1

I am looking for a Linux library/tool that can parse machine code instructions, preferably for the Power architecture (ppc64 or ppc64 little endian). I basically want to be able to convert a machine instruction to a readable assembly instruction string that I can process using a script.

Such functionality is obviously already part of GCC and GDB. For example, GDB can print the current assembly instruction using x /i $pc. Is there some underlying library that I could re-use? GCC can take an assembly instruction and generate the appropriate machine code when compiling.

  • so basically it's just a disassembler. Why don't you just call the available tools like objdump? – phuclv Jan 22 '18 at 16:18
  • Good point, I think it can work. I would have preferred to have a library that provides a clear API that I can call at runtime. With objdump I need to: 1) get the address of instruction I want to decompile (e.g. RIP register for the current instruction), 2) figure out what library/executable contains that instruction (probably using /proc/maps), 3) call objdump on the library/executable, parse the output, and save it in some data structure, and 4) figure out which instruction in this data structure I am actually interested in. – Radu Jan 22 '18 at 17:08
2

https://github.com/aquynh/capstone

Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community.

Created by Nguyen Anh Quynh, then developed and maintained by a small community, Capstone offers some unparalleled features:

  • Support multiple hardware architectures: ARM, ARM64 (ARMv8), Mips, PPC, Sparc, SystemZ, XCore and X86 (including X86_64).
  • ...

http://mkfs.github.io/content/opdis/

Opdis is a wrapper for the libopcodes disassembler library distributed as part of GNU binutils. It extends the libopcodes library by offering linear and control-flow disassembly algorithms, instruction and operand objects that are suitable for analysis, and a command-line utility to perform disassembly on arbitrary locations in a file.

These features are lacking in libopcodes and objdump. The design of libopcodes makes it awkward to use for binary analysis; it assumes that disassembled instructions are going to be printed, not stored or analyzed, and therefore it invokes a callback with an fprintf(3) signature. The shortcomings of objdump are even greater: it does not support control-flow disassembly, nor does it allow the user to specify which bytes in the file to disassemble.

The Opdis project consists of the libopdis library and the opdis command-line utility.

Supported Architectures

Opdis supports the disassembly of all architectures that GNU binutils supports. On most of these architectures, however, only the ASCII string for the disassembled instruction is available.

You can find more libraries here

  • Capstone looks like what I want but it does not support 64 bit power (ppc64). – Radu Jan 22 '18 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.