DownWithUp / DbgKeystone

A keystone engine powered Windows Debugger extension

DbgKeystone

A Keystone engine powered Windows Debugger extension

Reasoning

WinDbg's default assember (the a command) can't handle instructions involving x64 registers and many instruction set extensions. For example:

With this extension you are able to assemble anything that the Keystone engine supports:

Usage

• The easiest way to use this is to simply download the binary file in the Binary directory of this repo.

• Load the extension in WinDbg with the .load [path to extension]

• You can now use !a [address] which will assemble using Keystone

Compiling

• Download the Keystone Engine's Win64 pacakge here
• Create a new Visual Studio solution and include the Keystone engine headers and the static library.
• Add the source code of this repository
• Compile, and load the plugin .load [path to extension]