LyDebugger Dynamic disassembly debugger

Lydebugger is a lightweight 32/64 bit local debugger developed based on Windows Debug API and Capstone disassembly engine. It supports creating process debugging/attaching existing processes, fully implementing software breakpoints, memory breakpoints, hardware breakpoints, register/stack/memory viewing and modification, single step debugging, module thread enumeration, instruction disassembly and other core functions of reverse debugging. The code is implemented in pure C++native, without third-party GUI dependencies and command-line interaction. It is mainly used for teaching and demonstrating debugger principles.

Create Debug Process

Create a new target process through the Debug command and start debugging immediately. The debugger automatically captures the system initialization breakpoint when the target process starts, waiting for user input of debug commands.

Syntax

LyDebugger32.exe Debug --path <target program path>

Parameter Description

• --path: Specify the full path of the program to be debugged

Example

CMD> LyDebugger32.exe Debug --path e://win32.exe

[+] Debug process created: e://win32.exe (PID: 20464, TID: 20468)
[*] Entering debug loop, waiting for events...
[*] Process created: PID = 20464, Entry address = 0x0040152C
[*] DLL loaded: Base address = 0x77100000, Path = C:\Windows\SYSTEM32\ntdll.dll
[*] DLL loaded: Base address = 0x75A60000, Path = C:\Windows\System32\KERNEL32.DLL
[*] DLL loaded: Base address = 0x76400000, Path = C:\Windows\System32\KERNELBASE.dll
[*] DLL loaded: Base address = 0x6E170000, Path = C:\Windows\SYSTEM32\apphelp.dll
[*] Thread created: TID = 13388, Entry address = 0x771497D0
[*] Thread created: TID = 11296, Entry address = 0x771497D0
[*] Thread created: TID = 16628, Entry address = 0x771497D0
[*] DLL loaded: Base address = 0x67E90000, Path = C:\Windows\SYSTEM32\MSVCR120.dll
[*] System initialization breakpoint captured, restoring context...
[*] Process started, waiting for debug commands...
[ 0x771AE9C6 ] #

Attach to Existing Process

Attach to an already running process for debugging through the Attach command. The debugger will pause the target process and wait for user input of debug commands.

Syntax

LyDebugger32.exe Attach --pid <process ID>

Parameter Description

• --pid: Specify the process ID (PID) of the target process to attach

Example

CMD> LyDebugger32.exe Attach --pid 16372

[+] Attached to process (PID: 16372)
[*] Entering debug loop, waiting for events...
[*] Process created: PID = 16372, Entry address = 0x00000000
[*] DLL loaded: Base address = 0x77100000, Path = C:\Windows\SYSTEM32\ntdll.dll
[*] Thread created: TID = 15908, Entry address = 0x771497D0
[*] Thread created: TID = 13132, Entry address = 0x771497D0
[*] Thread created: TID = 19452, Entry address = 0x771497D0
[*] Thread created: TID = 19948, Entry address = 0x771497D0
[*] Thread created: TID = 2912, Entry address = 0x771497D0
[*] DLL loaded: Base address = 0x75A60000, Path = C:\Windows\System32\KERNEL32.DLL
[*] DLL loaded: Base address = 0x76400000, Path = C:\Windows\System32\KERNELBASE.dll
[*] DLL loaded: Base address = 0x67F10000, Path = C:\Windows\SYSTEM32\MSVCR120.dll
[*] Thread created: TID = 20472, Entry address = 0x771AAC10
[*] System initialization breakpoint captured, restoring context...
[*] Process started, waiting for debug commands...
[ 0x77173D20 ] #

Enumerate Modules

Used to enumerate and display information about all loaded modules (DLLs and EXEs) in the target process, including module ID, base address, size, and module name. It works by calling the EnumProcessModules function to get a list of handles for all loaded modules in the target process, then calling GetModuleBaseName and GetModuleInformation for each module to get the module name, base address, and size information.

