Intel XED

Intel has a library to help encode/decode instructions, called the Intel(R) XED (X86 Encoder Decoder). I’ve yet to determine if it its PE image support also includes supports UEFI’s TE image format.

Intel XED is a software library (and associated headers) for encoding and decoding X86 (IA32 and Intel64) instructions. It is widely used inside and outside of Intel. The decoder takes sequences of 1-15 bytes along with machine mode information and produces a data structure describing the opcode and operands, and flags. The encoder takes a similar data structure and produces a sequence of 1 to 15 bytes. Disassembly is essentially printing pass on the data structure produced by the decoder. The examples also include binary image readers for Windows PECOFF, ELF, and Mac OSX MACHO binary file formats (32b and 64b). These allow Intel XED to be used as a simple disassembler. The Intel XED disassembler supports 3 output formats: Intel (dest on left), ATT SYSV (dest on right), and a more detailed internal format describing all resources read and written. Intel XED compiles with all major compilers and O/Ses and was designed for portability. If required, Intel XED can be built without the encoder or without the decoder to reduce the code/data footprint.  The code in the Intel XED library is written in C and is partially generated from tables using python scripts at build time. Intel XED is designed for embedding and has a minimal set of simple external dependencies. It makes no system calls and allocates no memory. It is multithread-safe after one-time initialization of the tables. Both the 32b and 64b versions of the library can decode or encode 32b and 64b instructions.  The machine mode for decoding the instructions is specified in a data structure that is input to the encoding and decoding APIs.

https://software.intel.com/en-us/articles/xed-x86-encoder-decoder-software-library
https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool
https://software.intel.com/sites/landingpage/xed/ref-manual/html/index.html

Leave a comment