| 
28 | 28 | 
 
  | 
29 | 29 | The following example program uses Zydis to disassemble a given memory buffer and prints the output to the console ([more examples here](./examples/)).  | 
30 | 30 | 
 
  | 
31 |  | -```C  | 
32 |  | -#include <stdio.h>  | 
33 |  | -#include <inttypes.h>  | 
34 |  | -#include <Zydis/Zydis.h>  | 
35 |  | - | 
36 |  | -int main()  | 
37 |  | -{  | 
38 |  | -    ZyanU8 data[] =  | 
39 |  | -    {  | 
40 |  | -        0x51, 0x8D, 0x45, 0xFF, 0x50, 0xFF, 0x75, 0x0C, 0xFF, 0x75,  | 
41 |  | -        0x08, 0xFF, 0x15, 0xA0, 0xA5, 0x48, 0x76, 0x85, 0xC0, 0x0F,  | 
42 |  | -        0x88, 0xFC, 0xDA, 0x02, 0x00  | 
43 |  | -    };  | 
44 |  | - | 
45 |  | -    // Initialize decoder context  | 
46 |  | -    ZydisDecoder decoder;  | 
47 |  | -    ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);  | 
48 |  | - | 
49 |  | -    // Initialize formatter. Only required when you actually plan to do instruction  | 
50 |  | -    // formatting ("disassembling"), like we do here  | 
51 |  | -    ZydisFormatter formatter;  | 
52 |  | -    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);  | 
53 |  | - | 
54 |  | -    // Loop over the instructions in our buffer.  | 
55 |  | -    // The runtime-address (instruction pointer) is chosen arbitrary here in order to better  | 
56 |  | -    // visualize relative addressing  | 
57 |  | -    ZyanU64 runtime_address = 0x007FFFFFFF400000;  | 
58 |  | -    ZyanUSize offset = 0;  | 
59 |  | -    const ZyanUSize length = sizeof(data);  | 
60 |  | -    ZydisDecodedInstruction instruction;  | 
61 |  | -    ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT_VISIBLE];  | 
62 |  | -    while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, data + offset, length - offset,  | 
63 |  | -        &instruction, operands, ZYDIS_MAX_OPERAND_COUNT_VISIBLE,   | 
64 |  | -        ZYDIS_DFLAG_VISIBLE_OPERANDS_ONLY)))  | 
65 |  | -    {  | 
66 |  | -        // Print current instruction pointer.  | 
67 |  | -        printf("%016" PRIX64 "  ", runtime_address);  | 
68 |  | - | 
69 |  | -        // Format & print the binary instruction structure to human-readable format  | 
70 |  | -        char buffer[256];  | 
71 |  | -        ZydisFormatterFormatInstruction(&formatter, &instruction, operands,  | 
72 |  | -            instruction.operand_count_visible, buffer, sizeof(buffer), runtime_address, ZYAN_NULL);  | 
73 |  | -        puts(buffer);  | 
74 |  | - | 
75 |  | -        offset += instruction.length;  | 
76 |  | -        runtime_address += instruction.length;  | 
77 |  | -    }  | 
78 |  | - | 
79 |  | -    return 0;  | 
80 |  | -}  | 
81 |  | -```  | 
 | 31 | +https://github.com/zyantific/zydis/blob/9cb54996c215422a398d7d2a287a08a185344200/examples/Disassemble.c#L27-L75  | 
82 | 32 | 
 
  | 
83 | 33 | ## Sample Output  | 
84 | 34 | 
 
  | 
 | 
0 commit comments