Package: iced-x86
iced-x86 disassembler Python bindingsiced-x86 is a blazing fast and correct x86 (16/32/64-bit) disassembler for Python.👍 Supports all Intel and AMD instructions👍 Correct: All instructions are tested and iced has been tested against other disassemblers/assemblers (xed, gas, objdump, masm, dumpbin, nasm, ndisasm) and fuzzed👍 The formatter supports masm, nasm, gas (AT&T), Intel (XED) and there are many options to customize the output👍 The encoder can be used to re-encode decoded instructions at any address👍 API to get instruction info, eg. read/written registers, memory and rflags bits; CPUID feature flag, control flow info, etc👍 Rust + Python👍 License: MITRust crate:https://github.com/icedland/iced/blob/master/src/rust/iced-x86/README.mdInstalling iced-x86It's onPyPIwith built wheels for Windows, macOS and Linux so this command should work (usepythonorpyif on Windows):python3-mpipinstall-Uiced-x86Ifpiptries to build it from source and fails, see below for all required build tools (eg.python3 -m pip install setuptools wheel setuptools-rustand Rusthttps://www.rust-lang.org/tools/install).Building the codeIf on Windows, replacepython3in all commands withpythonorpy.Prerequisites:Rust:https://www.rust-lang.org/tools/installPython >= 3.8:https://www.python.org/downloads/python3 -m pip install -r requirements.txt# Create the wheelpython3setup.pybdist_wheel# Install the built wheelpython3-mpipinstalliced-x86--no-index-fdist--only-binaryiced-x86# Uninstall your built copypython3-mpipuninstalliced-x86Prerequisites (tests/docs):python3 -m pip install -r requirements-dev.txtTests:python3setup.pybdist_wheel
python3-mpipinstalliced-x86--no-index-fdist--only-binaryiced-x86
python3-mpytest
python3-mpipuninstall-yiced-x86Docs:# Need the built module in build/lib/python3setup.pybdist_wheel# Build the docspython3-msphinx--color-n-W--keep-going-bhtmldocsdocs/_build# Test the doc examplespython3-msphinx--color-n-W--keep-going-bdoctestdocsdocs/_buildHow-tosDisassemble (decode and format instructions)Adding type annotationsCreate and encode instructionsMove code in memory (eg. hook a function)Get instruction info, eg. read/written regs/mem, control flow info, etcDisassemble old/deprecated CPU instructionsDisassemble (decode and format instructions)This example uses aDecoderand one of theFormatters to decode and format the code.
The last part shows how to use format specifiers to format instructions.fromiced_x86import*# This example produces the following output:# 00007FFAC46ACDA4 48895C2410           mov       [rsp+10h],rbx# 00007FFAC46ACDA9 4889742418           mov       [rsp+18h],rsi# 00007FFAC46ACDAE 55                   push      rbp# 00007FFAC46ACDAF 57                   push      rdi# 00007FFAC46ACDB0 4156                 push      r14# 00007FFAC46ACDB2 488DAC2400FFFFFF     lea       rbp,[rsp-100h]# 00007FFAC46ACDBA 4881EC00020000       sub       rsp,200h# 00007FFAC46ACDC1 488B0518570A00       mov       rax,[rel 7FFA`C475`24E0h]# 00007FFAC46ACDC8 4833C4               xor       rax,rsp# 00007FFAC46ACDCB 488985F0000000       mov       [rbp+0F0h],rax# 00007FFAC46ACDD2 4C8B052F240A00       mov       r8,[rel 7FFA`C474`F208h]# 00007FFAC46ACDD9 488D05787C0400       lea       rax,[rel 7FFA`C46F`4A58h]# 00007FFAC46ACDE0 33FF                 xor       edi,edi## Format specifiers example:# xchg [rdx+rsi+16h],ah# xchg %ah,0x16(%rdx,%rsi)# xchg [rdx+rsi+16h],ah# xchg ah,[rdx+rsi+16h]# xchg ah,[rdx+rsi+16h]# xchgb %ah, %ds:0x16(%rdx,%rsi)EXAMPLE_CODE_BITNESS=64EXAMPLE_CODE_RIP=0x0000_7FFA_C46A_CDA4EXAMPLE_CODE=\b"\x48\x89\x5C\x24\x10\x48\x89\x74\x24\x18\x55\x57\x41\x56\x48\x8D"\b"\xAC\x24\x00\xFF\xFF\xFF\x48\x81\xEC\x00\x02\x00\x00\x48\x8B\x05"\b"\x18\x57\x0A\x00\x48\x33\xC4\x48\x89\x85\xF0\x00\x00\x00\x4C\x8B"\b"\x05\x2F\x24\x0A\x00\x48\x8D\x05\x78\x7C\x04\x00\x33\xFF"# Create the decoder and initialize RIPdecoder=Decoder(EXAMPLE_CODE_BITNESS,EXAMPLE_CODE,ip=EXAMPLE_CODE_RIP)# Formatters: MASM, NASM, GAS (AT&T) and INTEL (XED).