Zydiskell

Haskell langage binding for the Zydis library, a fast and lightweight x86/x86-64 disassembler.

Building

• Recursively clone the project: git clone --recursive https://github.com/nerded1337/zydiskell
• Either use Stack or Cabal: stack build | cabal v2-build

Notes:

• the Zydis library is directly embedded and compiled by GHC.
• we support the last three major GHC versions, currently: 8.6, 8.8 and 8.10

Interface

We currently expose three functions:

import Data.ByteString (ByteString) import qualified Zydis as Z Z.initialize :: Z.MachineMode -> Z.AddressWidth -> IO (Either Z.ZyanStatus Z.Decoder) Z.decodeBuffer :: Z.Decoder -> ByteString -> Z.Offset -> Z.Length -> IO (Either Z.ZyanStatus Z.DecodedInstruction) Z.decodeFullBuffer :: Z.Decoder -> ByteString -> IO (Either Z.ZyanStatus (Seq Z.DecodedInstruction)) 

Example

{-# LANGUAGE OverloadedStrings #-} module Main where import Data.Sequence import Data.Bifoldable import qualified Zydis as Z main :: IO () main = test test :: IO () test = bitraverse_ initFailure decode =<< initZydis where zyanError :: Show a => String -> a -> IO () zyanError s = putStrLn . ((s <> ". ZyanStatus: ") <>) . show initFailure :: Z.ZyanStatus -> IO () initFailure = zyanError "Failed to initialize decoder" initZydis :: IO (Either Z.ZyanStatus Z.Decoder) initZydis = Z.initialize Z.MachineModeLong64 Z.AddressWidth64 {- mov rax, 0xCAFEBABECAFEBABE push rax ret -} buffer = "\x48\xB8\xBE\xBA\xFE\xCA\xBE\xBA\xFE\xCA\x50\xC3" decodingFailure :: Z.ZyanStatus -> IO () decodingFailure = zyanError "Failed to decode buffer" {- Given the decoded buffer, should output: [MnemonicMov,MnemonicPush,MnemonicRet] -} printMnemonics :: Seq Z.DecodedInstruction -> IO () printMnemonics = print . fmap Z.decodedInstructionMnemonic decode :: Z.Decoder -> IO () decode decoder = bitraverse_ decodingFailure printMnemonics =<< Z.decodeFullBuffer decoder buffer