OSDev.org

Hello fellow OSDevers.

I would like to present to your attention an x86 (and x86-64) instruction decoder that I and my colleagues have developed as part of our daytime job at the Institute for System Programming of Russian Academy of Sciences. It is used in a couple of our code analysis projects and we have relicensed it under LGPL3+ to allow others to take advantage of our work.

The decoder is written in C and has no external dependencies whatsoever, it even makes no calls into the C standard library and thus can be easily incorporated into an OS project, in an in-kernel debugger or to facilitate dynamic code patching.

The decoder is pretty fast, I don't have the recent data but back in 2008 the (then closed-source) version outperformed ndisasm 2.02 by 1.7 times, and objdump 2.17.50 by 3.4 times on a 50M corpus of 32-bit code, and we have made significant improvements since then. If there is demand for current numbers, I will conduct a few performance tests.

The downside is that documentation is, well, scarce, only in form of Doxygen comments. Again, if demand for documentation rises, I will invest some time in that as well. There is also currently no support for AVX/XOP instructions, I plan to add support later this summer.

Our decoder had also been incorporated in at least one big open-source project, the V3VEE Palacios virtual machine monitor.

• Download: https://github.com/ispras/quix86

The build process is straightforward:



The Makefile may require some tweaking for your target environment, but there's nothing there that an OSDever can't handle. The one prerequisite for building quix86 is awk which you probably already have.

Pull requests and bug reports are very much welcome, hope that quix86 helps someone. I will be happy to answer any questions.

Please, can you clarify a bit - is it just another disassembler?

There is some difference between disassemler tools (~work with files, produce human-readable output) and instruction decoders (fast decoding of single instruction, it's usefull for trap-and-emulate functions, decoding of execution traces, etc; work with structures instead of text).
There are many libraries that can be used for instruction decoding but they all have their pros and cons.
One can also note that quix86 development started many years ago and at that time there were ~no well-known library with required features and suitable license.