AwesomeREA.org

Tool

bddisasm

Bitdefender’s dependency-free C decoder for x86/x64 instructions, reporting explicit and implicit operands with their access modes, CPUID feature flags, flag accesses and valid modes, and printing Intel/MASM-style text. A minimal API with a 64-byte instruction structure trades detail for speed, and the companion bdshemu library emulates basic x86/x64 code in a raw buffer to flag shellcode-like behaviour such as NOP sleds, reading the instruction pointer, self-modification, TEB/PEB access and system calls. The disasmtool command-line example decodes or emulates files and hex strings.

Requirements & limits

  • The reviewed master commit is the v3.1.0 release of 2026-10-14, which attaches a Linux .deb package and x86 and x64 Windows zip bundles; the README says releases newer than 2.1.4 can be checked with GitHub artifact attestations. v3.1.0 removed the Python and Rust bindings, whose directories now hold only notices that they are unsupported and must not be used in production, and the README warns that the vcpkg package may lag behind.
  • Builds use CMake 3.16+ with optional Ninja, tested with GCC and Clang on Linux and MSVC on Windows; a Makefile builds only the static libraries, and the Visual Studio 2019 solution with Windows SDK 10.0.18362.0 adds Windows kernel configurations that need WDK 1903. Python 3 is needed only to regenerate the instruction tables with isagenerator, and Make or MSBuild builds leave nd_vsnprintf_s and nd_memset for the integrator to supply.
  • The caller supplies code bytes and a 16-, 32- or 64-bit mode, optionally with vendor and feature preferences, and only Intel/MASM-style syntax is printed. No executable-format loader is documented, so code in PE, ELF or firmware images must be located with another tool. The README says bdshemu handles only basic instructions, emulates no API calls and supports memory accesses only inside the shellcode and its emulated stack, so its flags describe shellcode-like behaviour rather than a full program run.
  • CI builds on Linux, Windows and macOS, runs cppcheck and runs the repository’s decoder and emulator regression suites, which compare disasmtool output for bundled test byte files, many with their .asm sources, against expected results. The README also reports internal fuzzing, testing with mishegos and per-instruction speed figures. This review ran none of these and decoded or emulated no code.
  • Apache-2.0 license. The documentation says Bitdefender uses the library in Windows and Linux user mode, Windows kernel mode and its Napoca hypervisor; the reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Binary analysis libraries
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · bitdefender/bddisasm · Revision f0c0e90
  2. README.md#L22-L176 GitHub · bitdefender/bddisasm · Revision f0c0e90
  3. CHANGELOG.md GitHub · bitdefender/bddisasm · Revision f0c0e90
  4. CMakeLists.txt GitHub · bitdefender/bddisasm · Revision f0c0e90
  5. inc/bdshemu.h GitHub · bitdefender/bddisasm · Revision f0c0e90
  6. disasmtool/disasmtool.c GitHub · bitdefender/bddisasm · Revision f0c0e90
  7. tests/README.md GitHub · bitdefender/bddisasm · Revision f0c0e90
  8. .github/workflows/ci.yml GitHub · bitdefender/bddisasm · Revision f0c0e90
  9. bindings/pybddisasm/README.md GitHub · bitdefender/bddisasm · Revision f0c0e90
  10. docs/source/index.rst GitHub · bitdefender/bddisasm · Revision f0c0e90
  11. LICENSE GitHub · bitdefender/bddisasm · Revision f0c0e90
  12. https://github.com/bitdefender/bddisasm/releases/tag/v3.1.0

More in Native binaries

All 104 entries in Native binaries