# There's also `FastFormatter` which is ~1.25x faster. Use it if formatting# speed is more important than being able to re-assemble formatted# instructions.#    formatter = FastFormatter()formatter=Formatter(FormatterSyntax.NASM)# Change some options, there are many moreformatter.digit_separator="`"formatter.first_operand_char_index=10# You can also call decoder.can_decode + decoder.decode()/decode_out(instr)# but the iterator is fasterforinstrindecoder:disasm=formatter.format(instr)# You can also get only the mnemonic string, or only one or more of the operands:#   mnemonic_str = formatter.format_mnemonic(instr, FormatMnemonicOptions.NO_PREFIXES)#   op0_str = formatter.format_operand(instr, 0)#   operands_str = formatter.format_all_operands(instr)start_index=instr.ip-EXAMPLE_CODE_RIPbytes_str=EXAMPLE_CODE[start_index:start_index+instr.len].hex().upper()# Eg. "00007FFAC46ACDB2 488DAC2400FFFFFF     lea       rbp,[rsp-100h]"print(f"{instr.ip:016X}{bytes_str:20}{disasm}")# Instruction also supports format specifiers, see the table belowdecoder=Decoder(64,b"\x86\x64\x32\x16",ip=0x1234_5678)instr=decoder.decode()print()print("Format specifiers example:")print(f"{instr:f}")print(f"{instr:g}")print(f"{instr:i}")print(f"{instr:m}")print(f"{instr:n}")print(f"{instr:gG_xSs}")# ====== =============================================================================# F-Spec Description# ====== =============================================================================# f      Fast formatter (masm-like syntax)# g      GNU Assembler formatter# i      Intel (XED) formatter# m      masm formatter# n      nasm formatter# X      Uppercase hex numbers with ``0x`` prefix# x      Lowercase hex numbers with ``0x`` prefix# H      Uppercase hex numbers with ``h`` suffix# h      Lowercase hex numbers with ``h`` suffix# r      RIP-relative memory operands use RIP register instead of abs addr (``[rip+123h]`` vs ``[123456789ABCDEF0h]``)# U      Uppercase everything except numbers and hex prefixes/suffixes (ignored by fast fmt)# s      Add a space after the operand separator# S      Always show the segment register (memory operands)# B      Don't show the branch size (``SHORT`` or ``NEAR PTR``) (ignored by fast fmt)# G      (GNU Assembler): Add mnemonic size suffix (eg. ``movl`` vs ``mov``)# M      Always show the memory size (eg. ``BYTE PTR``) even when not needed# _      Use digit separators (eg. ``0x12345678`` vs ``0x1234_5678``) (ignored by fast fmt)# ====== =============================================================================Adding type annotationsFor performance reasons, real Python enums are not used. They're just too slow. Instead, all enums are
currently modules with constants in them. However, this causes problems with type checkers such asmypysince it seesintegers instead of eg.Registers.If you add type annotations to methods or variables, the enum name to use is the enum name with an
appended_, eg. if the enum isRegister(which is a module), useRegister_as the type name.You don't need to do this with classes, eg.Instruction, since they're not enums.fromiced_x86import*BASE_REG:Register_=Register.RAXdefmy_fun(code:Code_,reg:Register_,reg2:Register_)->Register_:returnreg2my_fun(Code.RDTSC,BASE_REG,Register.ECX)Create and encode instructionsThis example uses aBlockEncoderto encode createdInstructions.fromiced_x86import*bitness=64# All created instructions get an IP of 0. The label id is just an IP.