Syntax

Modules

Output Field Description

• ID: Module number
• Base Address: Base address where the module is loaded
• Size: Module size (bytes)
• Name: Module file name

Example

[ 0x771AE9C6 ] # Modules
+----+----------------+----------------+----------------+
| ID |   Base Address |      Size      |      Name      |
+----+----------------+----------------+----------------+
|  1 | 0x00400000 | 0x00006000 | win32.exe      |
|  2 | 0x77100000 | 0x0019D000 | ntdll.dll      |
|  3 | 0x75A60000 | 0x000E0000 | KERNEL32.DLL   |
|  4 | 0x76400000 | 0x00202000 | KERNELBASE.dll |
|  5 | 0x74850000 | 0x0019A000 | USER32.dll     |
|  6 | 0x768E0000 | 0x00017000 | win32u.dll     |
|  7 | 0x76930000 | 0x00023000 | GDI32.dll      |
|  8 | 0x766D0000 | 0x00176000 | gdi32full.dll  |
|  9 | 0x747D0000 | 0x00080000 | msvcp_win.dll  |
| 10 | 0x75360000 | 0x00123000 | ucrtbase.dll   |
| 11 | 0x67E90000 | 0x000EE000 | MSVCR120.dll   |
+----+----------------+----------------+----------------+
[ 0x771AE9C6 ] #

Enumerate Threads (Threads)

Used to enumerate and display information about all threads in the target process, including thread ID, TEB (Thread Environment Block) base address, and thread status. It works by calling CreateToolhelp32Snapshot to create a thread snapshot, then using Thread32First and Thread32Next to iterate through all threads and get each thread's ID and TEB base address.

Syntax

Threads

Output Field Description

• ID: Thread number
• Thread ID: Thread identifier (TID)
• TEB Base: Base address of the Thread Environment Block
• Status: Thread status (Active means active, Exited means exited)

Example

[ 0x771AE9C6 ] # Threads
+----+----------------+----------------+----------------+
| ID |   Thread ID    |    TEB Base    |    Status      |
+----+----------------+----------------+----------------+
|  1 | 20320          | 0x00000053 | Active         |
|  2 | 12900          | 0x00000053 | Active         |
|  3 | 17752          | 0x00000053 | Active         |
|  4 | 16064          | 0x00000053 | Active         |
+----+----------------+----------------+----------------+

View Registers (Register)

Used to display all register information of the current thread, including general-purpose registers, segment registers, control registers, debug registers, FPU registers, and SSE registers. It works by calling the GetThreadContext function to get the context structure (CONTEXT) of the current thread, which contains the values of all registers. Depending on different ContextFlags flags, general-purpose registers, segment registers, control registers, debug registers, FPU registers, and SSE registers can be obtained.

Syntax

Register

Output Description

• [General Purpose Registers]: Shows values of EAX, EBX, ECX, EDX, ESI, EDI, ESP, EBP
• [Segment Registers]: Shows values of CS, SS, DS, ES, FS, GS
• [Control Registers]: Shows values of EIP (Instruction Pointer) and EFLAGS (Flags Register)
• [Debug Registers]: Shows values of DR0-DR7, used for hardware breakpoints
• [Floating Point (FPU) Registers]: Shows FPU control word, status word, and tag word
• [SSE Registers (XMM0-XMM7)]: Shows values of 128-bit SSE registers

Example

[ 0x771AE9C6 ] # Register
[General Purpose Registers]
+----------------+----------------+----------------+----------------+
| EAX = 0x00000000   | EBX = 0x00000010   | ECX = 0x66EC0000   | EDX = 0x00000000   |
+----------------+----------------+----------------+----------------+
| ESI = 0x006C2040   | EDI = 0x00315000   | ESP = 0x0019FA24   | EBP = 0x0019FA50   |
+----------------+----------------+----------------+----------------+

[Segment Registers]
+----------------+----------------+----------------+----------------+
| CS = 0x0023    | SS = 0x002B    | DS = 0x002B    | ES = 0x002B    |
+----------------+----------------+----------------+----------------+
| FS = 0x0053    | GS = 0x002B    |                |                |
+----------------+----------------+----------------+----------------+

[Control Registers]
+----------------+----------------+
| EIP = 0x771AE9C6   | EFLAGS = 0x00000244 |
+----------------+----------------+

[Debug Registers]
+----------------+----------------+----------------+----------------+
| DR0 = 0x00000000   | DR1 = 0x00000000   | DR2 = 0x00000000   | DR3 = 0x00000000   |
+----------------+----------------+----------------+----------------+
| DR6 = 0x00000000   | DR7 = 0x00000000   |                |                |
+----------------+----------------+----------------+----------------+

