Intel XED


The X86 Encoder Decoder (XED), is a software library (and associated headers) for encoding and decoding X86 (IA32 and Intel64) instructions. The decoder takes sequences of 1-15 bytes along with machine mode information and produces a data structure describing the opcode, operands, and flags. The encoder takes a similar data structure and produces a sequence of 1 to 15 bytes. Disassembly is essentially a printing pass on the data structure.

XED is the encoder/decoder used by Pin and the Intel® Software Development Emulator (SDE). XED is used by the ASIM performance model, ZSIM, Intel® VTune Amplifier, IACA, as well as in projects at McAfee, Wind River, and many other projects inside and outside Intel.

XED supports the notion of layers of instructions. As new instructions are made public corresponding to future processors, the associated layers are added to the tables of instructions in the "datafiles" subdirectory. (Intel announces and documents instructions in the ISE and SDM documents typically).

XED compiles with various compilers (GNU gcc, MSVS, Intel ICC/ICL and Clang) and is supported on various operating systems (Linux, Microsoft Window, Apple OS X, etc.).

The XED examples also include binary image readers for Windows PECOFF, ELF, and Mac OSX MACHO binary file formats (32b and 64b). These allow XED to be used as a simple disassembler. The XED disassembler supports 3 output formats: Intel, ATT SYSV, and a more detailed internal format describing all resources read and written. The XED command line tool example can be linked with libelf/libdwarf on Linux and with dbghelp.dll on Microsoft Windows to access symbol information in binaries. The command line tool can also emit (graphviz) "dot" graphs to show register dependences between instructions.

When required, XED can be built without the encoder or the decoder to reduce the code/data footprint. The code in the XED library is written in C and is partially generated from tables using python scripts at build time. XED is designed for embedding and has a minimal set of simple external dependencies. XED requires only 6 simple external library functions (like memcmp and memset). The libxed library makes no system calls and allocates no memory. It is multithread-safe after one-time initialization of the tables.