# The branch instruction's *target* IP should be equal to the IP of the# target instruction.label_id:int=1defcreate_label()->int:globallabel_ididd=label_idlabel_id+=1returnidddefadd_label(id:int,instruction:Instruction)->Instruction:instruction.ip=idreturninstructionlabel1=create_label()instructions=[]instructions.append(Instruction.create_reg(Code.PUSH_R64,Register.RBP))instructions.append(Instruction.create_reg(Code.PUSH_R64,Register.RDI))instructions.append(Instruction.create_reg(Code.PUSH_R64,Register.RSI))instructions.append(Instruction.create_reg_u32(Code.SUB_RM64_IMM32,Register.RSP,0x50))instructions.append(Instruction.create(Code.VEX_VZEROUPPER))instructions.append(Instruction.create_reg_mem(Code.LEA_R64_M,Register.RBP,MemoryOperand(Register.RSP,displ=0x60)))instructions.append(Instruction.create_reg_reg(Code.MOV_R64_RM64,Register.RSI,Register.RCX))instructions.append(Instruction.create_reg_mem(Code.LEA_R64_M,Register.RDI,MemoryOperand(Register.RBP,displ=-0x38)))instructions.append(Instruction.create_reg_i32(Code.MOV_R32_IMM32,Register.ECX,0x0A))instructions.append(Instruction.create_reg_reg(Code.XOR_R32_RM32,Register.EAX,Register.EAX))instructions.append(Instruction.create_rep_stosd(bitness))instructions.append(Instruction.create_reg_u64(Code.CMP_RM64_IMM32,Register.RSI,0x1234_5678))# Create a branch instruction that references label1instructions.append(Instruction.create_branch(Code.JNE_REL32_64,label1))instructions.append(Instruction.create(Code.NOPD))# Add the instruction that is the target of the branchinstructions.append(add_label(label1,Instruction.create_reg_reg(Code.XOR_R32_RM32,Register.R15D,Register.R15D)))# Create an instruction that accesses some data using an RIP relative memory operanddata1=create_label()instructions.append(Instruction.create_reg_mem(Code.LEA_R64_M,Register.R14,MemoryOperand(Register.RIP,displ=data1)))instructions.append(Instruction.create(Code.NOPD))raw_data=b"\x12\x34\x56\x78"instructions.append(add_label(data1,Instruction.create_declare_byte(raw_data)))# Use BlockEncoder to encode a block of instructions. This block can contain any# number of branches and any number of instructions.# It uses Encoder to encode all instructions.# If the target of a branch is too far away, it can fix it to use a longer branch.# This can be disabled by passing in `False` to the ctor.target_rip=0x0000_1248_FC84_0000encoder=BlockEncoder(bitness)encoder.add_many(instructions)encoded_bytes=encoder.encode(target_rip)# Now disassemble the encoded instructions. Note that the 'jmp near'# instruction was turned into a 'jmp short' instruction because we# didn't disable branch optimizations.bytes_code=encoded_bytes[0:len(encoded_bytes)-len(raw_data)]bytes_data=encoded_bytes[len(encoded_bytes)-len(raw_data):]decoder=Decoder(bitness,bytes_code,ip=target_rip)formatter=Formatter(FormatterSyntax.GAS)formatter.first_operand_char_index=8forinstructionindecoder:disasm=formatter.format(instruction)print(f"{instruction.ip:016X}{disasm}")db=Instruction.create_declare_byte(bytes_data)print(f"{decoder.ip:016X}{formatter.format(db)}")# Output:# 00001248FC840000 push    %rbp# 00001248FC840001 push    %rdi# 00001248FC840002 push    %rsi# 00001248FC840003 sub     $0x50,%rsp# 00001248FC84000A vzeroupper# 00001248FC84000D lea     0x60(%rsp),%rbp# 00001248FC840012 mov     %rcx,%rsi# 00001248FC840015 lea     -0x38(%rbp),%rdi# 00001248FC840019 mov     $0xA,%ecx# 00001248FC84001E xor     %eax,%eax# 00001248FC840020 rep stos %eax,(%rdi)# 00001248FC840022 cmp     $0x12345678,%rsi# 00001248FC840029 jne     0x00001248FC84002C# 00001248FC84002B nop# 00001248FC84002C xor     %r15d,%r15d# 00001248FC84002F lea     0x1248FC840037,%r14# 00001248FC840036 nop# 00001248FC840037 .byte   0x12,0x34,0x56,0x78Move code in memory (eg. hook a function)Uses instruction info API and the encoder to patch a function to jump to the programmer's function.fromiced_x86import*# Decodes instructions from some address, then encodes them starting at some# other address. This can be used to hook a function. You decode enough instructions# until you have enough bytes to add a JMP instruction that jumps to your code.