[Floating Point (FPU) Registers]
+----------------+----------------+----------------+
| Control Word(CW)=0x027F | Status Word(SW)=0x0000 | Tag Word(TW)=0xFFFF |
+----------------+----------------+----------------+

[SSE Registers (XMM0-XMM7)]
+----------------------------------------+----------------------------------------+
| XMM0 = 0x00000000000000000000000000000000                | XMM1 = 0x00000000000000000000000000000000                |
+----------------------------------------+----------------------------------------+
| XMM2 = 0x00000000000000000000000000000000                | XMM3 = 0x00000000000000000000000000000000                |
+----------------------------------------+----------------------------------------+
| XMM4 = 0x00000000000000000000000000000000                | XMM5 = 0x00000000000000000000000000000000                |
+----------------------------------------+----------------------------------------+
| XMM6 = 0x00000000000000000000000000000000                | XMM7 = 0x00000000000000000000000000000000                |
+----------------------------------------+----------------------------------------+

Modify Register (SetRegister)

Used to modify the value of a specified register. It works by calling the GetThreadContext function to get the context structure of the current thread, modifying the value of the specified register, then calling the SetThreadContext function to set the modified context back to the thread. Supports modifying general-purpose registers, instruction pointer, and debug registers (DR0-DR3, DR6-DR7).

Syntax

SetRegister --reg <register name> --value <value>

Parameter Description

• --reg: Specify the name of the register to modify (supported: eax, ebx, ecx, edx, esi, edi, esp, ebp, eip, dr0, dr1, dr2, dr3, dr6, dr7)
• --value: Specify the new value for the register, can be decimal or hexadecimal (prefixed with 0x)

Supported Registers for Modification

Register	Full Name	Description
EAX	Accumulator	Accumulator, used for arithmetic operations and function return values
EBX	Base	Base register, commonly used for storing data pointers
ECX	Counter	Counter register, commonly used for loop counting
EDX	Data	Data register, commonly used for multiplication and division operations
ESP	Stack Pointer	Stack pointer, points to the current top of the stack
EBP	Base Pointer	Base pointer, points to the current stack frame base
ESI	Source Index	Source index register, commonly used for string operations
EDI	Destination Index	Destination index register, commonly used for string operations
EIP	Instruction Pointer	Instruction pointer, points to the next instruction to be executed
DR0	Debug Register 0	Debug register 0, used for hardware breakpoint address
DR1	Debug Register 1	Debug register 1, used for hardware breakpoint address
DR2	Debug Register 2	Debug register 2, used for hardware breakpoint address
DR3	Debug Register 3	Debug register 3, used for hardware breakpoint address
DR6	Debug Status Register	Debug status register, records breakpoint trigger status
DR7	Debug Control Register	Debug control register, controls hardware breakpoint enablement and type

Example

[ 0x771AE9C6 ] # SetRegister --reg eax --value 10
[+] Register eax has been modified to 0x0000000A

[ 0x771AE9C6 ] # Register
[General Purpose Registers]
+----------------+----------------+----------------+----------------+
| EAX = 0x0000000A   | EBX = 0x00000010   | ECX = 0x66EC0000   | EDX = 0x00000000   |
+----------------+----------------+----------------+----------------+
| ESI = 0x006C2040   | EDI = 0x00315000   | ESP = 0x0019FA24   | EBP = 0x0019FA50   |
+----------------+----------------+----------------+----------------+

View Memory (Memory)

Used to view the memory content at a specified address in the target process, displayed in both hexadecimal and ASCII formats. It works by calling the ReadProcessMemory function to read memory data of the specified length from the target process's virtual address space, then displaying it in both hexadecimal and ASCII formats.

Syntax

Memory --address <address> [--size <length>]

Parameter Description

• --address: Specify the memory address to view, supports hexadecimal (prefixed with 0x) or decimal
• --size: Optional parameter, specify the memory length to view (bytes), default value is 0x40 (64 bytes)

Output Field Description

• Address: Memory address
• Hex Data: Hexadecimal representation of 16 bytes per line, with the first 8 and last 8 separated by a space
• ASCII: ASCII character representation of memory data, non-printable characters shown as .

