blob: 92eb28c57023b22f616c6b92a407fbcbb3cd08fd [file] [log] [blame]
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +08001/* Capstone Disassembler Engine */
2/* By Nguyen Anh Quynh <aquynh@gmail.com>, 2013> */
3
4#include <stdio.h>
5#include <stdlib.h>
Cr4sh19ee2d12015-03-29 18:29:06 +08006#include "../myinttypes.h"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +08007
pancake9c10ace2015-02-24 04:55:55 +01008#include <capstone/capstone.h>
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +08009
10struct platform {
11 cs_arch arch;
12 cs_mode mode;
Nguyen Anh Quynhb42a6572013-11-29 17:40:07 +080013 unsigned char *code;
14 size_t size;
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +080015 char *comment;
Nguyen Anh Quynhb8ce68e2013-12-03 23:45:08 +080016 cs_opt_type opt_type;
17 cs_opt_value opt_value;
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +080018};
19
Mr. eXoDia9be1f932014-08-26 12:46:15 +020020static void print_string_hex(unsigned char *str, size_t len)
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +080021{
Nguyen Anh Quynhb42a6572013-11-29 17:40:07 +080022 unsigned char *c;
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +080023
24 printf("Code: ");
25 for (c = str; c < str + len; c++) {
26 printf("0x%02x ", *c & 0xff);
27 }
28 printf("\n");
29}
30
31static void test()
32{
33#define X86_CODE16 "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00"
34#define X86_CODE32 "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00"
Nguyen Anh Quynhb4ce3832013-12-06 08:06:21 +080035//#define X86_CODE32 "\x0f\xa7\xc0" // xstorerng
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +080036#define X86_CODE64 "\x55\x48\x8b\x05\xb8\x13\x00\x00"
37//#define ARM_CODE "\x04\xe0\x2d\xe5"
38#define ARM_CODE "\xED\xFF\xFF\xEB\x04\xe0\x2d\xe5\x00\x00\x00\x00\xe0\x83\x22\xe5\xf1\x02\x03\x0e\x00\x00\xa0\xe3\x02\x30\xc1\xe7\x00\x00\x53\xe3"
39#define ARM_CODE2 "\x10\xf1\x10\xe7\x11\xf2\x31\xe7\xdc\xa1\x2e\xf3\xe8\x4e\x62\xf3"
Nguyen Anh Quynh83466d42014-11-11 21:44:42 +080040#define ARMV8 "\xe0\x3b\xb2\xee\x42\x00\x01\xe1\x51\xf0\x7f\xf5"
41#define THUMB_MCLASS "\xef\xf3\x02\x80"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +080042#define THUMB_CODE "\x70\x47\xeb\x46\x83\xb0\xc9\x68"
43#define THUMB_CODE2 "\x4f\xf0\x00\x01\xbd\xe8\x00\x88\xd1\xe8\x00\xf0"
44#define MIPS_CODE "\x0C\x10\x00\x97\x00\x00\x00\x00\x24\x02\x00\x0c\x8f\xa2\x00\x00\x34\x21\x34\x56"
45#define MIPS_CODE2 "\x56\x34\x21\x34\xc2\x17\x01\x00"
Nguyen Anh Quynh248519e2014-11-09 14:07:07 +080046#define MIPS_32R6M "\x00\x07\x00\x07\x00\x11\x93\x7c\x01\x8c\x8b\x7c\x00\xc7\x48\xd0"
47#define MIPS_32R6 "\xec\x80\x00\x19\x7c\x43\x22\xa0"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +080048//#define ARM64_CODE "\x00\x40\x21\x4b" // sub w0, w0, w1, uxtw
49//#define ARM64_CODE "\x21\x7c\x02\x9b" // mul x1, x1, x2
50//#define ARM64_CODE "\x20\x74\x0b\xd5" // dc zva, x0
51//#define ARM64_CODE "\xe1\x0b\x40\xb9" // ldr w1, [sp, #0x8]
52#define ARM64_CODE "\x21\x7c\x02\x9b\x21\x7c\x00\x53\x00\x40\x21\x4b\xe1\x0b\x40\xb9"
Nguyen Anh Quynhf1d489b2014-01-05 00:00:05 +080053#define PPC_CODE "\x80\x20\x00\x00\x80\x3f\x00\x00\x10\x43\x23\x0e\xd0\x44\x00\x80\x4c\x43\x22\x02\x2d\x03\x00\x80\x7c\x43\x20\x14\x7c\x43\x20\x93\x4f\x20\x00\x21\x4c\xc8\x00\x21"
