Teddy Rogers Posted July 25, 2006 Share Posted July 25, 2006 Hacker Disassembler Engine: Hacker Disassembler Engine, or HDE, is small disassembler engine, which intend to code analyse. HDE get length of command, prefixes, ModR/M and SIB bytes, opcode, immediate, displacement, relative address, etc. For example, you can use HDE when writing unpackers or decryptors executable files, because more others disassemblers too big, get only disasm listing and aren't intended for code analys, but more simplelength disassemblers usually get too little info. HDE get enough info to analyse, but it has very small size. HDE package include DLL, object, header files and and source. + support MMX, SSE, SSE2, SSE3, 3DNow! instructions + high-speed & small size (coded in assembler + compatibility with most coding language To disassemble should call hde_disasm function: void hde_disasm( void *pCode // pointer to code HDE_STRUCT *pHDE_STRUCT // pointer to structure HDE_STRUCT ) After execute, you get filled structure HDE_STRUCT: typedef struct _HDE_STRUCT { BYTE len; // length of command BYTE p_rep; // rep/repnz/.. prefix: 0xF2 or 0xF3 BYTE p_lock; // lock prefix 0xF0 BYTE p_seg; // segment prefix: 0x2E, 0x36, 0x3E, 0x26, 0x64, 0x65 BYTE p_66; // prefix 0x66 BYTE p_67; // prefix 0x67 BYTE opcode; // opcode BYTE opcode2; // second opcode, if first opcode equal 0x0F BYTE modrm; // ModR/M byte BYTE modrm_mod; // - mod byte of ModR/M BYTE modrm_reg; // - reg byte of ModR/M BYTE modrm_rm; // - r/m byte of ModR/M BYTE sib; // SIB byte BYTE sib_scale; // - scale (ss) byte of SIB BYTE sib_index; // - index byte of SIB BYTE sib_base; // - base byte of SIB BYTE imm8; // immediate imm8 WORD imm16; // immediate imm16 DWORD imm32; // immediate imm32 BYTE disp8; // displacement disp8 WORD disp16; // displacement disp16, if prefix 0x67 exist DWORD disp32; // displacement disp32 BYTE rel8; // relative address rel8 WORD rel16; // relative address rel16, if prefix 0x66 exist DWORD rel32; // relative address rel32 } HDE_STRUCT; Opcode and len fields always exist, others are optional and depend of command. Iffield's value equal zero, then it isn't existing. Note: HDE work only with 32-bit commands of x86 processors ! Improvements, suggestions and bugfixes are welcomed. Home Page: http://vxheavens.com/vx.php?id=eh04 Ted. hde.0.02.zip hde.0.03.zip hde28b.zip hde28c.zip hde6404c.zip hde27b.zip hde27c.zip Link to comment
yamraaj Posted July 25, 2006 Share Posted July 25, 2006 Correct english Homepagehttp://patkov-site.narod.ru/eng.html Link to comment
Napalm Posted August 28, 2006 Share Posted August 28, 2006 Hacker Disassembler Engine 0.04: version 0.04 [08.08.2006]------------------------------------------ + optimized and small code (~1 kb) + some bugfixes http://rapidshare.de/files/31023129/hde.0.04.zip.html Enjoy! Napalm Link to comment
antrobs Posted August 30, 2006 Share Posted August 30, 2006 Oopss! not for me need to practice coding first, but it's a good tool to collect.... Thanks aNtRoBs Link to comment
Oldschool Hardtrancer Posted January 17, 2007 Share Posted January 17, 2007 Hacker Disassembler Engine (HDE) v0.06version 0.06 [03.01.2007] + some optimization: changed standard stack frames in procedures to more optimized enter/leave + corrected C/C++ header file + added C example version 0.05 [28.11.2006] + fixed bug with displacements (thx: Napalm) + fixed bug with length of command + added object files in elf32 format Link to comment
Oldschool Hardtrancer Posted March 31, 2007 Share Posted March 31, 2007 Hacker Disassembler Engine (HDE) version 0.07 - 09.02.2007- fixed bug with F6 and F7 opcodes - added support of FPU commands - optimized and small code - corrected documentation Link to comment
Loki Posted April 2, 2007 Share Posted April 2, 2007 Has anyone actually done anything useful with this? I've not really looked at it and was wondering if its worthwhile. Link to comment
