1*9a0e4156SSadaf Ebrahimi /* Capstone Disassembler Engine */
2*9a0e4156SSadaf Ebrahimi /* By Nguyen Anh Quynh <[email protected]>, 2013 */
3*9a0e4156SSadaf Ebrahimi
4*9a0e4156SSadaf Ebrahimi #include <stdio.h>
5*9a0e4156SSadaf Ebrahimi #include <stdlib.h>
6*9a0e4156SSadaf Ebrahimi
7*9a0e4156SSadaf Ebrahimi #include <capstone/platform.h>
8*9a0e4156SSadaf Ebrahimi #include <capstone/capstone.h>
9*9a0e4156SSadaf Ebrahimi
10*9a0e4156SSadaf Ebrahimi struct platform {
11*9a0e4156SSadaf Ebrahimi cs_arch arch;
12*9a0e4156SSadaf Ebrahimi cs_mode mode;
13*9a0e4156SSadaf Ebrahimi unsigned char *code;
14*9a0e4156SSadaf Ebrahimi size_t size;
15*9a0e4156SSadaf Ebrahimi const char *comment;
16*9a0e4156SSadaf Ebrahimi cs_opt_type opt_type;
17*9a0e4156SSadaf Ebrahimi cs_opt_value opt_value;
18*9a0e4156SSadaf Ebrahimi cs_opt_type opt_skipdata;
19*9a0e4156SSadaf Ebrahimi size_t skipdata;
20*9a0e4156SSadaf Ebrahimi };
21*9a0e4156SSadaf Ebrahimi
print_string_hex(unsigned char * str,size_t len)22*9a0e4156SSadaf Ebrahimi static void print_string_hex(unsigned char *str, size_t len)
23*9a0e4156SSadaf Ebrahimi {
24*9a0e4156SSadaf Ebrahimi unsigned char *c;
25*9a0e4156SSadaf Ebrahimi
26*9a0e4156SSadaf Ebrahimi printf("Code: ");
27*9a0e4156SSadaf Ebrahimi for (c = str; c < str + len; c++) {
28*9a0e4156SSadaf Ebrahimi printf("0x%02x ", *c & 0xff);
29*9a0e4156SSadaf Ebrahimi }
30*9a0e4156SSadaf Ebrahimi printf("\n");
31*9a0e4156SSadaf Ebrahimi }
32*9a0e4156SSadaf Ebrahimi
33*9a0e4156SSadaf Ebrahimi #ifdef CAPSTONE_HAS_ARM
mycallback(const uint8_t * buffer,size_t buffer_size,size_t offset,void * p)34*9a0e4156SSadaf Ebrahimi static size_t CAPSTONE_API mycallback(const uint8_t *buffer, size_t buffer_size, size_t offset, void *p)
35*9a0e4156SSadaf Ebrahimi {
36*9a0e4156SSadaf Ebrahimi // always skip 2 bytes when encountering data
37*9a0e4156SSadaf Ebrahimi return 2;
38*9a0e4156SSadaf Ebrahimi }
39*9a0e4156SSadaf Ebrahimi #endif
40*9a0e4156SSadaf Ebrahimi
test()41*9a0e4156SSadaf Ebrahimi static void test()
42*9a0e4156SSadaf Ebrahimi {
43*9a0e4156SSadaf Ebrahimi #ifdef CAPSTONE_HAS_X86
44*9a0e4156SSadaf Ebrahimi #define X86_CODE32 "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x00\x91\x92"
45*9a0e4156SSadaf Ebrahimi #endif
46*9a0e4156SSadaf Ebrahimi #define RANDOM_CODE "\xed\x00\x00\x00\x00\x1a\x5a\x0f\x1f\xff\xc2\x09\x80\x00\x00\x00\x07\xf7\xeb\x2a\xff\xff\x7f\x57\xe3\x01\xff\xff\x7f\x57\xeb\x00\xf0\x00\x00\x24\xb2\x4f\x00\x78"
47*9a0e4156SSadaf Ebrahimi
48*9a0e4156SSadaf Ebrahimi #if defined(CAPSTONE_HAS_X86)
49*9a0e4156SSadaf Ebrahimi cs_opt_skipdata skipdata = {
50*9a0e4156SSadaf Ebrahimi // rename default "data" instruction from ".byte" to "db"
51*9a0e4156SSadaf Ebrahimi "db",
52*9a0e4156SSadaf Ebrahimi };
53*9a0e4156SSadaf Ebrahimi #endif
54*9a0e4156SSadaf Ebrahimi
55*9a0e4156SSadaf Ebrahimi #ifdef CAPSTONE_HAS_ARM
56*9a0e4156SSadaf Ebrahimi cs_opt_skipdata skipdata_callback = {
57*9a0e4156SSadaf Ebrahimi "db",
58*9a0e4156SSadaf Ebrahimi &mycallback,
59*9a0e4156SSadaf Ebrahimi };
60*9a0e4156SSadaf Ebrahimi #endif
61*9a0e4156SSadaf Ebrahimi
62*9a0e4156SSadaf Ebrahimi struct platform platforms[] = {