Example

[ 0x771AE9C6 ] # Memory --address 0x771AE9C6 --size 40
Memory data (0x771AE9C6, Length: 0x28):
+----------------+-------------------------------------------------+----------------+
|    Address     |                  Hex Data                       |    ASCII       |
+----------------+-------------------------------------------------+----------------+
| 0x771AE9C6 | CC EB 07 33 C0 40 C3 8B  65 E8 C7 45 FC FE FF FF | ...3.@..e..E.... |
| 0x771AE9D6 | FF E8 E1 72 FD FF C3 64  A1 30 00 00 00 33 C9 89 | ...r...d.0...3.. |
| 0x771AE9E6 | 0D 34 16 22 77 89 0D 38                          | .4."w..8         |
+----------------+-------------------------------------------------+----------------+
[ 0x771AE9C6 ] #

View Stack (Stack)

Used to view the stack content of the current thread, displayed downward from the current ESP (stack pointer) address. It works by first getting the ESP (stack pointer) value of the current thread through GetThreadContext, then using ESP as the starting address to call ReadProcessMemory to read the specified number of stack memory data from the target process, with each stack entry being 4 bytes (DWORD).

Syntax

Stack [--count <count>]

Parameter Description

• --count: Optional parameter, specify the number of stack entries to display, each entry is 4 bytes (one DWORD), default value is 20

Output Field Description

• Address: Stack memory address
• Content: 32-bit value (DWORD) at that address

Example

[ 0x771AE9C6 ] # Stack --count 10
Stack information (ESP = 0x0019FA24):
+----------------+----------------+
|    Address     |    Content     |
+----------------+----------------+
| 0x0019FA24 | 0xD724CDBC |
| 0x0019FA28 | 0x00315000 |
| 0x0019FA2C | 0x006C2040 |
| 0x0019FA30 | 0x00000010 |
| 0x0019FA34 | 0x00000001 |
| 0x0019FA38 | 0x0019FA24 |
| 0x0019FA3C | 0x0019FA4C |
| 0x0019FA40 | 0x0019FC9C |
| 0x0019FA44 | 0x77179C70 |
| 0x0019FA48 | 0xA01DB81C |
+----------------+----------------+

Modify Memory (SetMemory)

Used to modify the value at a specified memory address in the target process, modifying 4 bytes (one DWORD) at a time. It works by calling the WriteProcessMemory function to write 4 bytes (one DWORD) of data to the target process's virtual address space. Note: Modifying memory may cause the target process to crash or behave abnormally, use with caution.

Syntax

SetMemory --address <address> --value <value>

Parameter Description

• --address: Specify the memory address to modify, supports hexadecimal (prefixed with 0x) or decimal
• --value: Specify the new value to write, supports hexadecimal (prefixed with 0x) or decimal

Example

[ 0x771AE9C6 ] # SetMemory --address 0x0019FA28 --value 10
[+] Memory 0x0019FA28 has been modified to 0x0000000A

[ 0x771AE9C6 ] # Stack --count 10
Stack information (ESP = 0x0019FA24):
+----------------+----------------+
|    Address     |    Content     |
+----------------+----------------+
| 0x0019FA24 | 0xD724CDBC |
| 0x0019FA28 | 0x0000000A |
| 0x0019FA2C | 0x006C2040 |
| 0x0019FA30 | 0x00000010 |
| 0x0019FA34 | 0x00000001 |
| 0x0019FA38 | 0x0019FA24 |
| 0x0019FA3C | 0x0019FA4C |
| 0x0019FA40 | 0x0019FC9C |
| 0x0019FA44 | 0x77179C70 |
| 0x0019FA48 | 0xA01DB81C |
+----------------+----------------+

Software Breakpoint (SetBreakPoint / DelBreakPoint / ShowBreakPoint)

Software breakpoints are implemented by writing 0xCC (INT3 instruction) at the specified memory address. When the CPU executes this instruction, it triggers a breakpoint exception. Write 0xCC (INT3 instruction) at the target address and save the original byte; when the breakpoint triggers, restore the original byte and execute; after execution, rewrite 0xCC to keep the breakpoint active (unless it's a temporary breakpoint). This is the most commonly used and simplest type of breakpoint.

