Jump to content
Tuts 4 You
Sign in to follow this  
Teddy Rogers

Hacker Disassembler Engine + Source Code...

Recommended Posts

Teddy Rogers

Hacker Disassembler Engine:

Hacker Disassembler Engine, or HDE, is small disassembler engine, which intend to code analyse. HDE get length of command, prefixes, ModR/M and SIB bytes, opcode, immediate, displacement, relative address, etc. For example, you can use HDE when writing unpackers or decryptors executable files, because more others disassemblers too big, get only disasm listing and aren't intended for code analys, but more simple

length disassemblers usually get too little info. HDE get enough info to analyse, but it has very small size. HDE package include DLL, object, header files and and source.

+ support MMX, SSE, SSE2, SSE3, 3DNow! instructions

+ high-speed & small size (coded in assembler ;)

+ compatibility with most coding language

To disassemble should call hde_disasm function:

   void hde_disasm(
void *pCode // pointer to code
HDE_STRUCT *pHDE_STRUCT // pointer to structure HDE_STRUCT
)

After execute, you get filled structure HDE_STRUCT:

   typedef struct _HDE_STRUCT
{
BYTE len; // length of command
BYTE p_rep; // rep/repnz/.. prefix: 0xF2 or 0xF3
BYTE p_lock; // lock prefix 0xF0
BYTE p_seg; // segment prefix: 0x2E, 0x36, 0x3E, 0x26, 0x64, 0x65
BYTE p_66; // prefix 0x66
BYTE p_67; // prefix 0x67
BYTE opcode; // opcode
BYTE opcode2; // second opcode, if first opcode equal 0x0F
BYTE modrm; // ModR/M byte
BYTE modrm_mod; // - mod byte of ModR/M
BYTE modrm_reg; // - reg byte of ModR/M
BYTE modrm_rm; // - r/m byte of ModR/M
BYTE sib; // SIB byte
BYTE sib_scale; // - scale (ss) byte of SIB
BYTE sib_index; // - index byte of SIB
BYTE sib_base; // - base byte of SIB
BYTE imm8; // immediate imm8
WORD imm16; // immediate imm16
DWORD imm32; // immediate imm32
BYTE disp8; // displacement disp8
WORD disp16; // displacement disp16, if prefix 0x67 exist
DWORD disp32; // displacement disp32
BYTE rel8; // relative address rel8
WORD rel16; // relative address rel16, if prefix 0x66 exist
DWORD rel32; // relative address rel32
} HDE_STRUCT;
Opcode and len fields always exist, others are optional and depend of command. If

field's value equal zero, then it isn't existing.

Note: HDE work only with 32-bit commands of x86 processors !

Improvements, suggestions and bugfixes are welcomed.

Home Page:

http://vxheavens.com/vx.php?id=eh04

Ted.

hde.0.02.zip

hde.0.03.zip

hde28b.zip

hde28c.zip

hde6404c.zip

hde27b.zip

hde27c.zip

  • Like 1

Share this post


Link to post
antrobs

Oopss! not for me need to practice coding first, but it's a good tool to collect.... :D Thanks

aNtRoBs

Share this post


Link to post
Oldschool Hardtrancer

Hacker Disassembler Engine (HDE) v0.06

version 0.06 [03.01.2007]

+ some optimization: changed standard stack frames in procedures to

more optimized enter/leave

+ corrected C/C++ header file

+ added C example

version 0.05 [28.11.2006]

+ fixed bug with displacements (thx: Napalm)

+ fixed bug with length of command

+ added object files in elf32 format

Share this post


Link to post
Oldschool Hardtrancer

Hacker Disassembler Engine (HDE) version 0.07 - 09.02.2007

- fixed bug with F6 and F7 opcodes

- added support of FPU commands

- optimized and small code

- corrected documentation

Share this post


Link to post
Loki

Has anyone actually done anything useful with this? I've not really looked at it and was wondering if its worthwhile.

Share this post


Link to post
Whiterat

Very useful indeed :)

Great for trying to differentiate between opcodes and data. (i.e 0xCC and INT3 when restoring nanos)

Share this post


Link to post
Loki

Ah, fair point. Think I'll download and store this one for when a have a bit of time spare then!

Thanks for the comment WhiteRat.

Share this post


Link to post
Killboy

One very good argument is its size. 1kb is almost nothing, very useful for creating Imprec plugins which need some more advanced treatment like removing junk code, counting commands etc...

Share this post


Link to post
Oldschool Hardtrancer

Hacker Disassembler Engine (HDE) version 0.08

version 0.08 [27.08.2007]

+ sources translated to nasm

+ code is position independent now

Edited by Oldschool Hardtrancer (see edit history)

Share this post


Link to post
Oldschool Hardtrancer
version 0.09 [02.10.2007]

+ optimized and small code from 978 to 660 bytes

Share this post


Link to post
rendari

Very useful for deobfuscation :)

Share this post


Link to post
What

Hacker Disassembler Engine 32 version 0.11

* now the function follow C convension

* now elf32 object file doesn't contain nasm's comment, so bug when linking with mingw-gcc disappear

* now omf object is compiled directly with nasm, and there is no bug when linking with Borland C++

* now win32 dll doesn't contain versioninfo

* corrected pascal header file

Share this post


Link to post
BlacKaT
Very useful for deobfuscation :)

indeed.

Share this post


Link to post
4e4en

It would be great, if you would add some samples.

Share this post


Link to post
in4matics

How to use:

var
instruction :HDEInstruction; // holds instruction info
...
HDEDisasm(buffer, instruction); // param 'buffer' holds the data to disassemble (pchar, pointer...)

