

Very useful indeed

Great for trying to differentiate between opcodes and data. (i.e 0xCC and INT3 when restoring nanos)

Ah, fair point. Think I'll download and store this one for when a have a bit of time spare then!

Thanks for the comment WhiteRat.

One very good argument is its size. 1kb is almost nothing, very useful for creating Imprec plugins which need some more advanced treatment like removing junk code, counting commands etc...

Hacker Disassembler Engine (HDE) version 0.08

version 0.08 [27.08.2007]

+ sources translated to nasm

+ code is position independent now

Edited September 8, 200717 yr by Oldschool Hardtrancer

version 0.09 [02.10.2007]

+ optimized and small code from 978 to 660 bytes

Very useful for deobfuscation

Hacker Disassembler Engine 32 version 0.11

* now the function follow C convension

* now elf32 object file doesn't contain nasm's comment, so bug when linking with mingw-gcc disappear

* now omf object is compiled directly with nasm, and there is no bug when linking with Borland C++

* now win32 dll doesn't contain versioninfo

* corrected pascal header file

Very useful for deobfuscation

indeed.

Direct Download link : http://patkov-site.narod.ru/download/hde32-0.11.tar.gz

Pascal/Delphi version in the attachments.

Regards

HDE_Pascal.rar

It would be great, if you would add some samples.

How to use:

var
	instruction :HDEInstruction; // holds instruction info
...
	HDEDisasm(buffer, instruction); // param 'buffer' holds the data to disassemble (pchar, pointer...)

HDEInstruction struct:

	HDEInstruction = packed record
		len		: byte;	 { length of command							 }
		p_rep	  : byte;	 { rep/repz (0xf3) & repnz (0xf2) prefix		 }
		p_lock	 : byte;	 { lock prefix: 0xf0							 }
		p_seg	  : byte;	 { segment prefix: 0x2e,0x36,0x3e,0x26,0x64,0x65 }
		p_66	   : byte;	 { operand-size override prefix: 0x66			}
		p_67	   : byte;	 { address-size override prefix: 0x67			}
		opcode	 : byte;	 { opcode										}
		opcode2	: byte;	 { second opcode (if first opcode is 0x0f)	   }
		modrm	  : byte;	 { ModR/M byte								   }
		modrm_mod  : byte;	 {   mod field of ModR/M						 }
		modrm_reg  : byte;	 {   reg field of ModR/M						 }
		modrm_rm   : byte;	 {   r/m field of ModR/M						 }
		sib		: byte;	 { SIB byte									  }
		sib_scale  : byte;	 {   scale field of SIB						  }
		sib_index  : byte;	 {   index field of SIB						  }
		sib_base   : byte;	 {   base field of SIB						   }
		imm8	   : byte;	 { immediate value imm8						  }
		imm16	  : word;	 { immediate value imm16						 }
		imm32	  : dword;	{ immediate value imm32						 }
		disp8	  : byte;	 { displacement disp8							}
		disp16	 : word;	 { displacement disp16						   }
		disp32	 : dword;	{ displacement disp32						   }
		rel8	   : byte;	 { relative address rel8						 }
		rel16	  : word;	 { relative address rel16						}
		rel32	  : dword;	{ relative address rel32						}{i}		imm32_offs : byte;	 { immediate value (imm32) offset in code		} \\ NEW
{i}		disp32_offs: byte;	 { displacement (disp32) offset in code		  } \\ NEW
{i}		rel32_offs : byte;	 { relative address (rel32) offset in code	   } \\ NEW
	end;

Regards

Edited March 17, 200817 yr by in4matics

i am using a different language at the moment for my disassm project. i was curious if someone already had the following.

this library as a .dll already compiled-

a list of functions that the library contains, and their associated types, returns, etc.

i am currently using the freely posted ollydbg 1.0 engine for disassm in one of my projects, but that library is very old and does not contain the sse, instructions, etc.

thanks in advance for the help!

best,

Cal

Edited March 19, 200817 yr by Caliber

this library as a .dll already compiled-

Yes, it also has coff, omf and elf32 objects, that you can statically link to your code.

a list of functions that the library contains, and their associated types, returns, etc.

One function:

hde32_disasm(const void *code, hde32s *hs)

which takes two parameters:

-a pointer to the code you want to disassemble...

- a pointer to the following structure:

typedef struct {

unsigned char len; /* length of command */

unsigned char p_rep; /* rep/repz (0xf3) & repnz (0xf2) prefix */

unsigned char p_lock; /* lock prefix: 0xf0 */

unsigned char p_seg; /* segment prefix: 0x2e,0x36,0x3e,0x26,0x64,0x65 */

unsigned char p_66; /* operand-size override prefix: 0x66 */

unsigned char p_67; /* address-size override prefix: 0x67 */

unsigned char opcode; /* opcode */

unsigned char opcode2; /* second opcode (if first opcode is 0x0f) */

unsigned char modrm; /* ModR/M byte */

unsigned char modrm_mod; /* mod field of ModR/M */

unsigned char modrm_reg; /* reg field of ModR/M */

unsigned char modrm_rm; /* r/m field of ModR/M */

unsigned char sib; /* SIB byte */

unsigned char sib_scale; /* scale field of SIB */

unsigned char sib_index; /* index field of SIB */

unsigned char sib_base; /* base field of SIB */

unsigned char imm8; /* immediate value imm8 */

unsigned short imm16; /* immediate value imm16 */

unsigned long imm32; /* immediate value imm32 */

unsigned char disp8; /* displacement disp8 */

unsigned short disp16; /* displacement disp16 */

unsigned long disp32; /* displacement disp32 */

unsigned char rel8; /* relative address rel8 */

unsigned short rel16; /* relative address rel16 */

unsigned long rel32; /* relative address rel32 */

} hde32s;

Now, since all this information is in the package, i don't know if you have it available...

There you go:

http://patkov-site.narod.ru/download/hde32-0.11.tar.gz

BTW This is just an LDE, that is, it will just give some formatted basic information about the opcode such as:

length

prefix

[relative] addresses (if any)

but no mnemonics

You might want to take a look at BeaEngine/LDE64 from Beatrix/FRET which support 32 + 64 bit + MMX, SSE, SSE2, SSE3, SSSE3 (SSE4), VMX...

http://reverseengineering.online.fr/tools/...gine/index1.php

16 august 2008, Thursday

Hacker Disassembler Engine 32 version 0.15

now engine detects instruction with invalid operands (like `lea eax,ecx')

changes in the documentation and headers

Latest versions, noticed this topic was a couple versions behind an lacking other types:

Asm Version

hde32-0.24.tar.gz (Sources + i386 libraries, 23.4 KB)

_http://patkov-site.narod.ru/download/hde32-0.24.tar.gz

C Version

hde32c-0.24.01.tar.gz (Sources, 4.7 KB)

_http://patkov-site.narod.ru/download/hde32c-0.24.01.tar.gz

64 Bit

hde64c-0.01.tar.gz (Sources, 11.3 KB)

_http://patkov-site.narod.ru/download/hde64c-0.01.tar.gz

Edited September 30, 200816 yr by What

@killboy

can attach BeaEngine here coz the original dead