Skip to main content

Python bindings for Zydis library

Project description

pydis

Pydis is a python binding for the Zydis disassembler library.

import pydis

instructions = b'\x51\x8d\x45\xff\x50\xff\x75\x0c\xff\x75\x08\xff\x15\xa0\xa5\x48\x76\x85\xc0\x0f\x88\xfc\xda\x02\x00'
instruction_pointer = 0x007FFFFFFF400000

for instruction in pydis.decode(instructions, instruction_pointer):
    print(instruction)

Output:

push rcx
lea eax, [rbp-0x01]
push rax
push [rbp+0x0C]
push [rbp+0x08]
call [0x008000007588A5B1]
test eax, eax
js 0x007FFFFFFF42DB15

The module uses the same field names as Zydis with the exception that snake_case is used instead of camelCase.

Requirements

Pydis requires a python version >=3.6. The package has been tested on macOS, linux, and windows running cpython. Since pydis uses ctypes to interface with zydis it may or may not work on other interpreters.

Installing

pip install py-dis

or you can build from source as described below.

Building

MacOS and linux machines will need cmake and a C compiler in order to build Zydis. Windows machines will need Visual Studios. Pydis does not use any python modules beyond ones provided by a default python installation.

With the tooling installed running: python setup.py build install will build Zydis and install the package.

Usage

Documentation is currently being worked on. For now the example script pydisinfo is the best place to look for example usage.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
py_dis-0.3-cp36-none-macosx_10_12_x86_64.whl (149.6 kB) Copy SHA256 hash SHA256 Wheel cp36
py_dis-0.3-cp36-none-manylinux1_i686.whl (160.9 kB) Copy SHA256 hash SHA256 Wheel cp36
py_dis-0.3-cp36-none-manylinux1_x86_64.whl (160.7 kB) Copy SHA256 hash SHA256 Wheel cp36
py_dis-0.3-cp36-none-win32.whl (139.8 kB) Copy SHA256 hash SHA256 Wheel cp36
py_dis-0.3-cp36-none-win_amd64.whl (139.7 kB) Copy SHA256 hash SHA256 Wheel cp36

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page