Nguyen Anh Quynhb8ffb862015-03-12 16:52:31 +080054#define PPC_CODE2 "\x10\x60\x2a\x10\x10\x64\x28\x88\x7c\x4a\x5d\x0f"
Nguyen Anh Quynh05e27132014-03-10 11:58:57 +080055#define SPARC_CODE "\x80\xa0\x40\x02\x85\xc2\x60\x08\x85\xe8\x20\x01\x81\xe8\x00\x00\x90\x10\x20\x01\xd5\xf6\x10\x16\x21\x00\x00\x0a\x86\x00\x40\x02\x01\x00\x00\x00\x12\xbf\xff\xff\x10\xbf\xff\xff\xa0\x02\x00\x09\x0d\xbf\xff\xff\xd4\x20\x60\x00\xd4\x4e\x00\x16\x2a\xc2\x80\x03"
Nguyen Anh Quynhea9f4b12014-03-10 20:38:01 +080056#define SPARCV9_CODE "\x81\xa8\x0a\x24\x89\xa0\x10\x20\x89\xa0\x1a\x60\x89\xa0\x00\xe0"
Nguyen Anh Quynhda1e8332014-03-23 11:12:07 +080057#define SYSZ_CODE "\xed\x00\x00\x00\x00\x1a\x5a\x0f\x1f\xff\xc2\x09\x80\x00\x00\x00\x07\xf7\xeb\x2a\xff\xff\x7f\x57\xe3\x01\xff\xff\x7f\x57\xeb\x00\xf0\x00\x00\x24\xb2\x4f\x00\x78"
Nguyen Anh Quynhc80d8402014-05-26 23:02:48 +080058#define XCORE_CODE "\xfe\x0f\xfe\x17\x13\x17\xc6\xfe\xec\x17\x97\xf8\xec\x4f\x1f\xfd\xec\x37\x07\xf2\x45\x5b\xf9\xfa\x02\x06\x1b\x10"
Nguyen Anh Quynh42706a32014-05-09 07:33:35 +080059 struct platform {
60 cs_arch arch;
61 cs_mode mode;
62 unsigned char *code;
63 size_t size;
64 char *comment;
65 cs_opt_type opt_type;
66 cs_opt_value opt_value;
67 };
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +080068 struct platform platforms[] = {
69 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +010070 CS_ARCH_X86,
71 CS_MODE_16,
72 (unsigned char*)X86_CODE16,
73 sizeof(X86_CODE16) - 1,
74 "X86 16bit (Intel syntax)"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +080075 },
76 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +010077 CS_ARCH_X86,
78 CS_MODE_32,
79 (unsigned char*)X86_CODE32,
80 sizeof(X86_CODE32) - 1,
81 "X86 32bit (ATT syntax)",
82 CS_OPT_SYNTAX,
83 CS_OPT_SYNTAX_ATT,
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +080084 },
85 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +010086 CS_ARCH_X86,
87 CS_MODE_32,
88 (unsigned char*)X86_CODE32,
89 sizeof(X86_CODE32) - 1,
90 "X86 32 (Intel syntax)"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +080091 },
92 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +010093 CS_ARCH_X86,
94 CS_MODE_64,
95 (unsigned char*)X86_CODE64,
96 sizeof(X86_CODE64) - 1,
97 "X86 64 (Intel syntax)"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +080098 },
99 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100100 CS_ARCH_ARM,
101 CS_MODE_ARM,
102 (unsigned char*)ARM_CODE,
103 sizeof(ARM_CODE) - 1,
104 "ARM"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800105 },
106 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100107 CS_ARCH_ARM,
108 CS_MODE_THUMB,
109 (unsigned char*)THUMB_CODE2,
110 sizeof(THUMB_CODE2) - 1,
111 "THUMB-2"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800112 },
113 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100114 CS_ARCH_ARM,
115 CS_MODE_ARM,
116 (unsigned char*)ARM_CODE2,
117 sizeof(ARM_CODE2) - 1,
118 "ARM: Cortex-A15 + NEON"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800119 },
120 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100121 CS_ARCH_ARM,
122 CS_MODE_THUMB,
123 (unsigned char*)THUMB_CODE,
124 sizeof(THUMB_CODE) - 1,