Command List

Command	Syntax	Description
SetBreakPoint	SetBreakPoint --address <address> [--thread <thread ID>] [--temp]	Set software breakpoint
DelBreakPoint	DelBreakPoint --address <address>	Delete software breakpoint
ShowBreakPoint	ShowBreakPoint	Show all set software breakpoints

Parameter Description

• --address: Specify the breakpoint address, supports hexadecimal (prefixed with 0x) or decimal
• --thread: Optional parameter, specify that the breakpoint only takes effect for a specific thread, thread ID 0 means all threads
• --temp: Optional parameter, set a temporary breakpoint that is automatically deleted after triggering once

ShowBreakPoint Output Field Description

• ID: Breakpoint number
• Address: Breakpoint address
• Code: Original byte (instruction byte before being overwritten by 0xCC)
• Temporary: Whether it is a temporary breakpoint (True means yes, False means no)
• Thread: Bound thread ID (0 means all threads)

Example

[ 0x771AE9C6 ] # SetBreakPoint --address 0x771AE9C6
[+] Software breakpoint set: 771AE9C6 (Thread: 0)

[ 0x771AE9C6 ] # ShowBreakPoint
+----+----------------+--------+----------+--------+
| ID |    Address     |  Code  | Temporary| Thread |
+----+----------------+--------+----------+--------+
|  1 | 0x771AE9C6 | 0xCC  | False    | 0      |
+----+----------------+--------+----------+--------+
[ 0x771AE9C6 ] #

[ 0x771AE9C6 ] # DelBreakPoint --address 0x771AE9C6
[-] Software breakpoint cleared: 771AE9C6

Memory Breakpoint (SetMemBreakPoint / DelMemBreakPoint / ShowMemBreakPoint)

Memory breakpoints are implemented by modifying the protection attributes of memory pages. When the target memory page is accessed (read, write, or execute), an access violation exception is triggered. Memory breakpoints are page-based (usually 4KB), suitable for monitoring access to specific memory regions. Use VirtualProtectEx to modify the protection attribute of the target memory page (e.g., set to inaccessible), save the original protection attribute; when an access violation exception is triggered, restore the original protection attribute; memory breakpoints are automatically deleted after triggering.

Command List

Command	Syntax	Description
SetMemBreakPoint	SetMemBreakPoint --address <address> --flag <r|w|e>	Set memory breakpoint
DelMemBreakPoint	DelMemBreakPoint --address <address>	Delete memory breakpoint
ShowMemBreakPoint	ShowMemBreakPoint	Show all set memory breakpoints

Parameter Description

• --address: Specify the memory address to monitor, the breakpoint will automatically align to the start address of the memory page
• --flag: Specify the access type to monitor, optional values:
  • r: Read access breakpoint (set page as inaccessible)
  • w: Write access breakpoint (set page as read-only)
  • e: Execute access breakpoint (set page as read-write)

Example

[ 0x771AE9C6 ] # SetMemBreakPoint --address 0x771AE9C6 --flag w
[+] Memory breakpoint set: 0x771AE000 (Type: w)
[ 0x771AE9C6 ] #
[ 0x771AE9C6 ] # SetMemBreakPoint --address 0x771AE9C6 --flag r
[-] Memory page 0x771AE000 already has a breakpoint

Hardware Breakpoint (SetHbreakPoint / DelHbreakPoint / ShowHbreakPoint)

Hardware breakpoints are implemented using the CPU's debug registers (DR0-DR3), enabling breakpoints by setting the DR7 control register. Hardware breakpoints do not modify the target program's memory, suitable for scenarios where memory cannot be modified (e.g., code is protected or verified). Write the breakpoint address to DR0-DR3 debug registers, set the breakpoint type (read, write, execute) and length through DR7; when a hardware breakpoint triggers, the CPU generates a single-step exception.

