Zydis Rust 绑定

Rust 对 Zydis 的绑定，Zydis 是一个快速且轻量级的 x86/x86-64 反汇编器和代码生成库。

[dependencies]
zydis = "4.1.1"

示例

use zydis::*;

#[rustfmt::skip]
static CODE: &'static [u8] = &[
    0x51, 0x8D, 0x45, 0xFF, 0x50, 0xFF, 0x75, 0x0C, 0xFF, 0x75, 0x08,
    0xFF, 0x15, 0xA0, 0xA5, 0x48, 0x76, 0x85, 0xC0, 0x0F, 0x88, 0xFC,
    0xDA, 0x02, 0x00,
];

fn main() -> zydis::Result {
    let fmt = Formatter::intel();
    let dec = Decoder::new64();

    // 0 is the address for our code.
    for insn_info in dec.decode_all::<VisibleOperands>(CODE, 0) {
        let (ip, _raw_bytes, insn) = insn_info?;
        
        // We use Some(ip) here since we want absolute addressing based on the given
        // instruction pointer. If we wanted relative addressing, we'd use `None` instead.
        println!("0x{:016X} {}", ip, fmt.format(Some(ip), &insn)?);
    }

    Ok(())
}

输出

0x0000000000000000 push rcx
0x0000000000000001 lea eax, [rbp-0x01]
0x0000000000000004 push rax
0x0000000000000005 push [rbp+0x0C]
0x0000000000000008 push [rbp+0x08]
0x000000000000000B call [0x000000007648A5B1]
0x0000000000000011 test eax, eax
0x0000000000000013 js 0x000000000002DB15

版本映射

自 3.0.0 版本起，绑定的主版本和次要版本与 Zydis 版本绑定。绑定的补丁版本独立于 Zydis 版本，可以进行绑定仅更改的升级。每个 cargo crate 发布都有一个相应的 git 标签。