Whiterat Posted April 2, 2007 Share Posted April 2, 2007 Very useful indeed Great for trying to differentiate between opcodes and data. (i.e 0xCC and INT3 when restoring nanos) Link to comment
Loki Posted April 3, 2007 Share Posted April 3, 2007 Ah, fair point. Think I'll download and store this one for when a have a bit of time spare then!Thanks for the comment WhiteRat. Link to comment
Killboy Posted April 3, 2007 Share Posted April 3, 2007 One very good argument is its size. 1kb is almost nothing, very useful for creating Imprec plugins which need some more advanced treatment like removing junk code, counting commands etc... Link to comment
Oldschool Hardtrancer Posted September 8, 2007 Share Posted September 8, 2007 (edited) Hacker Disassembler Engine (HDE) version 0.08version 0.08 [27.08.2007] + sources translated to nasm + code is position independent now Edited September 8, 2007 by Oldschool Hardtrancer Link to comment
Oldschool Hardtrancer Posted January 5, 2008 Share Posted January 5, 2008 version 0.09 [02.10.2007] + optimized and small code from 978 to 660 bytes Link to comment
rendari Posted January 5, 2008 Share Posted January 5, 2008 Very useful for deobfuscation Link to comment
What Posted March 2, 2008 Share Posted March 2, 2008 Hacker Disassembler Engine 32 version 0.11* now the function follow C convension * now elf32 object file doesn't contain nasm's comment, so bug when linking with mingw-gcc disappear * now omf object is compiled directly with nasm, and there is no bug when linking with Borland C++ * now win32 dll doesn't contain versioninfo * corrected pascal header file Link to comment
BlacKaT Posted March 2, 2008 Share Posted March 2, 2008 Very useful for deobfuscation indeed. Link to comment
Loki Posted March 2, 2008 Share Posted March 2, 2008 Direct Download link : http://patkov-site.narod.ru/download/hde32-0.11.tar.gz Link to comment
in4matics Posted March 10, 2008 Share Posted March 10, 2008 Pascal/Delphi version in the attachments. Regards HDE_Pascal.rar 2 Link to comment
4e4en Posted March 10, 2008 Share Posted March 10, 2008 It would be great, if you would add some samples. Link to comment
in4matics Posted March 17, 2008 Share Posted March 17, 2008 (edited) How to use:var instruction :HDEInstruction; // holds instruction info... HDEDisasm(buffer, instruction); // param 'buffer' holds the data to disassemble (pchar, pointer...)HDEInstruction struct: HDEInstruction = packed record len : byte; { length of command } p_rep : byte; { rep/repz (0xf3) & repnz (0xf2) prefix } p_lock : byte; { lock prefix: 0xf0 } p_seg : byte; { segment prefix: 0x2e,0x36,0x3e,0x26,0x64,0x65 } p_66 : byte; { operand-size override prefix: 0x66 } p_67 : byte; { address-size override prefix: 0x67 } opcode : byte; { opcode } opcode2 : byte; { second opcode (if first opcode is 0x0f) } modrm : byte; { ModR/M byte } modrm_mod : byte; { mod field of ModR/M } modrm_reg : byte; { reg field of ModR/M } modrm_rm : byte; { r/m field of ModR/M } sib : byte; { SIB byte } sib_scale : byte; { scale field of SIB } sib_index : byte; { index field of SIB } sib_base : byte; { base field of SIB } imm8 : byte; { immediate value imm8 } imm16 : word; { immediate value imm16 } imm32 : dword; { immediate value imm32 } disp8 : byte; { displacement disp8 } disp16 : word; { displacement disp16 } disp32 : dword; { displacement disp32 } rel8 : byte; { relative address rel8 } rel16 : word; { relative address rel16 } rel32 : dword; { relative address rel32 }{i} imm32_offs : byte; { immediate value (imm32) offset in code } \\ NEW{i} disp32_offs: byte; { displacement (disp32) offset in code } \\ NEW{i} rel32_offs : byte; { relative address (rel32) offset in code } \\ NEW end;Regards Edited March 17, 2008 by in4matics Link to comment
