A simple x86 (32 bit) disassembler written in C
- decode common one-byte and two-byte x86-32 opcode
- support 0x66 (operand-size override) prefix
- parse PE files and calculate virtual addresses (used in JMP, etc.) automatically
Kaleidoscope has been tested to compile and run on:
- Windows 10, CLion, MinGW w64 3.4, CMake 3.13.2
klp -s SIZE [-a ADDR] [-b BASE] [-h] FILE
-s SIZE
: disassemble SIZE
bytes (in decimal) starting from ADDR
-a ADDR
: start disassembling from file offset ADDR
(in hex)
-b BASE
: specify the image base in hex (i.e. the address an executable is loaded to in memory); the disassember will add BASE
to file offsets to form virtual addresses (VA). Note: this BASE
is calculated automatically if FILE
is a PE; you don't need to specify it manually.
-h
: display this help message
MIT License