I'm looking for some disassembler that has feature similar to WinDbg uf function, it produces output that is really easy transferable to compilable NASM listing. The problem with WinDbg is that it's hard to execute from API level, without attaching debugger. It can work on Linux or Windows.


you don't have to attach to a running process you can open any binary as a dumpfile and ask windbg to disassemble a given function

There is a dbgeng api Execute and ExecuteCmdFile that can execute commands

you can write a standalone dbgeng executable that can open a binary run the command uf and quit

with ".opendump \..\foo.dll ; uf foo!blah;q"

sample code and results

#pragma comment ( lib ,"dbgeng.lib")
#include <stdio.h>
#include <dbgeng.h>
#include "out.cpp" //from remmon windbg sdk sample dir for stdiocallbacks
StdioOutputCallbacks g_Callback;
int main (int argc , char* argv[])
    IDebugClient*    g_Client  = NULL;
    IDebugControl*   g_Control = NULL;
    if(argc == 2 )
        if (DebugCreate(__uuidof(IDebugClient), (void**)&g_Client) == S_OK)
            if (g_Client->QueryInterface(__uuidof(IDebugControl),(void**)&g_Control) == S_OK )
                g_Client->SetOutputCallbacks( &g_Callback );

compiled and linked with in vsdevcmdprompt vs2017 community

cl /Zi /O1 /W4 /analyze /EHsc uf.cpp /link /release

copy the relevent dbgeng.dll / dbghelp.dll and extension dll to current working
directory or copy the executable to windbg installation directory

do not use the system default dbgeng/dbghelp dlls

>uf.exe ".opendump c:\windows\system32\kernelbase.dll;uf kernelbase!CreateFileA;q"
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work    
Microsoft (R) Windows Debugger Version 10.0.18362.1 X86
Copyright (c) Microsoft Corporation. All rights reserved.    
Loading Dump File [c:\windows\system32\kernelbase.dll]
0dd162d1 8bff            mov     edi,edi
0dd162d3 55              push    ebp
0dd162d4 8bec            mov     ebp,esp
0dd162d6 51              push    ecx
0dd162d7 51              push    ecx
0dd162d8 ff7508          push    dword ptr [ebp+8]
0dd162db 8d45f8          lea     eax,[ebp-8]
0dd162de 50              push    eax
0dd162df e83127fdff      call    kernelbase!GetModuleHandleW+0x9a (0dce8a15)
0dd162e4 85c0            test    eax,eax
0dd162e6 7505            jne     kernelbase!CreateFileA+0x1c (0dd162ed)    
0dd162e8 83c8ff          or      eax,0FFFFFFFFh
0dd162eb eb2a            jmp     kernelbase!CreateFileA+0x46 (0dd16317)    
0dd162ed 56              push    esi
0dd162ee ff7520          push    dword ptr [ebp+20h]
0dd162f1 ff751c          push    dword ptr [ebp+1Ch]
0dd162f4 ff7518          push    dword ptr [ebp+18h]
0dd162f7 ff7514          push    dword ptr [ebp+14h]
0dd162fa ff7510          push    dword ptr [ebp+10h]
0dd162fd ff750c          push    dword ptr [ebp+0Ch]
0dd16300 ff75fc          push    dword ptr [ebp-4]
0dd16303 e86044fdff      call    kernelbase!CreateFileW (0dcea768)
0dd16308 8bf0            mov     esi,eax
0dd1630a 8d45f8          lea     eax,[ebp-8]
0dd1630d 50              push    eax
0dd1630e ff159410ce0d    call    dword ptr [kernelbase+0x1094 (0dce1094)]
0dd16314 8bc6            mov     eax,esi
0dd16316 5e              pop     esi    
0dd16317 c9              leave
0dd16318 c21c00          ret     1Ch
  • Woah, that's almost exactly what I was looking for, thanks :D
    – spimley
    Oct 20 '19 at 16:41

IDA, Ghidra, Radare, Capstone and Binary Ninja are some of the most popular disassemblers for static code analysis, and all of them have python SDKs.

  • Yeah, I know all of those. I'm looking for an easy way of doing that. AFAIK IDA, Capstone and BN don't have any features that are capable of that.
    – spimley
    Sep 16 '19 at 19:38
  • Why doesn't their python SDK gives you what you want? Sep 18 '19 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.