# Your code will then conditionally jump to the original code that you re-encoded.## This code uses the BlockEncoder which will help with some things, eg. converting# short branches to longer branches if the target is too far away.## 64-bit mode also supports RIP relative addressing, but the encoder can't rewrite# those to use a longer displacement. If any of the moved instructions have RIP# relative addressing and it tries to access data too far away, the encoder will fail.# The easiest solution is to use OS alloc functions that allocate memory close to the# original code (+/-2GB).# This example produces the following output:# Original code:# 00007FFAC46ACDA4 mov [rsp+10h],rbx# 00007FFAC46ACDA9 mov [rsp+18h],rsi# 00007FFAC46ACDAE push rbp# 00007FFAC46ACDAF push rdi# 00007FFAC46ACDB0 push r14# 00007FFAC46ACDB2 lea rbp,[rsp-100h]# 00007FFAC46ACDBA sub rsp,200h# 00007FFAC46ACDC1 mov rax,[rel 7FFAC47524E0h]# 00007FFAC46ACDC8 xor rax,rsp# 00007FFAC46ACDCB mov [rbp+0F0h],rax# 00007FFAC46ACDD2 mov r8,[rel 7FFAC474F208h]# 00007FFAC46ACDD9 lea rax,[rel 7FFAC46F4A58h]# 00007FFAC46ACDE0 xor edi,edi## Original + patched code:# 00007FFAC46ACDA4 mov rax,123456789ABCDEF0h# 00007FFAC46ACDAE jmp rax# 00007FFAC46ACDB0 push r14# 00007FFAC46ACDB2 lea rbp,[rsp-100h]# 00007FFAC46ACDBA sub rsp,200h# 00007FFAC46ACDC1 mov rax,[rel 7FFAC47524E0h]# 00007FFAC46ACDC8 xor rax,rsp# 00007FFAC46ACDCB mov [rbp+0F0h],rax# 00007FFAC46ACDD2 mov r8,[rel 7FFAC474F208h]# 00007FFAC46ACDD9 lea rax,[rel 7FFAC46F4A58h]# 00007FFAC46ACDE0 xor edi,edi## Moved code:# 00007FFAC48ACDA4 mov [rsp+10h],rbx# 00007FFAC48ACDA9 mov [rsp+18h],rsi# 00007FFAC48ACDAE push rbp# 00007FFAC48ACDAF push rdi# 00007FFAC48ACDB0 jmp 00007FFAC46ACDB0hdefdisassemble(data:bytes,ip:int)->None:formatter=Formatter(FormatterSyntax.NASM)decoder=Decoder(EXAMPLE_CODE_BITNESS,data,ip=ip)forinstructionindecoder:disasm=formatter.format(instruction)print(f"{instruction.ip:016X}{disasm}")print()defhow_to_move_code()->None:print("Original code:")disassemble(EXAMPLE_CODE,EXAMPLE_CODE_RIP)decoder=Decoder(EXAMPLE_CODE_BITNESS,EXAMPLE_CODE,ip=EXAMPLE_CODE_RIP)# In 64-bit mode, we need 12 bytes to jump to any address:#      mov rax,imm64   # 10#      jmp rax         # 2# We overwrite rax because it's probably not used by the called function.# In 32-bit mode, a normal JMP is just 5 bytesrequired_bytes=10+2total_bytes=0orig_instructions=[]forinstrindecoder:orig_instructions.append(instr)total_bytes+=instr.lenifnotinstr:raiseValueError("Found garbage")iftotal_bytes>=required_bytes:breakcflow=instr.flow_controlifcflow==FlowControl.NEXT:pass# nothingelifcflow==FlowControl.UNCONDITIONAL_BRANCH:ifinstr.op0_kind==OpKind.NEAR_BRANCH64:_target=instr.near_branch_target# You could check if it's just jumping forward a few bytes and follow it# but this is a simple example so we'll fail.raiseValueError("Not supported by this simple example")else:raiseValueError("Not supported by this simple example")iftotal_bytes<required_bytes:raiseValueError("Not enough bytes!")iflen(orig_instructions)==0:raiseValueError("Should not be empty here")# Create a JMP instruction that branches to the original code, except those instructions# that we'll re-encode. We don't need to do it if it already ends in 'ret'last_instr=orig_instructions[-1]iflast_instr.flow_control!=FlowControl.RETURN:orig_instructions.append(Instruction.create_branch(Code.JMP_REL32_64,last_instr.next_ip))# Relocate the code to some new location. It can fix short/near branches and# convert them to short/near/long forms if needed. This also works even if it's a# jrcxz/loop/loopcc instruction which only have short forms.