diff --git a/README.md b/README.md index ee7db988..3e86f807 100644 --- a/README.md +++ b/README.md @@ -28,57 +28,7 @@ The following example program uses Zydis to disassemble a given memory buffer and prints the output to the console ([more examples here](./examples/)). -```C -#include -#include -#include - -int main() -{ - ZyanU8 data[] = - { - 0x51, 0x8D, 0x45, 0xFF, 0x50, 0xFF, 0x75, 0x0C, 0xFF, 0x75, - 0x08, 0xFF, 0x15, 0xA0, 0xA5, 0x48, 0x76, 0x85, 0xC0, 0x0F, - 0x88, 0xFC, 0xDA, 0x02, 0x00 - }; - - // Initialize decoder context - ZydisDecoder decoder; - ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64); - - // Initialize formatter. Only required when you actually plan to do instruction - // formatting ("disassembling"), like we do here - ZydisFormatter formatter; - ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL); - - // Loop over the instructions in our buffer. - // The runtime-address (instruction pointer) is chosen arbitrary here in order to better - // visualize relative addressing - ZyanU64 runtime_address = 0x007FFFFFFF400000; - ZyanUSize offset = 0; - const ZyanUSize length = sizeof(data); - ZydisDecodedInstruction instruction; - ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT_VISIBLE]; - while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, data + offset, length - offset, - &instruction, operands, ZYDIS_MAX_OPERAND_COUNT_VISIBLE, - ZYDIS_DFLAG_VISIBLE_OPERANDS_ONLY))) - { - // Print current instruction pointer. - printf("%016" PRIX64 " ", runtime_address); - - // Format & print the binary instruction structure to human-readable format - char buffer[256]; - ZydisFormatterFormatInstruction(&formatter, &instruction, operands, - instruction.operand_count_visible, buffer, sizeof(buffer), runtime_address, ZYAN_NULL); - puts(buffer); - - offset += instruction.length; - runtime_address += instruction.length; - } - - return 0; -} -``` +https://github.com/zyantific/zydis/blob/9cb54996c215422a398d7d2a287a08a185344200/examples/Disassemble.c#L27-L75 ## Sample Output diff --git a/examples/Disassemble.c b/examples/Disassemble.c index fddd167c..879d8f3e 100644 --- a/examples/Disassemble.c +++ b/examples/Disassemble.c @@ -72,4 +72,4 @@ int main() } return 0; -} \ No newline at end of file +}