| DISASM.dll is Win32 DLL to provide disassembler of byte code sequence. It supports 16 and 32 bit instructions up to Pentium 3 processor, including float point. It is using the same code as embedded disassemblers of SocketSpy and XEdit utilities. | Price of full version of disasm.dll is US$19.99. Source code of disassembler in ANSI C costs US$149.99 |
||||||
| ASPID - New disassembler/decompiler tool | |||||||
| It has 2 export functions: | |||||||
| void SetIntelMode(int
b32Bits) The function select decoding mode, when b32Bits = 1, it will be 32 bit mode, otherwise 16 bit mode. The function has no return value. |
|||||||
| int
disassembler(unsigned char *
pbyBuffer, unsigned long dwAddress, char * lpDisasmStr, int bReturnWithCodes, int bReturnWithAddress); The function provides conversion of binary byte code sequence to ASCII string of assembler instruction. Parameters: pbyBuffer – pointer to byte array of the instruction queue, the buffer should be with read/write access and its contents may be modified during interpretation, because of this, use only copy of original instruction array. dwAddress - physical addess (IP register value) for current instruction lpStr – pointer to the char array to accept disassembled string, array should be big enough for disassembled string, instruction codes, and address of one instruction (usually 128 should enough) bReturnWithCodes – return with code byte (when bReturnWithCodes = 1, lpStr contains instruction codes, for example CD 2E INT 2E, otherwise it contains only assembler mnemonics - INT 2E. bReturnWithAddress - lpStr begins with hex value of dwAddress, for example: 04000000 CD 2E INT 2E. Return value: number of decoded byte, for example if you input pbyBuffer contains the for following codes: CD 2E 90 2E 8A 1E 9C 90 F8 C3 50 26 8B 07 A9 02 00 75 05 2E FF 06 94 90-2E 80 3C 00 34 00 2B 0B lpStr will receive string: CD 2E INT 2E (bReturnWithCodes = 1) return value will be equal 2 and index of pbyBuffer should be incremented by 2 for next execution of disassembler function. |
|
Test application screen shot
Example of code
Code
#includeScreen Shot of previous example#include "dasmdll.h" //disassember DLL template void main() { char szDisasmBuffer[256]; unsigned long dwAddressStart; unsigned long dwAddressEnd; unsigned char * pbyCodeBuffer; int nIndex; printf("Disassembler Test Application\n\n"); _asm { start: mov eax,offset start mov dword ptr dwAddressStart,eax mov eax,offset end mov dword ptr dwAddressEnd,eax jmp end //additional assembler lines, not executable sidt [ebx] clc mov al,byte ptr [eax] push ds pop dx call [eax+esi] imul eax bt ax,1 end: nop } SetIntelMode(1 /* TRUE*/); nIndex = dwAddressEnd - dwAddressStart; pbyCodeBuffer = (unsigned char *)malloc(nIndex); memcpy(pbyCodeBuffer,(const void*)dwAddressStart,nIndex); nIndex = 0; while((dwAddressStart+nIndex)<dwAddressEnd) { nIndex + = disassembler(&pbyCodeBuffer[nIndex],dwAddressStart nIndex szDisasmBuffer 1, 1); printf("%s",szDisasmBuffer); } free(pbyCodeBuffer); }