Controlling ZydisDisassembleIntel output

[440bx]

ZydisDisassembleIntel is quite convenient for its simplicity.

I was wondering if it is possible to control/modify its output. For instance, the address uses lowercase 'a'..'f', can that function be somehow told to use uppercase ? If yes then the question is how

Thank you for your help.

[mappzor]

No, it's not possible. ZydisDisassemble* functions are quick, convinient, all-in-one functions which accept minimal input.

If you need greater control look into formatter API and use ZYDIS_FORMATTER_PROP_HEX_UPPERCASE.

[440bx]

Thank you mappzor. I suspected that would be the answer but, I wanted confirmation from someone who has more knowledge of the Zydis functions than I do (I'm a newbie ;-) )

[mappzor]

See Formatter01 example if you need a quick start on formatters. It's basically ZydisFormatterInit -> one or more ZydisFormatterSetProperty calls -> ZydisDecoderDecodeFull -> ZydisFormatterFormatInstruction.

[440bx]

Thank you. I'm going through all the disassembling and formatting examples. I'm sure I'll have more questions soon ;-)