125 "THUMB"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800126 },
127 {
Nguyen Anh Quynh83466d42014-11-11 21:44:42 +0800128 CS_ARCH_ARM,
129 (cs_mode)(CS_MODE_THUMB + CS_MODE_MCLASS),
130 (unsigned char*)THUMB_MCLASS,
131 sizeof(THUMB_MCLASS) - 1,
132 "Thumb-MClass"
133 },
134 {
135 CS_ARCH_ARM,
136 (cs_mode)(CS_MODE_ARM + CS_MODE_V8),
137 (unsigned char*)ARMV8,
138 sizeof(ARMV8) - 1,
139 "Arm-V8"
140 },
141 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100142 CS_ARCH_MIPS,
Nguyen Anh Quynh84df6002014-11-13 11:27:51 +0800143 (cs_mode)(CS_MODE_MIPS32 + CS_MODE_BIG_ENDIAN),
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100144 (unsigned char*)MIPS_CODE,
145 sizeof(MIPS_CODE) - 1,
146 "MIPS-32 (Big-endian)"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800147 },
148 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100149 CS_ARCH_MIPS,
Nguyen Anh Quynh84df6002014-11-13 11:27:51 +0800150 (cs_mode)(CS_MODE_MIPS64 + CS_MODE_LITTLE_ENDIAN),
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100151 (unsigned char*)MIPS_CODE2,
152 sizeof(MIPS_CODE2) - 1,
153 "MIPS-64-EL (Little-endian)"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800154 },
155 {
Nguyen Anh Quynh5720cb72014-10-29 22:35:02 +0800156 CS_ARCH_MIPS,
Nguyen Anh Quynh0d97a3b2014-11-13 11:12:52 +0800157 (cs_mode)(CS_MODE_MIPS32R6 + CS_MODE_MICRO + CS_MODE_BIG_ENDIAN),
Nguyen Anh Quynh248519e2014-11-09 14:07:07 +0800158 (unsigned char*)MIPS_32R6M,
159 sizeof(MIPS_32R6M) - 1,
160 "MIPS-32R6 | Micro (Big-endian)"
161 },
162 {
163 CS_ARCH_MIPS,
Nguyen Anh Quynh0d97a3b2014-11-13 11:12:52 +0800164 (cs_mode)(CS_MODE_MIPS32R6 + CS_MODE_BIG_ENDIAN),
Nguyen Anh Quynh5720cb72014-10-29 22:35:02 +0800165 (unsigned char*)MIPS_32R6,
166 sizeof(MIPS_32R6) - 1,
Nguyen Anh Quynh248519e2014-11-09 14:07:07 +0800167 "MIPS-32R6 (Big-endian)"
Nguyen Anh Quynh5720cb72014-10-29 22:35:02 +0800168 },
169 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100170 CS_ARCH_ARM64,
171 CS_MODE_ARM,
172 (unsigned char*)ARM64_CODE,
173 sizeof(ARM64_CODE) - 1,
174 "ARM-64"
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800175 },
Nguyen Anh Quynh42c6b1a2013-12-30 00:15:25 +0800176 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100177 CS_ARCH_PPC,
178 CS_MODE_BIG_ENDIAN,
179 (unsigned char*)PPC_CODE,
180 sizeof(PPC_CODE) - 1,
Nguyen Anh Quynh42706a32014-05-09 07:33:35 +0800181 "PPC-64"
Nguyen Anh Quynh42c6b1a2013-12-30 00:15:25 +0800182 },
183 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100184 CS_ARCH_PPC,
185 CS_MODE_BIG_ENDIAN,
186 (unsigned char*)PPC_CODE,
187 sizeof(PPC_CODE) - 1,
Nguyen Anh Quynh42706a32014-05-09 07:33:35 +0800188 "PPC-64, print register with number only",
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100189 CS_OPT_SYNTAX,
190 CS_OPT_SYNTAX_NOREGNAME
Nguyen Anh Quynh42c6b1a2013-12-30 00:15:25 +0800191 },
Nguyen Anh Quynh05e27132014-03-10 11:58:57 +0800192 {
Nguyen Anh Quynhb8ffb862015-03-12 16:52:31 +0800193 CS_ARCH_PPC,
194 CS_MODE_BIG_ENDIAN + CS_MODE_QPX,
195 (unsigned char*)PPC_CODE2,
196 sizeof(PPC_CODE2) - 1,
197 "PPC-64 + QPX",
198 },
199 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100200 CS_ARCH_SPARC,
201 CS_MODE_BIG_ENDIAN,
202 (unsigned char*)SPARC_CODE,
203 sizeof(SPARC_CODE) - 1,
204 "Sparc"