## It can currently only fix RIP relative operands if the new location is within 2GB# of the target data location.relocated_base_address=EXAMPLE_CODE_RIP+0x20_0000encoder=BlockEncoder(decoder.bitness)encoder.add_many(orig_instructions)new_code=encoder.encode(relocated_base_address)# Patch the original code. Pretend that we use some OS API to write to memory...# We could use the BlockEncoder/Encoder for this but it's easy to do yourself too.# This is 'mov rax,imm64; jmp rax'YOUR_FUNC:int=0x1234_5678_9ABC_DEF0# Address of your codeexample_code=bytearray(EXAMPLE_CODE)example_code[0]=0x48# \ 'MOV RAX,imm64'example_code[1]=0xB8# /v=YOUR_FUNCforiinrange(2,10):example_code[i]=v&0xFFv>>=8example_code[10]=0xFF# \ JMP RAXexample_code[11]=0xE0# /# Disassemble itprint("Original + patched code:")disassemble(example_code,EXAMPLE_CODE_RIP)# Disassemble the moved codeprint("Moved code:")disassemble(new_code,relocated_base_address)EXAMPLE_CODE_BITNESS:int=64EXAMPLE_CODE_RIP:int=0x0000_7FFA_C46A_CDA4EXAMPLE_CODE:bytes=\b"\x48\x89\x5C\x24\x10\x48\x89\x74\x24\x18\x55\x57\x41\x56\x48\x8D"\b"\xAC\x24\x00\xFF\xFF\xFF\x48\x81\xEC\x00\x02\x00\x00\x48\x8B\x05"\b"\x18\x57\x0A\x00\x48\x33\xC4\x48\x89\x85\xF0\x00\x00\x00\x4C\x8B"\b"\x05\x2F\x24\x0A\x00\x48\x8D\x05\x78\x7C\x04\x00\x33\xFF"how_to_move_code()Get instruction info, eg. read/written regs/mem, control flow info, etcShows how to get used registers/memory and other info. It usesInstructionmethods
and anInstructionInfoFactoryto get this info.fromiced_x86import*fromtypingimportDict,SequencefromtypesimportModuleType# This code produces the following output:# 00007FFAC46ACDA4 mov [rsp+10h],rbx#     OpCode: o64 89 /r#     Instruction: MOV r/m64, r64#     Encoding: LEGACY#     Mnemonic: MOV#     Code: MOV_RM64_R64#     CpuidFeature: X64#     FlowControl: NEXT#     Displacement offset = 4, size = 1#     Memory size: 8#     Op0Access: WRITE#     Op1Access: READ#     Op0: R64_OR_MEM#     Op1: R64_REG#     Used reg: RSP:READ#     Used reg: RBX:READ#     Used mem: [SS:RSP+0x10;UINT64;WRITE]# 00007FFAC46ACDA9 mov [rsp+18h],rsi#     OpCode: o64 89 /r#     Instruction: MOV r/m64, r64#     Encoding: LEGACY#     Mnemonic: MOV#     Code: MOV_RM64_R64#     CpuidFeature: X64#     FlowControl: NEXT#     Displacement offset = 4, size = 1#     Memory size: 8#     Op0Access: WRITE#     Op1Access: READ#     Op0: R64_OR_MEM#     Op1: R64_REG#     Used reg: RSP:READ#     Used reg: RSI:READ#     Used mem: [SS:RSP+0x18;UINT64;WRITE]# 00007FFAC46ACDAE push rbp#     OpCode: o64 50+ro#     Instruction: PUSH r64#     Encoding: LEGACY#     Mnemonic: PUSH#     Code: PUSH_R64#     CpuidFeature: X64#     FlowControl: NEXT#     SP Increment: -8#     Op0Access: READ#     Op0: R64_OPCODE#     Used reg: RBP:READ#     Used reg: RSP:READ_WRITE#     Used mem: [SS:RSP+0xFFFFFFFFFFFFFFF8;UINT64;WRITE]# 00007FFAC46ACDAF push rdi#     OpCode: o64 50+ro#     Instruction: PUSH r64#     Encoding: LEGACY#     Mnemonic: PUSH#     Code: PUSH_R64#     CpuidFeature: X64#     FlowControl: NEXT#     SP Increment: -8#     Op0Access: READ#     Op0: R64_OPCODE#     Used reg: RDI:READ#     Used reg: RSP:READ_WRITE#     Used mem: [SS:RSP+0xFFFFFFFFFFFFFFF8;UINT64;WRITE]# 00007FFAC46ACDB0 push r14#     OpCode: o64 50+ro#     Instruction: PUSH r64#     Encoding: LEGACY#     Mnemonic: PUSH#     Code: PUSH_R64#     CpuidFeature: X64#     FlowControl: NEXT#     SP Increment: -8#     Op0Access: READ#     Op0: R64_OPCODE#     Used reg: R14:READ#     Used reg: RSP:READ_WRITE#     Used mem: [SS:RSP+0xFFFFFFFFFFFFFFF8;UINT64;WRITE]# 00007FFAC46ACDB2 lea rbp,[rsp-100h]#     OpCode: o64 8D /r#     Instruction: LEA r64, m#     Encoding: LEGACY#     Mnemonic: LEA#     Code: LEA_R64_M#     CpuidFeature: X64#     FlowControl: NEXT#     Displacement offset = 4, size = 4#     Op0Access: WRITE#     Op1Access: NO_MEM_ACCESS#     Op0: R64_REG#     Op1: