1*9a0e4156SSadaf Ebrahimi#!/usr/bin/env python 2*9a0e4156SSadaf Ebrahimi 3*9a0e4156SSadaf Ebrahimi# Capstone Python bindings, by Nguyen Anh Quynnh <[email protected]> 4*9a0e4156SSadaf Ebrahimifrom __future__ import print_function 5*9a0e4156SSadaf Ebrahimiimport sys 6*9a0e4156SSadaf Ebrahimifrom capstone import * 7*9a0e4156SSadaf Ebrahimi 8*9a0e4156SSadaf EbrahimiCODE32 = b"\xc0\xe0\x02" 9*9a0e4156SSadaf EbrahimiCODE32 += b"\xc0\xf6\x02" # sal dh, 0 10*9a0e4156SSadaf EbrahimiCODE32 += b"\xc1\xf6\x00" # sal esi, 0 11*9a0e4156SSadaf EbrahimiCODE32 += b"\x82\xc0\x00" 12*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x1a\x00" # nop dword ptr [eax] 13*9a0e4156SSadaf EbrahimiCODE32 += b"\xf7\xc0\x11\x22\x33\x44" # test eax, 0x44332211 14*9a0e4156SSadaf EbrahimiCODE32 += b"\xf7\xc8\x11\x22\x33\x44" # test eax, 0x44332211 15*9a0e4156SSadaf EbrahimiCODE32 += b"\xf7\x88\x00\x00\x00\x00\x00\x00\x00\x00" # test dword ptr [eax], 0 16*9a0e4156SSadaf EbrahimiCODE32 += b"\xf6\x88\x00\x00\x00\x00\x00" # test byte ptr [eax], 0 17*9a0e4156SSadaf Ebrahimi 18*9a0e4156SSadaf EbrahimiCODE32 += b"\xd9\xd8" # fstpnce st(0), st(0) 19*9a0e4156SSadaf EbrahimiCODE32 += b"\xdf\xdf" # fstp st(7), st(0) 20*9a0e4156SSadaf Ebrahimi 21*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x20\x00" # mov eax, cr0 22*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x20\x40" # mov eax, cr0 23*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x20\x80" # mov eax, cr0 24*9a0e4156SSadaf Ebrahimi 25*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x22\x00" # mov cr0, eax 26*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x22\x40" # mov cr0, eax 27*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x22\x80" # mov cr0, eax 28*9a0e4156SSadaf Ebrahimi 29*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x21\x00" # mov eax, dr0 30*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x21\x40" # mov eax, dr0 31*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x21\x80" # mov eax, dr0 32*9a0e4156SSadaf Ebrahimi 33*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x23\x00" # mov dr0, eax 34*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x23\x40" # mov dr0, eax 35*9a0e4156SSadaf EbrahimiCODE32 += b"\x0f\x23\x80" # mov dr0, eax 36*9a0e4156SSadaf Ebrahimi 37*9a0e4156SSadaf EbrahimiCODE32 += b"\x66\x2e\x0f\x58\xc0" # addpd xmm0, xmm0 38*9a0e4156SSadaf EbrahimiCODE32 += b"\x2e\x66\x0f\x58\xc0" # addpd xmm0, xmm0 39*9a0e4156SSadaf EbrahimiCODE32 += b"\x66\xf2\x0f\x38\xf1\xc3" # crc32w %bx, %eax 40*9a0e4156SSadaf EbrahimiCODE32 += b"\xf2\x0f\x38\xf1\x8c\xcb\xef\xbe\xad\xde" # crc32l -0x21524111(%ebx, %ecx, 8), %ecx 41*9a0e4156SSadaf Ebrahimi 42*9a0e4156SSadaf EbrahimiCODE32_MEMREF = b"\x8b\x84\x91\x23\x01\x00\x00" 43*9a0e4156SSadaf EbrahimiCODE32_MEMREF += b"\x8b\x04\x95\x23\x01\x00\x00" 44*9a0e4156SSadaf EbrahimiCODE32_MEMREF += b"\x8b\x04\x95\xdd\xfe\xff\xff" 45*9a0e4156SSadaf EbrahimiCODE32_MEMREF += b"\xa1\x23\x01\x00\x00" 46*9a0e4156SSadaf EbrahimiCODE32_MEMREF += b"\xa1\x00\x00\x00\x00" 47*9a0e4156SSadaf EbrahimiCODE32_MEMREF += b"\xa1\xdd\xfe\xff\xff" 48*9a0e4156SSadaf EbrahimiCODE32_MEMREF += b"\x8b\x04\x91" 49*9a0e4156SSadaf Ebrahimi 50*9a0e4156SSadaf EbrahimiCODE64_MEMREF = b"\xa3\x0b\x00\x00\x0f\xbe\xc0\x48\x83" 51*9a0e4156SSadaf EbrahimiCODE64_MEMREF += b"\xa0\x71\xfa\xff\x48\x85\xc0\x48\x89" 52*9a0e4156SSadaf Ebrahimi 53*9a0e4156SSadaf EbrahimiCODE32_ARITH = b"\x83\xe0\xf7" 54*9a0e4156SSadaf EbrahimiCODE32_ARITH += b"\x83\xe0\x10" 55*9a0e4156SSadaf EbrahimiCODE32_ARITH += b"\x83\xe0\x00" 56*9a0e4156SSadaf EbrahimiCODE32_ARITH += b"\x80\x23\x10" 57*9a0e4156SSadaf Ebrahimi 58*9a0e4156SSadaf EbrahimiCODE64_ARITH = b"\x41\x83\xe0\xfa" 59*9a0e4156SSadaf EbrahimiCODE64_ARITH += b"\x48\x83\xe4\xf0" 60*9a0e4156SSadaf Ebrahimi 61*9a0e4156SSadaf EbrahimiCODE32_IMM = b"\xc2\xb8\xc0" 62*9a0e4156SSadaf EbrahimiCODE32_IMM += b"\xc2\x0f\x92" 63*9a0e4156SSadaf EbrahimiCODE32_IMM += b"\x02\x2d\x00\x00\x00\x83" 64*9a0e4156SSadaf Ebrahimi 65*9a0e4156SSadaf Ebrahimi 66*9a0e4156SSadaf Ebrahimi 67*9a0e4156SSadaf Ebrahimi_python3 = sys.version_info.major == 3 68*9a0e4156SSadaf Ebrahimi 69*9a0e4156SSadaf Ebrahimiall_tests = ( 70*9a0e4156SSadaf Ebrahimi (CS_ARCH_X86, CS_MODE_32, CODE32, "X86 32 (Intel syntax)", 0), 71*9a0e4156SSadaf Ebrahimi (CS_ARCH_X86, CS_MODE_32, CODE32, "X86 32 (ATT syntax)", CS_OPT_SYNTAX_ATT), 72*9a0e4156SSadaf Ebrahimi 73*9a0e4156SSadaf Ebrahimi (CS_ARCH_X86, CS_MODE_32, CODE32_MEMREF, "X86 32 MemRef (Intel syntax)", 0), 74*9a0e4156SSadaf Ebrahimi (CS_ARCH_X86, CS_MODE_32, CODE32_MEMREF, "X86 32 MemRef (ATT syntax)", CS_OPT_SYNTAX_ATT), 75*9a0e4156SSadaf Ebrahimi (CS_ARCH_X86, CS_MODE_64, CODE64_MEMREF, "X86 64 (Intel syntax)", 0), 76*9a0e4156SSadaf Ebrahimi 77*9a0e4156SSadaf Ebrahimi (CS_ARCH_X86, CS_MODE_32, CODE32_ARITH, "X86 32 (Intel syntax)", 0), 78*9a0e4156SSadaf Ebrahimi (CS_ARCH_X86, CS_MODE_64, CODE64_ARITH, "X86 64 (Intel syntax)", 0), 79*9a0e4156SSadaf Ebrahimi 80*9a0e4156SSadaf Ebrahimi (CS_ARCH_X86, CS_MODE_32, CODE32_IMM, "X86 32 (Intel syntax)", 0), 81*9a0e4156SSadaf Ebrahimi (CS_ARCH_X86, CS_MODE_32, CODE32_IMM, "X86 32 (Intel syntax)", CS_OPT_SYNTAX_ATT), 82*9a0e4156SSadaf Ebrahimi) 83*9a0e4156SSadaf Ebrahimi 84*9a0e4156SSadaf Ebrahimi 85*9a0e4156SSadaf Ebrahimidef to_hex(s): 86*9a0e4156SSadaf Ebrahimi if _python3: 87*9a0e4156SSadaf Ebrahimi return " ".join("0x{0:02x}".format(c) for c in s) # <-- Python 3 is OK 88*9a0e4156SSadaf Ebrahimi else: 89*9a0e4156SSadaf Ebrahimi return " ".join("0x{0:02x}".format(ord(c)) for c in s) 90*9a0e4156SSadaf Ebrahimi 91*9a0e4156SSadaf Ebrahimi# ## Test cs_disasm_quick() 92*9a0e4156SSadaf Ebrahimidef test_cs_disasm_quick(): 93*9a0e4156SSadaf Ebrahimi for (arch, mode, code, comment, syntax) in all_tests: 94*9a0e4156SSadaf Ebrahimi print("Platform: %s" % comment) 95*9a0e4156SSadaf Ebrahimi print("Code: %s" %(to_hex(code))), 96*9a0e4156SSadaf Ebrahimi print("Disasm:") 97*9a0e4156SSadaf Ebrahimi md = Cs(arch, mode) 98*9a0e4156SSadaf Ebrahimi if syntax != 0: 99*9a0e4156SSadaf Ebrahimi md.syntax = syntax 100*9a0e4156SSadaf Ebrahimi for insn in md.disasm(code, 0x1000): 101*9a0e4156SSadaf Ebrahimi print("0x%x:\t%s\t%s" % (insn.address, insn.mnemonic, insn.op_str)) 102*9a0e4156SSadaf Ebrahimi print("--------") 103*9a0e4156SSadaf Ebrahimi 104*9a0e4156SSadaf Ebrahimi 105*9a0e4156SSadaf Ebrahimiif __name__ == '__main__': 106*9a0e4156SSadaf Ebrahimi test_cs_disasm_quick() 107