distorm | Powerful Disassembler Library For x86/AMD64

 by   gdabah C Version: 3.5.2b License: Non-SPDX

kandi X-RAY | distorm Summary

kandi X-RAY | distorm Summary

distorm is a C library typically used in Hardware applications. distorm has no bugs, it has no vulnerabilities and it has medium support. However distorm has a Non-SPDX License. You can download it from GitHub.

Powerful Disassembler Library For x86/AMD64
Support
    Quality
      Security
        License
          Reuse

            kandi-support Support

              distorm has a medium active ecosystem.
              It has 1122 star(s) with 235 fork(s). There are 60 watchers for this library.
              OutlinedDot
              It had no major release in the last 12 months.
              There are 7 open issues and 141 have been closed. On average issues are closed in 80 days. There are 5 open pull requests and 0 closed requests.
              It has a neutral sentiment in the developer community.
              The latest version of distorm is 3.5.2b

            kandi-Quality Quality

              distorm has 0 bugs and 0 code smells.

            kandi-Security Security

              distorm has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.
              distorm code analysis shows 0 unresolved vulnerabilities.
              There are 0 security hotspots that need review.

            kandi-License License

              distorm has a Non-SPDX License.
              Non-SPDX licenses can be open source with a non SPDX compliant license, or non open source licenses, and you need to review them closely before use.

            kandi-Reuse Reuse

              distorm releases are available to install and integrate.
              It has 6735 lines of code, 508 functions and 32 files.
              It has medium code complexity. Code complexity directly impacts maintainability of the code.

            Top functions reviewed by kandi - BETA

            kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
            Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of distorm
            Get all kandi verified functions for this library.

            distorm Key Features

            No Key Features are available at this moment for distorm.

            distorm Examples and Code Snippets

            No Code Snippets are available at this moment for distorm.

            Community Discussions

            QUESTION

            Tracing and disassembling Linux Kernel instructions not matching kernel image file
            Asked 2021-Jan-13 at 12:59

            I'm trying to validate and understand the instructions executed in a simulation framework. The simulation steps are the following:

            1. a binary is cross-compiled in a host x86 machine with gcc (with -fPIC flag)
            2. the binary is then moved and executed in a virtual machine x86 named SimNow (used by AMD for testing their processors)
            3. the SimNow machine produces a list of executed instructions which they are passed to a framework including information about each instruction: virtual address, physical address, size, opcode.
            4. the framework produces a trace of the executed instructions including mnemonic and operands thanks to a x86 disassembler (named distorm). This is an example of trace output:

            The list of executed instructions includes the instructions contained into the binary and possible kernel instructions.

            I'm validating the user instructions of the trace by using the ouput of the objdump on the binary. They are equal, confirming the correctness of the execution.

            This is the objdump output for the instructions in the previous picture:

            For kernel instructions, I had to apply preliminary steps:

            1. I installed the kernel headers into the virtual machine and I extracted the linux image for executing the objdump on it.
            2. I added the kernel symbols into the trace output by comparing the virtual address of the kernel instruction with the virtual address contained in /proc/kallsysms.

            For the validation step, I'm using the same methodology of the user instructions, comparing the objdump of the linux kernel image with the trace output. However, I noticed some differences...mostly when a kernel symbol instruction is discovered. This is the output of the trace:

            This is the correspondent section of the linux kernel image:

            As you can see from these pictures, each callq which corresponds to a kernel symbol (comparing the virtual address of the linux image with /proc/kallsyms) is substituted with a NOP DWORD (nopl instruction) in trace output.

            What I'm trying to do is understand why there is a NOP DWORD instead of callq for the kernel symbols.

            It happens due to the relocation? If yes, how can I reconstruct the relocation for such instructions?

            NOTE: I executed objdump with -dr for checking the relocation on the Linux image, but the output didn't change.

            My validation methodology is wrong for kernel instructions?

            ...

            ANSWER

            Answered 2021-Jan-13 at 12:38

            (Partial answer / guess that might point you in the right direction. Update: Jester suggests this looks like ftrace machinery: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/ftrace.c?h=v5.10)

            I suspect those calls are getting NOPed after loading, perhaps when the relevant tracepoint or whatever is not enabled. NOPing out a call for some reason would explain why there's call-target or symbol relocation metadata associated with a NOP.

            I think I've read about Linux using code modification for low-overhead tracepoints or something, and self-modifying code is something Linux definitely does in general.

            Linux uses self-modifying code that's modified once at boot, or on a very rare config change, to reduce overhead for every execution vs. a branch, for a few different things. (e.g. booting an SMP kernel on a UP machine will NOP out the lock prefix in atomic RMWs that just need to be SMP-safe, not hardware device.) Inline asm macros define symbols and custom sections so the kernel has the necessary metadata. Also something recent about modifying rel32 call targets instead of using indirect branches, to avoid the need for any Spectre mitigation at those sites, but that's not what's happening here.

            So in general you should expect to see a few mismatches when you try to verify execution against a kernel image file, and this might be one of them

            In this case, this looks like the very top of a function (before setting up a frame pointer), which sounds like a likely place to find some kind of special call, perhaps for tracing (to a special function that preserves all registers).

            gcc-generated code would never AFAIK do a call before push %rbp / mov %rsp, %rbp. For one thing, that would violate the 16-byte stack alignment ABI requirement. (Although maybe the kernel uses -mpreferred-stack-boundary=3 instead of 4? After two pushes, there's another more normal call which would also have a misaligned RSP if this was a normal function.) Anyway, that's another sign that there's some custom inline asm hackery or something going on.

            Source https://stackoverflow.com/questions/65701383

            QUESTION

            Installing distorm3 via pip gives Windows SDK build error
            Asked 2020-Jan-14 at 07:52

            I'm getting an error that the right Windows SDK version is not installed on my machine when attempting to pip install the distorm3 package. I could install the SDK, but I want to know what is causing this as I guess it is not normal.

            I am using pip 19.3.1 (python2.7.17 x64)

            ...

            ANSWER

            Answered 2020-Jan-14 at 07:52

            Distorm3 apparently has binary wheels available only for Python 3.6 on Win32.

            For other platforms and Python versions, it will need to build the binary components upon installation. Since you don't have the necessary SDK, that's what's failing right now.

            Source https://stackoverflow.com/questions/59729431

            Community Discussions, Code Snippets contain sources that include Stack Exchange Network

            Vulnerabilities

            No vulnerabilities reported

            Install distorm

            You can download it from GitHub.

            Support

            For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .
            Find more information at:

            Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items

            Find more libraries

            Stay Updated

            Subscribe to our newsletter for trending solutions and developer bootcamps

            Agree to Sign up and Terms & Conditions

            Share this Page

            share link

            Explore Related Topics

            Consider Popular C Libraries

            linux

            by torvalds

            scrcpy

            by Genymobile

            netdata

            by netdata

            redis

            by redis

            git

            by git

            Try Top Libraries by gdabah

            win32k-bugs

            by gdabahC++

            distormx

            by gdabahC