MEM#     Used reg: RBP:WRITE#     Used reg: RSP:READ# 00007FFAC46ACDBA sub rsp,200h#     OpCode: o64 81 /5 id#     Instruction: SUB r/m64, imm32#     Encoding: LEGACY#     Mnemonic: SUB#     Code: SUB_RM64_IMM32#     CpuidFeature: X64#     FlowControl: NEXT#     Immediate offset = 3, size = 4#     RFLAGS Written: OF, SF, ZF, AF, CF, PF#     RFLAGS Modified: OF, SF, ZF, AF, CF, PF#     Op0Access: READ_WRITE#     Op1Access: READ#     Op0: R64_OR_MEM#     Op1: IMM32SEX64#     Used reg: RSP:READ_WRITE# 00007FFAC46ACDC1 mov rax,[7FFAC47524E0h]#     OpCode: o64 8B /r#     Instruction: MOV r64, r/m64#     Encoding: LEGACY#     Mnemonic: MOV#     Code: MOV_R64_RM64#     CpuidFeature: X64#     FlowControl: NEXT#     Displacement offset = 3, size = 4#     Memory size: 8#     Op0Access: WRITE#     Op1Access: READ#     Op0: R64_REG#     Op1: R64_OR_MEM#     Used reg: RAX:WRITE#     Used mem: [DS:0x7FFAC47524E0;UINT64;READ]# 00007FFAC46ACDC8 xor rax,rsp#     OpCode: o64 33 /r#     Instruction: XOR r64, r/m64#     Encoding: LEGACY#     Mnemonic: XOR#     Code: XOR_R64_RM64#     CpuidFeature: X64#     FlowControl: NEXT#     RFLAGS Written: SF, ZF, PF#     RFLAGS Cleared: OF, CF#     RFLAGS Undefined: AF#     RFLAGS Modified: OF, SF, ZF, AF, CF, PF#     Op0Access: READ_WRITE#     Op1Access: READ#     Op0: R64_REG#     Op1: R64_OR_MEM#     Used reg: RAX:READ_WRITE#     Used reg: RSP:READ# 00007FFAC46ACDCB mov [rbp+0F0h],rax#     OpCode: o64 89 /r#     Instruction: MOV r/m64, r64#     Encoding: LEGACY#     Mnemonic: MOV#     Code: MOV_RM64_R64#     CpuidFeature: X64#     FlowControl: NEXT#     Displacement offset = 3, size = 4#     Memory size: 8#     Op0Access: WRITE#     Op1Access: READ#     Op0: R64_OR_MEM#     Op1: R64_REG#     Used reg: RBP:READ#     Used reg: RAX:READ#     Used mem: [SS:RBP+0xF0;UINT64;WRITE]# 00007FFAC46ACDD2 mov r8,[7FFAC474F208h]#     OpCode: o64 8B /r#     Instruction: MOV r64, r/m64#     Encoding: LEGACY#     Mnemonic: MOV#     Code: MOV_R64_RM64#     CpuidFeature: X64#     FlowControl: NEXT#     Displacement offset = 3, size = 4#     Memory size: 8#     Op0Access: WRITE#     Op1Access: READ#     Op0: R64_REG#     Op1: R64_OR_MEM#     Used reg: R8:WRITE#     Used mem: [DS:0x7FFAC474F208;UINT64;READ]# 00007FFAC46ACDD9 lea rax,[7FFAC46F4A58h]#     OpCode: o64 8D /r#     Instruction: LEA r64, m#     Encoding: LEGACY#     Mnemonic: LEA#     Code: LEA_R64_M#     CpuidFeature: X64#     FlowControl: NEXT#     Displacement offset = 3, size = 4#     Op0Access: WRITE#     Op1Access: NO_MEM_ACCESS#     Op0: R64_REG#     Op1: MEM#     Used reg: RAX:WRITE# 00007FFAC46ACDE0 xor edi,edi#     OpCode: o32 33 /r#     Instruction: XOR r32, r/m32#     Encoding: LEGACY#     Mnemonic: XOR#     Code: XOR_R32_RM32#     CpuidFeature: INTEL386#     FlowControl: NEXT#     RFLAGS Cleared: OF, SF, CF#     RFLAGS Set: ZF, PF#     RFLAGS Undefined: AF#     RFLAGS Modified: OF, SF, ZF, AF, CF, PF#     Op0Access: WRITE#     Op1Access: NONE#     Op0: R32_REG#     Op1: R32_OR_MEM#     Used reg: RDI:WRITEdefhow_to_get_instruction_info()->None:decoder=Decoder(EXAMPLE_CODE_BITNESS,EXAMPLE_CODE,ip=EXAMPLE_CODE_RIP)# Use a factory to create the instruction info if you need register and# memory usage. If it's something else, eg. encoding, flags, etc, there# are Instruction methods that can be used instead.info_factory=InstructionInfoFactory()forinstrindecoder:# Gets offsets in the instruction of the displacement and immediates and their sizes.