Write Mini Disassembler: Decode Byte Stream Back to Mnemonics

Topic Overview

Decode Pipeline

A disassembler reverses assembly: bytes in, mnemonics out. A minimal x86 decoder reads one opcode byte, optionally consumes ModR/M and immediates, then prints the instruction.

cCopy
Loading…

Pattern Matching Opcodes

Start with a table for common one-byte opcodes:

• 0x90: NOP
• 0xC3: RET
• 0x01 /r: ADD r/m, r

For example, the byte stream 90 90 C3 disassembles to two NOPs followed by RET.

Extend ModR/M parsing to distinguish ADD EAX, EBX from ADD [RBX], EAX.

For this exercise, you will write a loop that advances ip correctly for each instruction length. This task asks you to never lose sync with the byte stream, because one wrong instruction boundary corrupts every following decode in a real debugger.

Working Through the Exercise

Keep the relevant datasheet, ISA manual, or architecture textbook chapter open while you implement. When your output disagrees with the reference trace on the same program, the bug is usually a mis-decoded opcode, a stale register read, or a flag bit left unchanged after arithmetic.

• Trace first: walk one failing input by hand before changing random lines
• Read the manual: skim the official doc for the mechanism named in this task
• Compare baselines: save measurements from the prior step so speedups are honest

For this exercise, you will use those habits while implementing the requirement in the starter code. Microarchitectural product names change across CPU generations, but the control ideas (fetch, bypass, cache lines, vector lanes) stay stable enough to debug from first principles.

Your Task

Write a mini x86-64 disassembler. It reads a stream of machine-code bytes and prints one assembly line per instruction. The hard part of x86 is that instructions have different lengths. The decoder has to work out each instruction's length from its prefix, opcode and ModR/M byte, or every instruction after it comes out as garbage.

Input

Hex bytes separated by whitespace (any number per line). The first byte is at address 0.

Supported encodings

Registers are numbered 0–7: eax ecx edx ebx esp ebp esi edi (32-bit) / rax … rdi (64-bit). An optional REX.W prefix 48 makes the operation 64-bit.

ModR/M = mod(2) reg(3) rm(3). mod=11: rm is a register. mod=00: [rm]. mod=01: [rm+disp8]. mod=10: [rm+disp32]. Memory operands always use 64-bit register names and print a signed displacement: [rbp-8], [rbx+16], [rax]. (The SIB and RIP-relative forms, rm=100 or mod=00 rm=101, do not occur in the tests.) Immediates and displacements are little-endian and signed. Jump and call targets are address of next instruction + rel.

Output

cCopy
Loading…

• AAAA is the 4-digit hex address. The instruction's bytes are lower-case hex, followed by two spaces and the text.
• Operands are separated by ", ". Immediates are signed decimal, and targets are 0xAAAA.
• For 83/81 with a memory operand, write DWORD PTR/QWORD PTR before the brackets, e.g. add DWORD PTR [rbx+8], 1.
• An unknown opcode is printed as a one-byte (bad) and decoding continues with the next byte. If the stream ends inside an instruction, print the remaining bytes with the text (truncated).

Finally, print N instructions, M bytes. (bad) and (truncated) count as instructions.

Example

Input:

cCopy
Loading…

Output:

cCopy
Loading…

Requirements

1. One decode function that returns the instruction's length, so the main loop can simply advance ip += len.
2. A single ModR/M decoder that returns the register-or-memory operand text and the number of displacement bytes.

Hidden tests cover 83/81 with register and memory operands, disp32, backward and forward jumps, call, an unknown opcode in the middle of the stream, and a truncated final instruction.