|
| 1 | +/*************************************************************************************************** |
| 2 | +
|
| 3 | + Zyan Disassembler Library (Zydis) |
| 4 | +
|
| 5 | + Original Author : Joel Hoener |
| 6 | +
|
| 7 | + * Permission is hereby granted, free of charge, to any person obtaining a copy |
| 8 | + * of this software and associated documentation files (the "Software"), to deal |
| 9 | + * in the Software without restriction, including without limitation the rights |
| 10 | + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
| 11 | + * copies of the Software, and to permit persons to whom the Software is |
| 12 | + * furnished to do so, subject to the following conditions: |
| 13 | + * |
| 14 | + * The above copyright notice and this permission notice shall be included in all |
| 15 | + * copies or substantial portions of the Software. |
| 16 | + * |
| 17 | + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
| 18 | + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| 19 | + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
| 20 | + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
| 21 | + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
| 22 | + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
| 23 | + * SOFTWARE. |
| 24 | +
|
| 25 | +***************************************************************************************************/ |
| 26 | + |
| 27 | +/** |
| 28 | + * @file |
| 29 | + * Demonstrates disassembling using the "all-in-one" disassembler API. |
| 30 | + */ |
| 31 | + |
| 32 | +#include <stdio.h> |
| 33 | +#include <inttypes.h> |
| 34 | +#include <Zydis/Zydis.h> |
| 35 | + |
| 36 | +int main() |
| 37 | +{ |
| 38 | + ZyanU8 data[] = |
| 39 | + { |
| 40 | + 0x51, 0x8D, 0x45, 0xFF, 0x50, 0xFF, 0x75, 0x0C, 0xFF, 0x75, |
| 41 | + 0x08, 0xFF, 0x15, 0xA0, 0xA5, 0x48, 0x76, 0x85, 0xC0, 0x0F, |
| 42 | + 0x88, 0xFC, 0xDA, 0x02, 0x00 |
| 43 | + }; |
| 44 | + |
| 45 | + // The runtime address (instruction pointer) was chosen arbitrarily here in order to better |
| 46 | + // visualize relative addressing. In your actual program, set this to e.g. the memory address |
| 47 | + // that the code being disassembled was read from. |
| 48 | + ZyanU64 runtime_address = 0x007FFFFFFF400000; |
| 49 | + |
| 50 | + // Loop over the instructions in our buffer. |
| 51 | + ZyanUSize offset = 0; |
| 52 | + ZydisDisassembledInstruction instruction; |
| 53 | + while (ZYAN_SUCCESS(ZydisDisassembleIntel( |
| 54 | + /* machine_mode: */ ZYDIS_MACHINE_MODE_LONG_64, |
| 55 | + /* runtime_address: */ runtime_address, |
| 56 | + /* buffer: */ data + offset, |
| 57 | + /* length: */ sizeof(data) - offset, |
| 58 | + /* instruction: */ &instruction |
| 59 | + ))) { |
| 60 | + printf("%016" PRIX64 " %s\n", runtime_address, instruction.text); |
| 61 | + offset += instruction.info.length; |
| 62 | + runtime_address += instruction.info.length; |
| 63 | + } |
| 64 | + |
| 65 | + return 0; |
| 66 | +} |
0 commit comments