Not a kernel guy

… in the Windows kernel team

Thursday, July 31, 2008

diStorm64 disassembler.

Наткнулся на хороший open source disassembler, понимающий и 80×86 и amd64, и распространяемый под BSD лицензией: diStorm64.

diStorm is a binary stream disassembler. It’s capable of disassembling 80×86 instructions in 64 bits (AMD64, X86-64) and both in 16 and 32 bits. In addition, it disassembles FPU, MMX, SSE, SSE2, SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, and AMD’s SVM! diStorm was written to decode quickly every instruction as accurately as possible. Robust decoding, while taking special care for valid or unused prefixes, is what makes this disassembler powerful, especially for research. Another benefit that might come in handy is that the module was written as multi-threaded, which means you could disassemble several streams or more simultaneously.

В использовании прост как двери: на входе даётся кусок кода, разрядность и его виртуальный адрес, на выходе получается набор инструкций. Для каждой указывается мнемоника, операнды, префиксы и размер. В комплекте идет интерфейсный модуль для Python, что может быть полезно для всяких reverse engineering утилит.

Posted at 9:51 pm •

RSS feed | Trackback URI

1 Comment »

Pingback by Not a kernel guy : diStorm64 disassembler. — July 31, 2008 @ 9:53 pm

[...] from blog.not-a-kernel-guy.com. Published Friday, August 01, 2008 6:53 AM by alexeypa Filed under: [...]

 

Your Comment (smaller | larger)

You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Powered by WordPress