Command List

Command	Syntax	Description
SetHbreakPoint	SetHbreakPoint --address <address> --len <1|2|4> --flag <r|w|e>	Set hardware breakpoint
DelHbreakPoint	DelHbreakPoint [--dr <0-3>]	Delete hardware breakpoint (deletes all by default)
ShowHbreakPoint	ShowHbreakPoint	Show all set hardware breakpoints

Parameter Description

• --address: Specify the breakpoint address, read/write breakpoint addresses are automatically aligned according to length
• --len: Specify the monitoring length of the breakpoint, optional values: 1, 2, 4 bytes
• --flag: Specify the access type to monitor, optional values:
  • r: Read access breakpoint
  • w: Write access breakpoint
  • e: Execute access breakpoint
• --dr: Specify the debug register number (0-3) to delete, if not specified, delete all hardware breakpoints

Limitations

• Maximum 4 hardware breakpoints supported (DR0-DR3)
• Read/write breakpoint addresses must be aligned according to length (1 byte no alignment, 2 bytes even address alignment, 4 bytes 4-byte alignment)
• Hardware breakpoints are automatically deleted after triggering

ShowHbreakPoint Output Field Description

• DR: Debug register number (0-3)
• Address: Breakpoint address
• Type: Breakpoint type (r/w/e)
• Length: Monitoring length (bytes)
• Enabled: Whether enabled

Example

[ 0x771AE9C6 ] # SetHbreakPoint --address 0x7781819C --len 4 --flag w
[+] Hardware breakpoint set: DR0: 0x7781819C (Type: w, Length: 4 bytes)

[ 0x771AE9C6 ] # SetHbreakPoint --address 0x778181AA --len 4 --flag r
[+] Hardware breakpoint set: DR1: 0x778181A8 (Type: r, Length: 4 bytes)

[ 0x771AE9C6 ] # SetHbreakPoint --address 0x778181CC --len 4 --flag e
[+] Hardware breakpoint set: DR2: 0x778181CC (Type: e, Length: 4 bytes)
[ 0x771AE9C6 ] #
[ 0x771AE9C6 ] # ShowHbreakPoint
+----+----------------+--------+--------+----------+
| DR |    Address     |  Type  | Length | Enabled  |
+----+----------------+--------+--------+----------+
|  0 | 0x7781819C | w      | 4      | True     |
|  1 | 0x778181A8 | r      | 4      | True     |
|  2 | 0x778181CC | e      | 4      | True     |
+----+----------------+--------+--------+----------+

Step Over (StepOut)

Used to execute the current instruction and skip function calls. If the current instruction is a call, jmp, or other jump instruction, the debugger sets a temporary breakpoint at the target address; otherwise, it sets the TF (Trap Flag) flag to implement single-step execution. Disassemble the current instruction, if it is a call, jmp, or other jump instruction, set a temporary breakpoint at the target address (current address + instruction length); if it is a normal instruction, set the TF flag bit of EFLAGS, and the CPU generates a single-step exception after executing one instruction.

Syntax

StepOut

Example

[ 0x771AE9C6 ] # StepOut
[-] Unknown software breakpoint exception: 0x80000003
[+] Single-step execution completed: 0x771AE9D0
[ 0x771AE9D0 ] # StepIn
[+] Single-step execution completed: 0x771AE9D7

Step Into (StepIn)

Used to execute the next instruction regardless of instruction type. Implemented by setting the TF (Trap Flag) flag bit of EFLAGS, the CPU generates a single-step exception after executing one instruction. Set the TF flag bit (bit 8) of EFLAGS, the CPU automatically generates an EXCEPTION_SINGLE_STEP exception after executing the next instruction, and the debugger pauses execution after catching this exception.

Syntax

StepIn

Difference from StepOut

• StepIn: Always executes one instruction step by step, if it is a call instruction, it enters the called function
• StepOut: Intelligently judges, skips if it is a jump instruction, otherwise executes step by step

Example

[ 0x771AE9D0 ] # StepIn
[+] Single-step execution completed: 0x771AE9D7

Continue Execution (Run)

Used to resume normal execution of the target program until the next breakpoint is encountered or the program ends. Restore all software breakpoints (rewrite 0xCC), then call ContinueDebugEvent to resume target program execution.

