Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace disassembler engine with Zydis #1730

merged 11 commits into from Oct 9, 2017


Copy link

@athre0z athre0z commented Sep 25, 2017

Current status

  • Adds zydis_wrapper
  • Adds Zydis as a submodule
  • Replaces all usages of capstone_wrapper with zydis_wrapper
  • Added IsBranchType, replacing many manual if(mnem == ...) occurrences
  • Copied previous QBeaEngine to CSQBeaEngine and CapstoneTokenizer to CsCapstoneTokenizer, for diffing
    • Reworked CsCapstoneTokenizer to use CapstoneTokenizer's data classes for easy comparision
  • Added CS<->Zydis tokenizer output diff code to Disassembly.cpp (commented out)

Future work required

  • Remove diff code and legacy tokenizer
  • Possibly more abstractions over the disassembler engine
  • Possibly refactor class names to use disassembler engine independent names
  • Possibly update x64dbg Zydis fork and use it for the submodule

If there's anything you don't like that you'd like me to change, just say the word.

athre0z added 11 commits Sep 20, 2017
- While at it, added branch info logic to disassembler class
  - Thus reduce direct checks by mnemonic in GUI and analysis code
- Replaced direct disassembler struct access with disassembler class calls where trivially possible
- Removed workarounds for empty segment registers
- Temp. disabled `cbInstrCapstone` command
- Temp. disabled flag stuff in `QBeaEngine`
- Prevents name clashes with actual capstone disassembler implementation
- Fixed various porting bugs in the Zydis `CapstoneTokenizer`
- Added Capstone vs Zydis tokenizing diff and various exceptions for known issues
- Also, more whitelist entries for the CS-Zydis diff
- Instead, we directly use Zydis as a submodule now
- Removed underscores
- Removed redundant “zy” prefix
- Executed `AStyleWhore` (sorreh, I use git on my macOS host, can’t put it into pre-commit-hook)
- Comment out diff code in GUI
- Enable optimization
- A few more whitelist entries in the diff code
- A few fixes in the old tokenizer to be consistent with the new one in diffs
- Remove LICENSE and README now that the wrapper is part of the x64dbg core repo
- Remove unused semantic groups
- Improve handling of “far” in tokenizer
//set the branch destinations
node.brtrue = mCp.BranchDestination();
if(mCp.GetId() != X86_INS_JMP && mCp.GetId() != X86_INS_LJMP) //unconditional jumps dont have a brfalse
if(mCp.GetId() != ZYDIS_MNEMONIC_JMP) //unconditional jumps dont have a brfalse

This comment has been minimized.


nooperation Sep 29, 2017

Should this also exclude ZYDIS_MNEMONIC_JMP_FAR? The previous logic excluded both unconditional jumps

This comment has been minimized.


athre0z Sep 29, 2017
Author Contributor

Zydis has the same mnemonic constant for both far and near jumps.

This comment has been minimized.


athre0z Sep 29, 2017
Author Contributor

In case you're wondering why this is the case: we stick to Intel SDM as close as possible and Intel doesn't treat them as separate instructions either.

Copy link
Contributor Author

@athre0z athre0z commented Oct 9, 2017

The Mergings project card mentions that @blaquee found problems with this PR. Could you elaborate?

Copy link

@mrexodia mrexodia commented Oct 9, 2017

@mrexodia mrexodia merged commit 77c6e95 into x64dbg:development Oct 9, 2017
1 check passed
1 check passed
continuous-integration/appveyor/pr AppVeyor build succeeded
@athre0z athre0z deleted the athre0z:zydis branch Oct 9, 2017
Copy link

@zcddtb zcddtb commented Dec 7, 2018

when i compile the whole project ,says miss zydis/xxxx.h, and how i solve it ? thk

Copy link
Contributor Author

@athre0z athre0z commented Dec 7, 2018

Try cloning recursively (git clone --recursive xxx).

Copy link

@zcddtb zcddtb commented Dec 8, 2018

Try cloning recursively (git clone --recursive xxx).

thks, it works well,because working offline (can not too sad), i find and download them all.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

4 participants
You can’t perform that action at this time.