Zyan Disassembler Engine – Fast, lightweight x86/x86-64 disassembler library

github.com

61 points·ingve··11 comments

Why would I use this instead of Capstone [1]?

Zydis builds cleanly on most platforms without any external dependencies. You can use CMake to generate project files for your favorite C++14 compiler.

I don't want to be mean here, but I think CMake + C++14 already ruled out many platforms as well as binding solutions. In which case the pure C-based Capstone might be better.

Why? Which platforms does it rule out?

It is targeted to x86/x64 processors.

At OSes that matter for those processors have C++14 and CMake available.

Also from my point of view, brownie points for being written in C++.

Curious why performance is a big factor for a disassembler?

For example, when you embed a disassembler in automated tooling…

Emulators. Detouring.

Automated analysis of malware is where speed matters to me. You have hundreds of thousands of samples per day and you want to do some automated analysis on them for categorization. No wonder all the AV companies just check the hash.

The given quick example is uselessly dependent on tchar.h, which is Microsoft-specific. This is not going to work with "my favourite C++14 compiler".

By the way, if we're going to require a C++14 compiler, why still implement empty destructors when we can use "= default"?

I found it interesting the project was previously called "Verteron". What prompted the change to Zyan/Zydis?

This is pretty awesome. I've been using the LLVM disassembler. How much faster is this one?

Reply on news.ycombinator.com