Zydis

[TimoVJL]

Another disassembler engine:
Zyan Disassembler Engine (Zydis)

Code size about 300 kb.

EDIT: PEObjDisAsm, an example for an object file asm dump.

EDIT 2017-10-25: PEObjDisAsm_WS_a3.zip with modified line lengths src\Generated\DecoderTables.inc.
                           additional files FormatHelperMasm.c FormatterMasm.c

EDIT 2017-11-22: PEObjDisAsm_WS_a7.zip code bytes and funtion names.
EDIT 2018-02-14: PEObjDisAsm_WS_a8.zip some fixes for symbols.

[Jokaste]

Very interesting. I download it immediatly.

[TimoVJL]

A tool to modify line lengths of src\Generated\DecoderTables.inc.
In C source file line length limit is 4096, at least in pocc.

[Jokaste]

For me that's good
Having a simple listing is nice for me
I would like to have an other with the addresses for seeing aligment
And an other that indicates if the source/destination operand(s) is/are register or memory operand.
That for later giving a name to the address.
I me problems with 2 files, I join into the zip the obj and the source file.
Good work... continue.

[Vortex]

Hi Timo,

Once again, impressive work. Let me study your project.

[Jokaste]

Is this project finished?

[TimoVJL]

Is something missing from that example?

[Jokaste]

Data segments and Resources.
Or a dump of the datas.
It there was an option for getting bytes code this would be great.
I made a program to optimize source code from podump, strages addresses computed, no possibility to know datas aligment.
PoDump gives the byes code and the source code the two were precious.
With your program i like taht you give the window's functions.
Knowing it we can built (or suppose) the function arguments.
With that we can identify the datas.

[TimoVJL]

Last version prints code bytes.

EDIT: 2018-02-13: Updated example using Zydis.dll.

[Jokaste]

 

[TimoVJL]

Zydis 3 testing.

[bitcoin]

Sample  test_zydis1.zip not working.
I need to download zydis from github? Or what?

[TimoVJL]

You need a proper Zydis dll too.
https://forum.pellesc.de/index.php?topic=7206.msg29081#msg29081

Busy right now, but if it doesn't work, just tell me.

[bitcoin]

This sample (with DLL ) works. but I delete msvcrt_main.c, because if fails in "#pragma comment(lib, "msvcrt.lib")" (not found).
Works good without this.

[TimoVJL]

msvcrt.lib isn't included in Pelles C, have to find one