Syntax

Run

Example

[ 0x771AE9D7 ] # Run
[*] DLL loaded: Base address = 0x76610000, Path = C:\Windows\System32\RPCRT4.dll
[*] DLL loaded: Base address = 0x74700000, Path = C:\Windows\System32\SspiCli.dll
[*] DLL loaded: Base address = 0x746F0000, Path = C:\Windows\System32\CRYPTBASE.dll

Disassembly (Dissasembler)

Used to disassemble code at a specified address in the target process, displaying machine code and corresponding assembly instructions. Temporarily remove software breakpoints (restore original bytes), read memory data from the target process, use the Capstone disassembly engine to disassemble, and finally restore software breakpoints.

Syntax

Dissasembler [--address <address>] [--size <count>]

Parameter Description

• --address: Optional parameter, specify the starting address for disassembly, defaults to the current EIP value
• --size: Optional parameter, specify the number of instructions to disassemble, default value is 10

Output Field Description

• Address: Instruction address
• Machine Code: Hexadecimal representation of the instruction
• Assembly Instruction: Corresponding x86 assembly instruction

Example

[ 0x771AE9D0 ] # Dissasembler --size 15
Disassembly (Start address: 0x771AE9D0):
+----------------+---------------------------------+------------------------------+
|    Address     |           Machine Code          |    Assembly Instruction      |
+----------------+---------------------------------+------------------------------+
| 0x771AE9D0 | C7 45 FC FE FF FF FF          | mov dword ptr [ebp - 4], 0xfffffffe |
| 0x771AE9D7 | E8 E1 72 FD FF                | call 0x77185cbd |
| 0x771AE9DC | C3                            | ret  |
| 0x771AE9DD | 64 A1 30 00 00 00             | mov eax, dword ptr fs:[0x30] |
| 0x771AE9E3 | 33 C9                         | xor ecx, ecx |
| 0x771AE9E5 | 89 0D 34 16 22 77             | mov dword ptr [0x77221634], ecx |
| 0x771AE9EB | 89 0D 38 16 22 77             | mov dword ptr [0x77221638], ecx |
| 0x771AE9F1 | 88 08                         | mov byte ptr [eax], cl |
| 0x771AE9F3 | 38 48 02                      | cmp byte ptr [eax + 2], cl |
| 0x771AE9F6 | 74 05                         | je 0x771ae9fd |
| 0x771AE9F8 | E8 9E FF FF FF                | call 0x771ae99b |
| 0x771AE9FD | 33 C0                         | xor eax, eax |
| 0x771AE9FF | C3                            | ret  |
| 0x771AEA00 | 8B FF                         | mov edi, edi |
| 0x771AEA02 | 55                            | push ebp |
+----------------+---------------------------------+------------------------------+
[ 0x771AE9D0 ] #

[ 0x771AE9D0 ] # StepOut
[+] Single-step execution completed: 0x771AE9D7

[ 0x771AE9D7 ] # Dissasembler --size 15
Disassembly (Start address: 0x771AE9D7):
+----------------+---------------------------------+------------------------------+
|    Address     |           Machine Code          |    Assembly Instruction      |
+----------------+---------------------------------+------------------------------+
| 0x771AE9D7 | E8 E1 72 FD FF                | call 0x77185cbd |
| 0x771AE9DC | C3                            | ret  |
| 0x771AE9DD | 64 A1 30 00 00 00             | mov eax, dword ptr fs:[0x30] |
| 0x771AE9E3 | 33 C9                         | xor ecx, ecx |
| 0x771AE9E5 | 89 0D 34 16 22 77             | mov dword ptr [0x77221634], ecx |
| 0x771AE9EB | 89 0D 38 16 22 77             | mov dword ptr [0x77221638], ecx |
| 0x771AE9F1 | 88 08                         | mov byte ptr [eax], cl |
| 0x771AE9F3 | 38 48 02                      | cmp byte ptr [eax + 2], cl |
| 0x771AE9F6 | 74 05                         | je 0x771ae9fd |
| 0x771AE9F8 | E8 9E FF FF FF                | call 0x771ae99b |
| 0x771AE9FD | 33 C0                         | xor eax, eax |
| 0x771AE9FF | C3                            | ret  |
| 0x771AEA00 | 8B FF                         | mov edi, edi |
| 0x771AEA02 | 55                            | push ebp |
| 0x771AEA03 | 8B EC                         | mov ebp, esp |
+----------------+---------------------------------+------------------------------+
[ 0x771AE9D7 ] #