HDEInstruction struct:

	HDEInstruction = packed record
len : byte; { length of command }
p_rep : byte; { rep/repz (0xf3) & repnz (0xf2) prefix }
p_lock : byte; { lock prefix: 0xf0 }
p_seg : byte; { segment prefix: 0x2e,0x36,0x3e,0x26,0x64,0x65 }
p_66 : byte; { operand-size override prefix: 0x66 }
p_67 : byte; { address-size override prefix: 0x67 }
opcode : byte; { opcode }
opcode2 : byte; { second opcode (if first opcode is 0x0f) }
modrm : byte; { ModR/M byte }
modrm_mod : byte; { mod field of ModR/M }
modrm_reg : byte; { reg field of ModR/M }
modrm_rm : byte; { r/m field of ModR/M }
sib : byte; { SIB byte }
sib_scale : byte; { scale field of SIB }
sib_index : byte; { index field of SIB }
sib_base : byte; { base field of SIB }
imm8 : byte; { immediate value imm8 }
imm16 : word; { immediate value imm16 }
imm32 : dword; { immediate value imm32 }
disp8 : byte; { displacement disp8 }
disp16 : word; { displacement disp16 }
disp32 : dword; { displacement disp32 }
rel8 : byte; { relative address rel8 }
rel16 : word; { relative address rel16 }
rel32 : dword; { relative address rel32 }{i} imm32_offs : byte; { immediate value (imm32) offset in code } \\ NEW
{i} disp32_offs: byte; { displacement (disp32) offset in code } \\ NEW
{i} rel32_offs : byte; { relative address (rel32) offset in code } \\ NEW
end;

Regards

Edited by in4matics (see edit history)

Share this post


Link to post
Caliber

i am using a different language at the moment for my disassm project. i was curious if someone already had the following.

this library as a .dll already compiled-

a list of functions that the library contains, and their associated types, returns, etc.

i am currently using the freely posted ollydbg 1.0 engine for disassm in one of my projects, but that library is very old and does not contain the sse, instructions, etc.

thanks in advance for the help!

best,

Cal

Edited by Caliber (see edit history)

Share this post


Link to post
HVC
this library as a .dll already compiled-

Yes, it also has coff, omf and elf32 objects, that you can statically link to your code.

a list of functions that the library contains, and their associated types, returns, etc.

One function:

hde32_disasm(const void *code, hde32s *hs)

which takes two parameters:

-a pointer to the code you want to disassemble...

- a pointer to the following structure:

typedef struct {

unsigned char len; /* length of command */

unsigned char p_rep; /* rep/repz (0xf3) & repnz (0xf2) prefix */

unsigned char p_lock; /* lock prefix: 0xf0 */

unsigned char p_seg; /* segment prefix: 0x2e,0x36,0x3e,0x26,0x64,0x65 */

unsigned char p_66; /* operand-size override prefix: 0x66 */

unsigned char p_67; /* address-size override prefix: 0x67 */

unsigned char opcode; /* opcode */

unsigned char opcode2; /* second opcode (if first opcode is 0x0f) */

unsigned char modrm; /* ModR/M byte */

unsigned char modrm_mod; /* mod field of ModR/M */

unsigned char modrm_reg; /* reg field of ModR/M */

unsigned char modrm_rm; /* r/m field of ModR/M */

unsigned char sib; /* SIB byte */

unsigned char sib_scale; /* scale field of SIB */

unsigned char sib_index; /* index field of SIB */

unsigned char sib_base; /* base field of SIB */

unsigned char imm8; /* immediate value imm8 */

unsigned short imm16; /* immediate value imm16 */

unsigned long imm32; /* immediate value imm32 */

unsigned char disp8; /* displacement disp8 */

unsigned short disp16; /* displacement disp16 */

unsigned long disp32; /* displacement disp32 */

unsigned char rel8; /* relative address rel8 */

unsigned short rel16; /* relative address rel16 */

unsigned long rel32; /* relative address rel32 */

} hde32s;

Now, since all this information is in the package, i don't know if you have it available... :unsure:

There you go:

http://patkov-site.narod.ru/download/hde32-0.11.tar.gz

Share this post


Link to post
Killboy

BTW This is just an LDE, that is, it will just give some formatted basic information about the opcode such as:

length

prefix

[relative] addresses (if any)

but no mnemonics :)

You might want to take a look at BeaEngine/LDE64 from Beatrix/FRET which support 32 + 64 bit + MMX, SSE, SSE2, SSE3, SSSE3 (SSE4), VMX...

http://reverseengineering.online.fr/tools/...gine/index1.php

Share this post


Link to post
linhanshi

16 august 2008, Thursday

Hacker Disassembler Engine 32 version 0.15

now engine detects instruction with invalid operands (like `lea eax,ecx')

changes in the documentation and headers

Share this post


Link to post
What

Latest versions, noticed this topic was a couple versions behind an lacking other types:

Asm Version

hde32-0.24.tar.gz (Sources + i386 libraries, 23.4 KB)

_http://patkov-site.narod.ru/download/hde32-0.24.tar.gz

C Version

hde32c-0.24.01.tar.gz (Sources, 4.7 KB)

_http://patkov-site.narod.ru/download/hde32c-0.24.01.tar.gz

64 Bit

hde64c-0.01.tar.gz (Sources, 11.3 KB)

_http://patkov-site.narod.ru/download/hde64c-0.01.tar.gz

Edited by What (see edit history)

Share this post


Link to post
GEEK

@killboy

can attach BeaEngine here coz the original dead

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
×
×
  • Create New...