Bitdefender Disassembler (bddisasm)

Instruction specifications follow a strict, case-sensitive format (except for the mnemonic):

mnemonic; explicit operands; implicit operands; encoding; flags

• Mnemonic: The instruction name (e.g., ADD). Supports decorators and hints.
• Explicit Operands: Operands that must be manually specified (e.g., eax, ecx).
• Implicit Operands: Operands that the instruction operates on automatically (e.g., FLAGS).
• Encoding: The binary encoding details, enclosed in square brackets [].
• Flags: Additional metadata.

The Rust bindings are split into two distinct crates following standard Rust conventions:

1. bddisasm-sys: A low-level crate that follows the *-sys convention. It provides a raw interface by linking directly with libbddisasm.
2. bddisasm: A high-level, idiomatic Rust crate built on top of bddisasm-sys. It provides a safer and more convenient API, though some parts (like the Mnemonic enum) are manually refined from auto-generated code.

The INSTRUX structure is a comprehensive container for all decoded information. You do not need helper functions to extract metadata; instead, access the fields directly.

Key information categories include:

• Encoding: Prefixes, opcodes, modrm, sib, immediates, and displacement.
• Operands: Type, size, access, and encoding for both explicit and implicit operands.
• Meta Information: Instruction set, type, and class.
• Modes: Supported modes (real, protected, long, ring 0/1/2/3, etc.).
• Flags: Access types (tested, modified, cleared, set, undefined) for CPU and FPU flags.
• Memory: Segment, base/index/scale registers, displacement, and VSIB info.
• CPU Compatibility: CPUID leaf information to check instruction availability.

The easiest way to install the Bitdefender disassembler is using the vcpkg package manager. This command installs both the bddisasm and bdshemu static libraries.

Note: The version available on vcpkg may not always be the latest version available on GitHub.

vcpkg install bddisasm

To use the disassembler, include the bddisasm.h header and link against the appropriate library: bddisasm.lib on Windows or libbddisasm.a on Linux.

Requirement: External Functions Because the library is designed to be OS and environment agnostic, you must provide definitions for nd_vsnprintf_s and nd_memset. This allows the integrator to use their own preferred implementations of these standard functions.

// Example of required function definitions
int nd_vsnprintf_s(
    char *buffer,
    size_t sizeOfBuffer,
    size_t count,
    const char *format,
    va_list argptr
) {
    return _vsnprintf_s(buffer, sizeOfBuffer, count, format, argptr);
}

void* nd_memset(void *s, int c, size_t n) {
    return memset(s, c, n);
}

You can verify the integrity of released static libraries and the disasmtool CLI using GitHub Artifact Attestation.

To verify a specific component:

$ gh attestation verify disasmtool -o bitdefender

To verify an entire bundle (e.g., a zip file):

$ gh attestation verify x86-windows-release.zip -o bitdefender

Note: Attestation is not available for bddisasm versions 2.1.4 or older.

You can install the Bitdefender disassembler Python wrapper using pip.

pip install pybddisasm

To use the no_std Rust bindings for the Bitdefender x86/x64 instruction decoder, add bddisasm to your Cargo.toml dependencies.

[dependencies]
bddisasm = "0.1.0"

To use bddisasm-sys, you must have clang installed on your system because the crate uses bindgen to generate bindings at build time.

Note: If you are looking for a high-level Rust wrapper rather than raw no_std bindings, use the bddisasm crate instead.