Caliber Posted March 19, 2008 Share Posted March 19, 2008 (edited) i am using a different language at the moment for my disassm project. i was curious if someone already had the following.this library as a .dll already compiled-a list of functions that the library contains, and their associated types, returns, etc.i am currently using the freely posted ollydbg 1.0 engine for disassm in one of my projects, but that library is very old and does not contain the sse, instructions, etc.thanks in advance for the help!best,Cal Edited March 19, 2008 by Caliber Link to comment
HVC Posted March 19, 2008 Share Posted March 19, 2008 this library as a .dll already compiled- Yes, it also has coff, omf and elf32 objects, that you can statically link to your code. a list of functions that the library contains, and their associated types, returns, etc. One function: hde32_disasm(const void *code, hde32s *hs) which takes two parameters: -a pointer to the code you want to disassemble... - a pointer to the following structure: typedef struct { unsigned char len; /* length of command */ unsigned char p_rep; /* rep/repz (0xf3) & repnz (0xf2) prefix */ unsigned char p_lock; /* lock prefix: 0xf0 */ unsigned char p_seg; /* segment prefix: 0x2e,0x36,0x3e,0x26,0x64,0x65 */ unsigned char p_66; /* operand-size override prefix: 0x66 */ unsigned char p_67; /* address-size override prefix: 0x67 */ unsigned char opcode; /* opcode */ unsigned char opcode2; /* second opcode (if first opcode is 0x0f) */ unsigned char modrm; /* ModR/M byte */ unsigned char modrm_mod; /* mod field of ModR/M */ unsigned char modrm_reg; /* reg field of ModR/M */ unsigned char modrm_rm; /* r/m field of ModR/M */ unsigned char sib; /* SIB byte */ unsigned char sib_scale; /* scale field of SIB */ unsigned char sib_index; /* index field of SIB */ unsigned char sib_base; /* base field of SIB */ unsigned char imm8; /* immediate value imm8 */ unsigned short imm16; /* immediate value imm16 */ unsigned long imm32; /* immediate value imm32 */ unsigned char disp8; /* displacement disp8 */ unsigned short disp16; /* displacement disp16 */ unsigned long disp32; /* displacement disp32 */ unsigned char rel8; /* relative address rel8 */ unsigned short rel16; /* relative address rel16 */ unsigned long rel32; /* relative address rel32 */ } hde32s; Now, since all this information is in the package, i don't know if you have it available... There you go: http://patkov-site.narod.ru/download/hde32-0.11.tar.gz Link to comment
Killboy Posted March 19, 2008 Share Posted March 19, 2008 BTW This is just an LDE, that is, it will just give some formatted basic information about the opcode such as: length prefix [relative] addresses (if any) but no mnemonics You might want to take a look at BeaEngine/LDE64 from Beatrix/FRET which support 32 + 64 bit + MMX, SSE, SSE2, SSE3, SSSE3 (SSE4), VMX... http://reverseengineering.online.fr/tools/...gine/index1.php Link to comment
linhanshi Posted August 17, 2008 Share Posted August 17, 2008 16 august 2008, ThursdayHacker Disassembler Engine 32 version 0.15now engine detects instruction with invalid operands (like `lea eax,ecx')changes in the documentation and headers Link to comment
What Posted September 30, 2008 Share Posted September 30, 2008 (edited) Latest versions, noticed this topic was a couple versions behind an lacking other types:Asm Versionhde32-0.24.tar.gz (Sources + i386 libraries, 23.4 KB) _http://patkov-site.narod.ru/download/hde32-0.24.tar.gzC Versionhde32c-0.24.01.tar.gz (Sources, 4.7 KB) _http://patkov-site.narod.ru/download/hde32c-0.24.01.tar.gz64 Bithde64c-0.01.tar.gz (Sources, 11.3 KB) _http://patkov-site.narod.ru/download/hde64c-0.01.tar.gz Edited September 30, 2008 by What Link to comment
GEEK Posted September 30, 2008 Share Posted September 30, 2008 @killboycan attach BeaEngine here coz the original dead Link to comment
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now