capstone
184 строки · 4.4 Кб
1/* Capstone Disassembler Engine */
2/* By Nguyen Anh Quynh <aquynh@gmail.com>, 2013-2019 */
3
4#include <stdio.h>5#include <stdlib.h>6
7#include <capstone/platform.h>8#include <capstone/capstone.h>9
10struct platform {11cs_arch arch;12cs_mode mode;13unsigned char *code;14size_t size;15const char *comment;16cs_opt_type opt_type;17cs_opt_value opt_value;18cs_opt_type opt_skipdata;19size_t skipdata;20};21
22static void print_string_hex(unsigned char *str, size_t len)23{
24unsigned char *c;25
26printf("Code: ");27for (c = str; c < str + len; c++) {28printf("0x%02x ", *c & 0xff);29}30printf("\n");31}
32
33#ifdef CAPSTONE_HAS_ARM34static size_t CAPSTONE_API mycallback(const uint8_t *buffer, size_t buffer_size, size_t offset, void *p)35{
36// always skip 2 bytes when encountering data37return 2;38}
39#endif40
41static void test()42{
43#ifdef CAPSTONE_HAS_X8644#define X86_CODE32 "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x00\x91\x92"45#endif46#define RANDOM_CODE "\xed\x00\x00\x00\x00\x1a\x5a\x0f\x1f\xff\xc2\x09\x80\x00\x00\x00\x07\xf7\xeb\x2a\xff\xff\x7f\x57\xe3\x01\xff\xff\x7f\x57\xeb\x00\xf0\x00\x00\x24\xb2\x4f\x00\x78"47
48#if defined(CAPSTONE_HAS_X86)49cs_opt_skipdata skipdata = {50// rename default "data" instruction from ".byte" to "db"51"db",52};53#endif54
55#ifdef CAPSTONE_HAS_ARM56cs_opt_skipdata skipdata_callback = {57"db",58&mycallback,59};60#endif61
62struct platform platforms[] = {63#ifdef CAPSTONE_HAS_X8664{65CS_ARCH_X86,66CS_MODE_32,67(unsigned char*)X86_CODE32,68sizeof(X86_CODE32) - 1,69"X86 32 (Intel syntax) - Skip data",70},71{72CS_ARCH_X86,73CS_MODE_32,74(unsigned char*)X86_CODE32,75sizeof(X86_CODE32) - 1,76"X86 32 (Intel syntax) - Skip data with custom mnemonic",77CS_OPT_INVALID,78CS_OPT_OFF,79CS_OPT_SKIPDATA_SETUP,80(size_t) &skipdata,81},82#endif83#ifdef CAPSTONE_HAS_ARM84{85CS_ARCH_ARM,86CS_MODE_ARM,87(unsigned char*)RANDOM_CODE,88sizeof(RANDOM_CODE) - 1,89"Arm - Skip data",90},91{92CS_ARCH_ARM,93CS_MODE_ARM,94(unsigned char*)RANDOM_CODE,95sizeof(RANDOM_CODE) - 1,96"Arm - Skip data with callback",97CS_OPT_INVALID,98CS_OPT_OFF,99CS_OPT_SKIPDATA_SETUP,100(size_t) &skipdata_callback,101},102#endif103};104
105csh handle;106uint64_t address = 0x1000;107cs_insn *insn;108cs_err err;109int i;110size_t count;111
112for (i = 0; i < sizeof(platforms)/sizeof(platforms[0]); i++) {113printf("****************\n");114printf("Platform: %s\n", platforms[i].comment);115err = cs_open(platforms[i].arch, platforms[i].mode, &handle);116if (err) {117printf("Failed on cs_open() with error returned: %u\n", err);118abort();119}120
121if (platforms[i].opt_type)122cs_option(handle, platforms[i].opt_type, platforms[i].opt_value);123
124// turn on SKIPDATA mode125cs_option(handle, CS_OPT_SKIPDATA, CS_OPT_ON);126cs_option(handle, platforms[i].opt_skipdata, platforms[i].skipdata);127
128count = cs_disasm(handle, platforms[i].code, platforms[i].size, address, 0, &insn);129if (count) {130size_t j;131
132print_string_hex(platforms[i].code, platforms[i].size);133printf("Disasm:\n");134
135for (j = 0; j < count; j++) {136printf("0x%" PRIx64 ":\t%s\t\t%s\n",137insn[j].address, insn[j].mnemonic, insn[j].op_str);138}139
140// print out the next offset, after the last insn141printf("0x%" PRIx64 ":\n", insn[j-1].address + insn[j-1].size);142
143// free memory allocated by cs_disasm()144cs_free(insn, count);145} else {146printf("****************\n");147printf("Platform: %s\n", platforms[i].comment);148print_string_hex(platforms[i].code, platforms[i].size);149printf("ERROR: Failed to disasm given code!\n");150abort();151}152
153printf("\n");154
155cs_close(&handle);156}157}
158
159int main()160{
161test();162
163#if 0164#define offsetof(st, m) __builtin_offsetof(st, m)165
166cs_insn insn;167printf("size: %lu\n", sizeof(insn));168printf("@id: %lu\n", offsetof(cs_insn, id));169printf("@address: %lu\n", offsetof(cs_insn, address));170printf("@size: %lu\n", offsetof(cs_insn, size));171printf("@bytes: %lu\n", offsetof(cs_insn, bytes));172printf("@mnemonic: %lu\n", offsetof(cs_insn, mnemonic));173printf("@op_str: %lu\n", offsetof(cs_insn, op_str));174printf("@regs_read: %lu\n", offsetof(cs_insn, regs_read));175printf("@regs_read_count: %lu\n", offsetof(cs_insn, regs_read_count));176printf("@regs_write: %lu\n", offsetof(cs_insn, regs_write));177printf("@regs_write_count: %lu\n", offsetof(cs_insn, regs_write_count));178printf("@groups: %lu\n", offsetof(cs_insn, groups));179printf("@groups_count: %lu\n", offsetof(cs_insn, groups_count));180printf("@arch: %lu\n", offsetof(cs_insn, x86));181#endif182
183return 0;184}
185