Download: X86 code translator + ASM + VB examples Download:Self Debugged/Disassembled code technique! Download:Remote Load/Realloc Module+Execute Remote Thread Download:Execute Ring 0 on NT Download:M$ PE & COFF specification (PDF) version:revision (0.02)

Last Update:22.12.2003. ***WRITE YOUR OWN DISASSEMBLER WITH DISASM.DLL*** X86 code translator library provides translation HEX to X86 code -disasm.dll written by Vanja Fuckar-- preliminary test!- -support pentium 3+pentium 4 code- -extreme fast and very small library ~32kb- Export:use STDCALL DisAssemble proc Data:DWORD,BaseAddress:DWORD,Buffer:DWORD,DisAsmStruct:DWORD,DisasmOpt:DWORD Data:-raw code [IN] BaseAddress:-Virtual Address for -code [IN] Buffer:-code output buffer (128 bytes optimal) [IN/OUT] DisAsmStruct:-pointer to DisAsm Structure [IN/OUT] which contain usefull code information (instruction length,registers,etc) DisasmOpt:-output string option (0-only instruction,1-include hex offsets,2-include address,-1 only fill DisAsmStruct] Procedure return:-number of bytes written in buffer string Internal DisAsmStruct: RegKind struct REG_Kind byte ? ;1=8 bits \ 2=16 bits \ 3=32 bits \ 4=MMX \ 5=XMM \ 6=Float stack \ 7=Segment \ 8=Debug \ 9=Control \ 10=Test REG_Ptr_Kind byte ? ;1=Byte PTR \ 2=Word PTR \ 3=Dword PTR \ 4=Qword PTR \ 5=MMword ptr \ 6=Xmmword ptr \ 7=FWord PTR \ 8=Tbyte ptr REG_Type byte ? ; internals\not for public use! REG_BaseAsReg byte ? ;Bit 1=Base used as Register not as pointer! RegKind ends VALUE_ UNION _1 byte ? _2 word ? _4 dword ? VALUE_ ends Reg STRUCT SEG_TYPE dword ? BASE dword ? ;pointer to Base string INDEX dword ? ;pointer to Index string SCALE VALUE_ <> ;scale value DISPLACEMENTS VALUE_ <> ;displacement value DISPLACEMENT_TYPE VALUE_ <> ;type of dispacement 2=Word \ 4=Dword \ 8=Signed byte \ 32=Signed dword REG_KIND RegKind <> PTR_TYPE dword ? ;pointer to PTR string Reg ends Imm STRUCT VALUE_LO VALUE_ <> VALUE_HI VALUE_ <> ;used only with AbsJump VALUE_TYPE VALUE_ <>  ;1=Byte \ 2=Word \ 4=Dword \ 8=ByteToWord \ 16=ByteToDword \ 32=AbsJump \ 64=ShortJump \ 128=LongJump Imm ends DisAsm STRUCT INSTRUCTION_PREFIX dword ? ;pointer to prefix string INSTRUCTION dword ? ;pointer to instruction string REG1 Reg <> REG2 Reg <> REG_REG VALUE_ <> ;bit 1=REG2 as Destination register / otherwise REG1 as Destination,bit 32=extra using CL register IMMEDIATE Imm <> INSTRUCTION_LENGTH VALUE_ <> DisAsm ends U can easily examine code through DisAsm type [OUT] , ensure that buffer must be large enough for outputing! Author: Vanja Fuckar,EMAIL:INGA@VIP.HR