AwesomeREA.org

Tool

diStorm3

Lightweight x86/AMD64 disassembler library in C that the README describes as a decomposer: besides formatted text, distorm_decompose returns a binary structure per instruction with its opcode, operands, prefixes, flow-control class and optionally affected CPU flags. It decodes 16-, 32- and 64-bit code, can stop at calls, returns, branches, interrupts or privileged instructions, and its generated instruction tables cover integer, x87, MMX, 3DNow!, SSE through SSE4.2 and SSE4a, AVX, FMA, AES, CLMUL, VMX and SVM sets. The repository includes the distorm3 Python module, plus example Java and .NET wrappers and sample programs for Linux, Win32 and a Windows kernel driver.

Targets
Binary
Category
Binary analysis libraries
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • No commits on master since 2021-12-18, the reviewed commit. The latest PyPI release is distorm3 3.5.2, uploaded 2021-03-19 as a source tarball and a Windows 32-bit Python 3.7 wheel; the GitHub release list ends with 3.5.2b (2021-04-03), and setup.py on master already says 3.5.3, which is not on PyPI.
  • Install the Python module with pip install distorm3, which compiles the C sources, or build the C library with the Makefiles for Linux, macOS and TinyCC or the Visual Studio solution for Windows. setup.py lists Windows, macOS and Linux, and its newest Python classifier is 3.5; CI last targeted Ubuntu 18.04, Windows and macOS with Python 3.x. The README points to the GitHub wiki for API documentation.
  • Input is raw machine code bytes plus a code offset and decoding mode supplied by the caller; it decodes instructions only and does not parse executable formats, build control-flow graphs or lift code. The disOps scripts generate its instruction tables from the x86sets.py database.
  • The repository bundles a test helper executable, test-deps/yasm-1.3.0-win64.exe, which the CI workflow copies into place so the Python tests can assemble their instruction samples with yasm on Windows; no other sample binaries are committed.
  • BSD three-clause license (COPYING; GitHub reports it as unclassified). No code was disassembled for this entry.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · gdabah/distorm · Revision 7a02caa
  2. include/distorm.h GitHub · gdabah/distorm · Revision 7a02caa
  3. disOps/x86sets.py GitHub · gdabah/distorm · Revision 7a02caa
  4. setup.py GitHub · gdabah/distorm · Revision 7a02caa
  5. .github/workflows/py.yml GitHub · gdabah/distorm · Revision 7a02caa
  6. examples GitHub · gdabah/distorm · Revision 7a02caa
  7. test-deps GitHub · gdabah/distorm · Revision 7a02caa
  8. COPYING GitHub · gdabah/distorm · Revision 7a02caa
  9. https://pypi.org/project/distorm3/3.5.2/
  10. https://github.com/gdabah/distorm/releases/tag/3.5.2b

More in Native binaries

All 158 entries in Native binaries