63*9a0e4156SSadaf Ebrahimi #ifdef CAPSTONE_HAS_X86
64*9a0e4156SSadaf Ebrahimi {
65*9a0e4156SSadaf Ebrahimi CS_ARCH_X86,
66*9a0e4156SSadaf Ebrahimi CS_MODE_32,
67*9a0e4156SSadaf Ebrahimi (unsigned char*)X86_CODE32,
68*9a0e4156SSadaf Ebrahimi sizeof(X86_CODE32) - 1,
69*9a0e4156SSadaf Ebrahimi "X86 32 (Intel syntax) - Skip data",
70*9a0e4156SSadaf Ebrahimi },
71*9a0e4156SSadaf Ebrahimi {
72*9a0e4156SSadaf Ebrahimi CS_ARCH_X86,
73*9a0e4156SSadaf Ebrahimi CS_MODE_32,
74*9a0e4156SSadaf Ebrahimi (unsigned char*)X86_CODE32,
75*9a0e4156SSadaf Ebrahimi sizeof(X86_CODE32) - 1,
76*9a0e4156SSadaf Ebrahimi "X86 32 (Intel syntax) - Skip data with custom mnemonic",
77*9a0e4156SSadaf Ebrahimi CS_OPT_INVALID,
78*9a0e4156SSadaf Ebrahimi CS_OPT_OFF,
79*9a0e4156SSadaf Ebrahimi CS_OPT_SKIPDATA_SETUP,
80*9a0e4156SSadaf Ebrahimi (size_t) &skipdata,
81*9a0e4156SSadaf Ebrahimi },
82*9a0e4156SSadaf Ebrahimi #endif
83*9a0e4156SSadaf Ebrahimi #ifdef CAPSTONE_HAS_ARM
84*9a0e4156SSadaf Ebrahimi {
85*9a0e4156SSadaf Ebrahimi CS_ARCH_ARM,
86*9a0e4156SSadaf Ebrahimi CS_MODE_ARM,
87*9a0e4156SSadaf Ebrahimi (unsigned char*)RANDOM_CODE,
88*9a0e4156SSadaf Ebrahimi sizeof(RANDOM_CODE) - 1,
89*9a0e4156SSadaf Ebrahimi "Arm - Skip data",
90*9a0e4156SSadaf Ebrahimi },
91*9a0e4156SSadaf Ebrahimi {
92*9a0e4156SSadaf Ebrahimi CS_ARCH_ARM,
93*9a0e4156SSadaf Ebrahimi CS_MODE_ARM,
94*9a0e4156SSadaf Ebrahimi (unsigned char*)RANDOM_CODE,
95*9a0e4156SSadaf Ebrahimi sizeof(RANDOM_CODE) - 1,
96*9a0e4156SSadaf Ebrahimi "Arm - Skip data with callback",
97*9a0e4156SSadaf Ebrahimi CS_OPT_INVALID,
98*9a0e4156SSadaf Ebrahimi CS_OPT_OFF,
99*9a0e4156SSadaf Ebrahimi CS_OPT_SKIPDATA_SETUP,
100*9a0e4156SSadaf Ebrahimi (size_t) &skipdata_callback,
101*9a0e4156SSadaf Ebrahimi },
102*9a0e4156SSadaf Ebrahimi #endif
103*9a0e4156SSadaf Ebrahimi };
104*9a0e4156SSadaf Ebrahimi
105*9a0e4156SSadaf Ebrahimi csh handle;
106*9a0e4156SSadaf Ebrahimi uint64_t address = 0x1000;
107*9a0e4156SSadaf Ebrahimi cs_insn *insn;
108*9a0e4156SSadaf Ebrahimi cs_err err;
109*9a0e4156SSadaf Ebrahimi int i;
110*9a0e4156SSadaf Ebrahimi size_t count;
111*9a0e4156SSadaf Ebrahimi
112*9a0e4156SSadaf Ebrahimi for (i = 0; i < sizeof(platforms)/sizeof(platforms[0]); i++) {
113*9a0e4156SSadaf Ebrahimi printf("****************\n");
114*9a0e4156SSadaf Ebrahimi printf("Platform: %s\n", platforms[i].comment);
115*9a0e4156SSadaf Ebrahimi err = cs_open(platforms[i].arch, platforms[i].mode, &handle);
116*9a0e4156SSadaf Ebrahimi if (err) {
117*9a0e4156SSadaf Ebrahimi printf("Failed on cs_open() with error returned: %u\n", err);
118*9a0e4156SSadaf Ebrahimi abort();
119*9a0e4156SSadaf Ebrahimi }
120*9a0e4156SSadaf Ebrahimi
121*9a0e4156SSadaf Ebrahimi if (platforms[i].opt_type)
122*9a0e4156SSadaf Ebrahimi cs_option(handle, platforms[i].opt_type, platforms[i].opt_value);
123*9a0e4156SSadaf Ebrahimi
124*9a0e4156SSadaf Ebrahimi // turn on SKIPDATA mode
125*9a0e4156SSadaf Ebrahimi cs_option(handle, CS_OPT_SKIPDATA, CS_OPT_ON);
126*9a0e4156SSadaf Ebrahimi cs_option(handle, platforms[i].opt_skipdata, platforms[i].skipdata);
127*9a0e4156SSadaf Ebrahimi
128*9a0e4156SSadaf Ebrahimi count = cs_disasm(handle, platforms[i].code, platforms[i].size, address, 0, &insn);
