Skip to content

README.md

Latest commit

 

History

History
50 lines (33 loc) · 1.3 KB

README.md

File metadata and controls

50 lines (33 loc) · 1.3 KB

ZydisExample

This is a small project that shows how to use Zydis. It loads a PE file from disk, scans for byte patterns, and then disassembles instructions around the matches.

What it does

  • Reads a PE file (like a .sys or .exe) from disk
  • Finds bytes with a simple pattern scan
  • Uses Zydis to decode + format x64 instructions

Install Zydis with vcpkg

This project is set up to use vcpkg through MSBuild. It will look for vcpkg in:

  • VCPKG_ROOT (environment variable), or
  • C:\vcpkg (fallback)
  1. Install vcpkg (once):
git clone https://github.com/microsoft/vcpkg
cd vcpkg
.\bootstrap-vcpkg.bat
  1. Install Zydis (x64, static, MSVC runtime MD):
.\vcpkg install zydis:x64-windows-static-md
  1. Integrate vcpkg with Visual Studio (recommended):
.\vcpkg integrate install

If you don’t want global integration, you can also pass the toolchain file to CMake builds. (This repo is a Visual Studio solution though.)

Build (Visual Studio 2022)

  • Open ZydisExample.sln
  • Select Release + x64
  • Build

Run

By default the sample tries to load a specific file path. If it can’t find your file, just change the path in ZydisExample/main.cpp and run again.

Credits to @dword64 inspired base from him.