# This can be useful if there are relocations in the binary. The encoder has a similar# method. This method must be called after decode() and you must pass in the last# instruction decode() returned.offsets=decoder.get_constant_offsets(instr)print(f"{instr.ip:016X}{instr}")op_code=instr.op_code()info=info_factory.info(instr)fpu_info=instr.fpu_stack_increment_info()print(f"    OpCode:{op_code.op_code_string}")print(f"    Instruction:{op_code.instruction_string}")print(f"    Encoding:{encoding_kind_to_string(instr.encoding)}")print(f"    Mnemonic:{mnemonic_to_string(instr.mnemonic)}")print(f"    Code:{code_to_string(instr.code)}")print(f"    CpuidFeature:{cpuid_features_to_string(instr.cpuid_features())}")print(f"    FlowControl:{flow_control_to_string(instr.flow_control)}")iffpu_info.writes_top:iffpu_info.increment==0:print(f"    FPU TOP: the instruction overwrites TOP")else:print(f"    FPU TOP inc:{fpu_info.increment}")cond_write="True"iffpu_info.conditionalelse"False"print(f"    FPU TOP cond write:{cond_write}")ifoffsets.has_displacement:print(f"    Displacement offset ={offsets.displacement_offset}, size ={offsets.displacement_size}")ifoffsets.has_immediate:print(f"    Immediate offset ={offsets.immediate_offset}, size ={offsets.immediate_size}")ifoffsets.has_immediate2:print(f"    Immediate #2 offset ={offsets.immediate_offset2}, size ={offsets.immediate_size2}")ifinstr.is_stack_instruction:print(f"    SP Increment:{instr.stack_pointer_increment}")ifinstr.condition_code!=ConditionCode.NONE:print(f"    Condition code:{condition_code_to_string(instr.condition_code)}")ifinstr.rflags_read!=RflagsBits.NONE:print(f"    RFLAGS Read:{rflags_bits_to_string(instr.rflags_read)}")ifinstr.rflags_written!=RflagsBits.NONE:print(f"    RFLAGS Written:{rflags_bits_to_string(instr.rflags_written)}")ifinstr.rflags_cleared!=RflagsBits.NONE:print(f"    RFLAGS Cleared:{rflags_bits_to_string(instr.rflags_cleared)}")ifinstr.rflags_set!=RflagsBits.NONE:print(f"    RFLAGS Set:{rflags_bits_to_string(instr.rflags_set)}")ifinstr.rflags_undefined!=RflagsBits.NONE:print(f"    RFLAGS Undefined:{rflags_bits_to_string(instr.rflags_undefined)}")ifinstr.rflags_modified!=RflagsBits.NONE:print(f"    RFLAGS Modified:{rflags_bits_to_string(instr.rflags_modified)}")foriinrange(instr.op_count):op_kind=instr.op_kind(i)ifop_kind==OpKind.MEMORY:size=MemorySizeExt.size(instr.memory_size)ifsize!=0:print(f"    Memory size:{size}")breakforiinrange(instr.op_count):print(f"    Op{i}Access:{op_access_to_string(info.op_access(i))}")foriinrange(op_code.op_count):print(f"    Op{i}:{op_code_operand_kind_to_string(op_code.op_kind(i))}")forreg_infoininfo.used_registers():print(f"    Used reg:{used_reg_to_string(reg_info)}")formem_infoininfo.used_memory():print(f"    Used mem:{used_mem_to_string(mem_info)}")defrflags_bits_to_string(rf:int)->str:defappend(sb:str,s:str)->str:iflen(sb)!=0:sb+=", "returnsb+ssb=""if(rf&RflagsBits.OF)!=0:sb=append(sb,"OF")if(rf&RflagsBits.SF)!=0:sb=append(sb,"SF")if(rf&RflagsBits.ZF)!=0:sb=append(sb,"ZF")if(rf&RflagsBits.AF)!=0:sb=append(sb,"AF")if(rf&RflagsBits.CF)!=0:sb=append(sb,"CF")if(rf&RflagsBits.PF)!=0:sb=append(sb,"PF")if(rf&RflagsBits.DF)!=0:sb=append(sb,"DF")if(rf&RflagsBits.IF)!=0:sb=append(sb,"IF")if(rf&RflagsBits.AC)!=0:sb=append(sb,"AC")if(rf&RflagsBits.UIF)!=0:sb=append(sb,"UIF")iflen(sb)==0:return"<empty>"returnsbEXAMPLE_CODE_BITNESS:int=64EXAMPLE_CODE_RIP:int=0x0000_7FFA_C46A_CDA4EXAMPLE_CODE:bytes=\b"\x48\x89\x5C\x24\x10\x48\x89\x74\x24\x18\x55\x57\x41\x56\x48\x8D"\b"\xAC\x24\x00\xFF\xFF\xFF\x48\x81\xEC\x00\x02\x00\x00\x48\x8B\x05"\b"\x18\x57\x0A\x00\x48\x33\xC4\x48\x89\x85\xF0\x00\x00\x00\x4C\x8B"\b"\x05\x2F\x24\x0A\x00\x48\x8D\x05\x78\x7C\x04\x00\x33\xFF"defcreate_enum_dict(module:ModuleType)->Dict[int,str]:return{module.__dict__[key]:keyforkeyinmodule.__dict__ifisinstance(module.