flat assembler
Message board for the users of flat assembler.
Index
> Projects and Ideas > quick decoder v1.0.6 (13-03-2023) Goto page 1, 2 Next |
Author |
|
CandyMan 03 Feb 2010, 16:48
Hello all.
16/32/64 bit mode disassembler with several options (for Dos, Windows and Linux). Also 64-bit version exists (rewrited). It supports all 8086-80486/Pentium instructions with FPU, MMX, 3DNow!, SSE, SSE2, SSE3, SSE4, AVX, FMA, XOP, BMI, TBM, HLE, RTM, AVX2, AVX-512, MPX and others.
_________________ smaller is better Last edited by CandyMan on 13 Mar 2023, 15:56; edited 21 times in total |
|||||||||||||||||||||
03 Feb 2010, 16:48 |
|
Madis731 03 Feb 2010, 18:04
nice and clean - simply works. Thanks!
|
|||
03 Feb 2010, 18:04 |
|
f0dder 05 Feb 2010, 01:32
EXE-compressed and no source included - eww.
|
|||
05 Feb 2010, 01:32 |
|
CandyMan 07 Feb 2010, 19:45
Thanks DOS386 for your suggestions.
There is already a qd version 1.01 (also universal). Some redundant suffixes were removed. - + numbers on some instructions mean signed byte/dword. If you prefer constants in the C style you can run with the option "-x". |
|||
07 Feb 2010, 19:45 |
|
CandyMan 01 Nov 2015, 15:29
New version of quick decoder for download.
_________________ smaller is better |
|||
01 Nov 2015, 15:29 |
|
kalambong 03 Nov 2015, 10:46
CandyMan wrote: New version of quick decoder for download. |
|||
03 Nov 2015, 10:46 |
|
Foxxy 07 Nov 2015, 05:28
This doesn't work on Windows 10 x64, seems to be a compatibility issue with x64.
|
|||
07 Nov 2015, 05:28 |
|
CandyMan 07 Nov 2015, 13:06
Foxxy wrote: This doesn't work on Windows 10 x64, seems to be a compatibility issue with x64. qdw.exe is packed by UPX, you tried to unpack it and run then again? _________________ smaller is better |
|||
07 Nov 2015, 13:06 |
|
Foxxy 10 Nov 2015, 05:49
It would seem that did the trick, but on a modern system I doubt anyone is strapped for space. Why is it packed? Also, very impressive build. However, on a simple program like:
Code: format PE console 4.0 entry start include 'win32ax.inc' section '.data' data readable writeable sStr db "Num: %010u | %08X",10,0 divisor dd 2 arr db 50 dup 0 section '.code' code readable executable start: xor ecx,ecx ;ecx = 0 mov esi,arr ;esi now points to start of array divloop: xor edx,edx ;edx = 0 mov eax,ecx ;eax = count div [divisor] ;div/2 mov byte [esi+ecx],dl ;move lower half of edx into esi+ecx (because modulus 2, it will be 1 or 0 so we can cheat) ;if you're wondering why esi+ecx, it's so we don't ahve ti inc esi every time, we just add the current count to it xor ebx,ebx ;ebx = 0 mov bl,byte [esi+ecx] ;save temporarily ;===Just me printing to the console, don't worry push ecx invoke printf,sStr,ebx,ecx ;print out result, you probably don't have to do this add esp,12 pop ecx ;===Just me printing to the console, don't worry ^ inc ecx ;ecx+1 cmp ecx,50 jne divloop ; if ecx != 50 go to divloop ;console stuff again, not important v invoke getchar ;=========Imports================= section '.idata' import data readable writeable library kernel,'KERNEL32.DLL',\ msvcrt,'MSVCRT.DLL' import kernel,\ ExitProcess,'ExitProcess',\ GetSystemTime,'GetSystemTime',\ Sleep,'Sleep' import msvcrt,\ printf,'printf',\ getchar,'getchar' it seems to treat the div instruction (I think) as imul. Also, when I specify "fasm syntax" and there are null values (00) they are still shown as ADD EAX,AL until the last one where it is treated as db 00. |
|||
10 Nov 2015, 05:49 |
|
CandyMan 10 Nov 2015, 12:59
Foxxy wrote: Also, very impressive build. However, on a simple program like: it isn't a decompiler but only a disassembler "fasm syntax" means distinguishing "cs:[...]" and "[cs:...]" last byte is db 00 because bytes are missing to the closing instruction _________________ smaller is better |
|||
10 Nov 2015, 12:59 |
|
catafest 14 Apr 2016, 19:50
Can you tell me why antivirus see QDW like:
"containing the pattern of 'HEUR/APC (Cloud)' was blocked."? In some cases antivirus programs are marking some software as false virus or malware because they are modified and not officially signed. Can be signed to work with antivirus? |
|||
14 Apr 2016, 19:50 |
|
revolution 15 Apr 2016, 00:44
This problem is easily solved by deleting you AV. Why put so much trust into something that doesn't work for many real viruses and blocks many legitimate programs?
|
|||
15 Apr 2016, 00:44 |
|
catafest 15 Apr 2016, 09:06
revolution wrote: This problem is easily solved by deleting you AV. Why put so much trust into something that doesn't work for many real viruses and blocks many legitimate programs? The problem is that is a malware ,if is not then my concern come with this: 1. I just about assembly and antivirus working well. I know antivirus software are sometimes too picky and will inappropriately flag some executables generated by our toolchain. Also If I make one report to antivirus so they can tune their heuristics - I don't think so will working. Basically the owner will come with source code of maybe can fix. 2. The secondary problem come from development so I need for future to know how to avoid toolchain. 3. I don't want to enable/disable my antivirus some part of this working well. Thank you. Regards. |
|||
15 Apr 2016, 09:06 |
|
revolution 15 Apr 2016, 09:10
It is the AV that is wrong. Why would one want to keep using a broken AV? We shouldn't have to keep changing our code to suit the demands of AV makers. Well, that is, unless they want to pay us to make the necessary changes.
|
|||
15 Apr 2016, 09:10 |
|
TheRaven 10 Sep 2016, 17:56
Don't quote me on this, but I think AV developers are whose behind the viruses --job security and all other manner of things --who needs ransom-ware, we're already hostages!
They come to kill me now... Remember the biography about McAfee --running from someone trying to slay him, his subscribers no doubt. I don't buy into his paranoia bs. -_- I'm done now. |
|||
10 Sep 2016, 17:56 |
|
CandyMan 27 Nov 2017, 16:54
I uploaded new version.
|
|||
27 Nov 2017, 16:54 |
|
Dark 26 Jan 2023, 19:07
CandyMan wrote: I uploaded new version. CandyMan Sorry google translate Hi, can you open source for windows 32-64 bit decoder? or make a dll version to use in my projects I was looking for a small and fast disassembler for a very long time, but I found either 500kb+ and everything in c++ |
|||
26 Jan 2023, 19:07 |
|
Roman 28 Jan 2023, 06:38
Foxxy
Quote: div [divisor] ;div/2 Why not shr eax,1 ? Div slow and not needed divisor dd 2. |
|||
28 Jan 2023, 06:38 |
|
revolution 28 Jan 2023, 06:49
Roman wrote: Foxxy Anyhow, "slow" is relative. My CPU can do DIV faster than I can, so it is fast. Plus, the code does not need high performance. It just prints stuff to the console. It isn't running in a loop a trillion times. |
|||
28 Jan 2023, 06:49 |
|
Goto page 1, 2 Next < Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2025, Tomasz Grysztar. Also on GitHub, YouTube.
Website powered by rwasa.