Makefile
The following make file statically compiles and links a test program:
STATIC_EXPORT=-DZYCORE_STATIC_DEFINE -DZYDIS_STATIC_DEFINE
zydis-test.exe: test.o Decoder.o DecoderData.o SharedData.o Register.o Formatter.o FormatterBase.o FormatterBuffer.o String.o Utils.o FormatterIntel.o FormatterATT.o Mnemonic.o
gcc $^ -o zydis-test.exe
test.o: test.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -c $<
Decoder.o: zydis/src/Decoder.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -c $<
Utils.o: zydis/src/Utils.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -c $<
DecoderData.o: zydis/src/DecoderData.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -Izydis/src -c $<
SharedData.o: zydis/src/SharedData.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -Izydis/src -c $<
Register.o: zydis/src/Register.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -Izydis/src -c $<
Formatter.o: zydis/src/Formatter.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -Izydis/src -c $<
FormatterBase.o: zydis/src/FormatterBase.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -Izydis/src -c $<
FormatterBuffer.o: zydis/src/FormatterBuffer.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -Izydis/src -c $<
String.o: zydis/src/String.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -Izydis/src -c $<
FormatterIntel.o: zydis/src/FormatterIntel.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -Izydis/src -c $<
FormatterATT.o: zydis/src/FormatterATT.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -Izydis/src -c $<
Mnemonic.o: zydis/src/Mnemonic.c
gcc $(STATIC_EXPORT) -Izydis/include -Izydis/dependencies/zycore/include -Izydis/msvc -Izydis/src -c $<
test.c
test.c
is the test program to create an executable (which I took from Zydis'
github respository («Quick Example»).
#include <stdio.h>
#include <inttypes.h>
#include <Zydis/Zydis.h>
int main() {
ZyanU8 binary[] = {
0x51, 0x8D, 0x45, 0xFF, 0x50, 0xFF, 0x75, 0x0C, 0xFF, 0x75,
0x08, 0xFF, 0x15, 0xA0, 0xA5, 0x48, 0x76, 0x85, 0xC0, 0x0F,
0x88, 0xFC, 0xDA, 0x02, 0x00
};
ZydisDecoder decoder;
ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64);
//
// Specify the dialect into which we want to disassemble the
// binary (AT&T or Intel):
//
ZydisFormatter formatter;
ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);
// Loop over the instructions in binary.
// The runtime-address (instruction pointer) is chosen arbitrary here in order to better
// visualize relative addressing
ZyanU64 runtime_address = 0x007FFFFFFF400000;
ZyanUSize offset = 0;
const ZyanUSize length = sizeof(binary);
ZydisDecodedInstruction instruction;
while (ZYAN_SUCCESS(ZydisDecoderDecodeBuffer(&decoder, binary + offset, length - offset, &instruction))) {
//
// Print «address» of currently disassembled instruction:
//
printf("%016" PRIX64 " ", runtime_address);
//
// Print the instruction in Intel dialect:
//
char buffer[256];
ZydisFormatterFormatInstruction(&formatter, &instruction, buffer, sizeof(buffer), runtime_address);
puts(buffer);
offset += instruction.length;
runtime_address += instruction.length;
}
}