129*9a0e4156SSadaf Ebrahimi if (count) {
130*9a0e4156SSadaf Ebrahimi size_t j;
131*9a0e4156SSadaf Ebrahimi
132*9a0e4156SSadaf Ebrahimi print_string_hex(platforms[i].code, platforms[i].size);
133*9a0e4156SSadaf Ebrahimi printf("Disasm:\n");
134*9a0e4156SSadaf Ebrahimi
135*9a0e4156SSadaf Ebrahimi for (j = 0; j < count; j++) {
136*9a0e4156SSadaf Ebrahimi printf("0x%" PRIx64 ":\t%s\t\t%s\n",
137*9a0e4156SSadaf Ebrahimi insn[j].address, insn[j].mnemonic, insn[j].op_str);
138*9a0e4156SSadaf Ebrahimi }
139*9a0e4156SSadaf Ebrahimi
140*9a0e4156SSadaf Ebrahimi // print out the next offset, after the last insn
141*9a0e4156SSadaf Ebrahimi printf("0x%" PRIx64 ":\n", insn[j-1].address + insn[j-1].size);
142*9a0e4156SSadaf Ebrahimi
143*9a0e4156SSadaf Ebrahimi // free memory allocated by cs_disasm()
144*9a0e4156SSadaf Ebrahimi cs_free(insn, count);
145*9a0e4156SSadaf Ebrahimi } else {
146*9a0e4156SSadaf Ebrahimi printf("****************\n");
147*9a0e4156SSadaf Ebrahimi printf("Platform: %s\n", platforms[i].comment);
148*9a0e4156SSadaf Ebrahimi print_string_hex(platforms[i].code, platforms[i].size);
149*9a0e4156SSadaf Ebrahimi printf("ERROR: Failed to disasm given code!\n");
150*9a0e4156SSadaf Ebrahimi abort();
151*9a0e4156SSadaf Ebrahimi }
152*9a0e4156SSadaf Ebrahimi
153*9a0e4156SSadaf Ebrahimi printf("\n");
154*9a0e4156SSadaf Ebrahimi
155*9a0e4156SSadaf Ebrahimi cs_close(&handle);
156*9a0e4156SSadaf Ebrahimi }
157*9a0e4156SSadaf Ebrahimi }
158*9a0e4156SSadaf Ebrahimi
main()159*9a0e4156SSadaf Ebrahimi int main()
160*9a0e4156SSadaf Ebrahimi {
161*9a0e4156SSadaf Ebrahimi test();
162*9a0e4156SSadaf Ebrahimi
163*9a0e4156SSadaf Ebrahimi #if 0
164*9a0e4156SSadaf Ebrahimi #define offsetof(st, m) __builtin_offsetof(st, m)
165*9a0e4156SSadaf Ebrahimi
166*9a0e4156SSadaf Ebrahimi cs_insn insn;
167*9a0e4156SSadaf Ebrahimi printf("size: %lu\n", sizeof(insn));
168*9a0e4156SSadaf Ebrahimi printf("@id: %lu\n", offsetof(cs_insn, id));
169*9a0e4156SSadaf Ebrahimi printf("@address: %lu\n", offsetof(cs_insn, address));
170*9a0e4156SSadaf Ebrahimi printf("@size: %lu\n", offsetof(cs_insn, size));
171*9a0e4156SSadaf Ebrahimi printf("@bytes: %lu\n", offsetof(cs_insn, bytes));
172*9a0e4156SSadaf Ebrahimi printf("@mnemonic: %lu\n", offsetof(cs_insn, mnemonic));
173*9a0e4156SSadaf Ebrahimi printf("@op_str: %lu\n", offsetof(cs_insn, op_str));
174*9a0e4156SSadaf Ebrahimi printf("@regs_read: %lu\n", offsetof(cs_insn, regs_read));
175*9a0e4156SSadaf Ebrahimi printf("@regs_read_count: %lu\n", offsetof(cs_insn, regs_read_count));
176*9a0e4156SSadaf Ebrahimi printf("@regs_write: %lu\n", offsetof(cs_insn, regs_write));
177*9a0e4156SSadaf Ebrahimi printf("@regs_write_count: %lu\n", offsetof(cs_insn, regs_write_count));
178*9a0e4156SSadaf Ebrahimi printf("@groups: %lu\n", offsetof(cs_insn, groups));
179*9a0e4156SSadaf Ebrahimi printf("@groups_count: %lu\n", offsetof(cs_insn, groups_count));
180*9a0e4156SSadaf Ebrahimi printf("@arch: %lu\n", offsetof(cs_insn, x86));
181*9a0e4156SSadaf Ebrahimi #endif
182*9a0e4156SSadaf Ebrahimi
183*9a0e4156SSadaf Ebrahimi return 0;
184*9a0e4156SSadaf Ebrahimi }
185