A simple x86 (32 bit) disassembler written in C
- decode common one-byte and two-byte x86-32 opcode
- support 0x66 (operand-size override) prefix
- parse PE files and calculate virtual addresses (used in JMP, etc.) automatically
Kaleidoscope has been tested to compile and run on:
- Windows 10, CLion, MinGW w64 3.4, CMake 3.13.2
klp -s SIZE [-a ADDR] [-b BASE] [-h] FILE
-s SIZE: disassemble SIZE bytes (in decimal) starting from ADDR
-a ADDR: start disassembling from file offset ADDR (in hex)
-b BASE: specify the image base in hex (i.e. the address an executable is loaded to in memory); the disassember will add BASE to file offsets to form virtual addresses (VA). Note: this BASE is calculated automatically if FILE is a PE; you don't need to specify it manually.
-h: display this help message
MIT License