__dict__[key],int)}REGISTER_TO_STRING:Dict[Register_,str]=create_enum_dict(Register)defregister_to_string(value:Register_)->str:s=REGISTER_TO_STRING.get(value)ifsisNone:returnstr(value)+" /*Register enum*/"returnsOP_ACCESS_TO_STRING:Dict[OpAccess_,str]=create_enum_dict(OpAccess)defop_access_to_string(value:OpAccess_)->str:s=OP_ACCESS_TO_STRING.get(value)ifsisNone:returnstr(value)+" /*OpAccess enum*/"returnsENCODING_KIND_TO_STRING:Dict[EncodingKind_,str]=create_enum_dict(EncodingKind)defencoding_kind_to_string(value:EncodingKind_)->str:s=ENCODING_KIND_TO_STRING.get(value)ifsisNone:returnstr(value)+" /*EncodingKind enum*/"returnsMNEMONIC_TO_STRING:Dict[Mnemonic_,str]=create_enum_dict(Mnemonic)defmnemonic_to_string(value:Mnemonic_)->str:s=MNEMONIC_TO_STRING.get(value)ifsisNone:returnstr(value)+" /*Mnemonic enum*/"returnsCODE_TO_STRING:Dict[Code_,str]=create_enum_dict(Code)defcode_to_string(value:Code_)->str:s=CODE_TO_STRING.get(value)ifsisNone:returnstr(value)+" /*Code enum*/"returnsFLOW_CONTROL_TO_STRING:Dict[FlowControl_,str]=create_enum_dict(FlowControl)defflow_control_to_string(value:FlowControl_)->str:s=FLOW_CONTROL_TO_STRING.get(value)ifsisNone:returnstr(value)+" /*FlowControl enum*/"returnsOP_CODE_OPERAND_KIND_TO_STRING:Dict[OpCodeOperandKind_,str]=create_enum_dict(OpCodeOperandKind)defop_code_operand_kind_to_string(value:OpCodeOperandKind_)->str:s=OP_CODE_OPERAND_KIND_TO_STRING.get(value)ifsisNone:returnstr(value)+" /*OpCodeOperandKind enum*/"returnsCPUID_FEATURE_TO_STRING:Dict[CpuidFeature_,str]=create_enum_dict(CpuidFeature)defcpuid_feature_to_string(value:CpuidFeature_)->str:s=CPUID_FEATURE_TO_STRING.get(value)ifsisNone:returnstr(value)+" /*CpuidFeature enum*/"returnsdefcpuid_features_to_string(cpuid_features:Sequence[int])->str:return" and ".join([cpuid_feature_to_string(f)forfincpuid_features])MEMORY_SIZE_TO_STRING:Dict[MemorySize_,str]=create_enum_dict(MemorySize)defmemory_size_to_string(value:MemorySize_)->str:s=MEMORY_SIZE_TO_STRING.get(value)ifsisNone:returnstr(value)+" /*MemorySize enum*/"returnsCONDITION_CODE_TO_STRING:Dict[ConditionCode_,str]=create_enum_dict(ConditionCode)defcondition_code_to_string(value:ConditionCode_)->str:s=CONDITION_CODE_TO_STRING.get(value)ifsisNone:returnstr(value)+" /*ConditionCode enum*/"returnsdefused_reg_to_string(reg_info:UsedRegister)->str:returnregister_to_string(reg_info.register)+":"+op_access_to_string(reg_info.access)defused_mem_to_string(mem_info:UsedMemory)->str:sb="["+register_to_string(mem_info.segment)+":"need_plus=mem_info.base!=Register.NONEifneed_plus:sb+=register_to_string(mem_info.base)ifmem_info.index!=Register.NONE:ifneed_plus:sb+="+"need_plus=Truesb+=register_to_string(mem_info.index)ifmem_info.scale!=1:sb+="*"+str(mem_info.scale)ifmem_info.displacement!=0ornotneed_plus:ifneed_plus:sb+="+"sb+=f"0x{mem_info.displacement:X}"sb+=";"+memory_size_to_string(mem_info.memory_size)+";"+op_access_to_string(mem_info.access)+"]"returnsbhow_to_get_instruction_info()Disassemble old/deprecated CPU instructionsfromiced_x86import*# This example produces the following output:# 731E0A03 bndmov bnd1, [eax]# 731E0A07 mov tr3, esi# 731E0A0A rdshr [eax]# 731E0A0D dmint# 731E0A0F svdc [eax], cs# 731E0A12 cpu_read# 731E0A14 pmvzb mm1, [eax]# 731E0A17 frinear# 731E0A19 altinstTEST_CODE=\b"\x66\x0F\x1A\x08"\b"\x0F\x26\xDE"\b"\x0F\x36\x00"\b"\x0F\x39"\b"\x0F\x78\x08"\b"\x0F\x3D"\b"\x0F\x58\x08"\b"\xDF\xFC"\b"\x0F\x3F"# Enable decoding of Cyrix/Geode instructions, Centaur ALTINST,# MOV to/from TR and MPX instructions.# There are other options to enable other instructions such as UMOV, KNC, etc.# These are deprecated instructions or only used by old CPUs so they're not# enabled by default. Some newer instructions also use the same opcodes as# some of these old instructions.DECODER_OPTIONS=DecoderOptions.MPX|\DecoderOptions.MOV_TR|\DecoderOptions.CYRIX|\DecoderOptions.CYRIX_DMI|\DecoderOptions.ALTINSTdecoder=Decoder(32,TEST_CODE,DECODER_OPTIONS,ip=0x731E_0A03)forinstrindecoder:# 'n' format specifier means NASM formatter, see the disassemble# example for all possible format specifiersprint(f"{instr.ip:08X}{instr:ns}")