Nguyen Anh Quynh05e27132014-03-10 11:58:57 +0800205 },
Nguyen Anh Quynhea9f4b12014-03-10 20:38:01 +0800206 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100207 CS_ARCH_SPARC,
208 (cs_mode)(CS_MODE_BIG_ENDIAN + CS_MODE_V9),
209 (unsigned char*)SPARCV9_CODE,
210 sizeof(SPARCV9_CODE) - 1,
211 "SparcV9"
Nguyen Anh Quynhea9f4b12014-03-10 20:38:01 +0800212 },
Nguyen Anh Quynh48a14ca2014-03-23 08:35:45 +0800213 {
Axel 0vercl0k Souchet779d4c72014-05-08 23:44:49 +0100214 CS_ARCH_SYSZ,
215 (cs_mode)0,
216 (unsigned char*)SYSZ_CODE,
217 sizeof(SYSZ_CODE) - 1,
218 "SystemZ"
Nguyen Anh Quynh48a14ca2014-03-23 08:35:45 +0800219 },
Nguyen Anh Quynhc80d8402014-05-26 23:02:48 +0800220 {
221 CS_ARCH_XCORE,
222 (cs_mode)0,
223 (unsigned char*)XCORE_CODE,
224 sizeof(XCORE_CODE) - 1,
225 "XCore"
226 },
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800227 };
228
229 csh handle;
Nguyen Anh Quynh5df9e4b2013-12-03 15:02:12 +0800230 uint64_t address = 0x1000;
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800231 cs_insn *insn;
232 int i;
Nguyen Anh Quynh5b556e52014-04-11 10:15:26 +0800233 size_t count;
Nguyen Anh Quynh655c7022014-04-11 12:15:33 +0800234 cs_err err;
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800235
236 for (i = 0; i < sizeof(platforms)/sizeof(platforms[0]); i++) {
Nguyen Anh Quynh48a14ca2014-03-23 08:35:45 +0800237 printf("****************\n");
238 printf("Platform: %s\n", platforms[i].comment);
Nguyen Anh Quynh655c7022014-04-11 12:15:33 +0800239 err = cs_open(platforms[i].arch, platforms[i].mode, &handle);
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800240 if (err) {
241 printf("Failed on cs_open() with error returned: %u\n", err);
Nguyen Anh Quynh49146912014-02-22 16:54:44 +0800242 continue;
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800243 }
244
Nguyen Anh Quynhb8ce68e2013-12-03 23:45:08 +0800245 if (platforms[i].opt_type)
246 cs_option(handle, platforms[i].opt_type, platforms[i].opt_value);
Nguyen Anh Quynh01aba002013-12-03 21:00:09 +0800247
Nguyen Anh Quynh0beb0d42014-08-27 22:55:29 +0800248 count = cs_disasm(handle, platforms[i].code, platforms[i].size, address, 0, &insn);
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800249 if (count) {
Nguyen Anh Quynh5b556e52014-04-11 10:15:26 +0800250 size_t j;
251
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800252 print_string_hex(platforms[i].code, platforms[i].size);
253 printf("Disasm:\n");
254
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800255 for (j = 0; j < count; j++) {
Nguyen Anh Quynh723687e2013-11-29 22:36:45 +0800256 printf("0x%"PRIx64":\t%s\t\t%s\n",
Nguyen Anh Quynh7b7b40c2013-12-03 12:24:06 +0800257 insn[j].address, insn[j].mnemonic, insn[j].op_str);
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800258 }
259
260 // print out the next offset, after the last insn
Nguyen Anh Quynh7b7b40c2013-12-03 12:24:06 +0800261 printf("0x%"PRIx64":\n", insn[j-1].address + insn[j-1].size);
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800262
Nguyen Anh Quynh0beb0d42014-08-27 22:55:29 +0800263 // free memory allocated by cs_disasm()
Nguyen Anh Quynh4fe224b2013-12-24 16:49:36 +0800264 cs_free(insn, count);
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800265 } else {
266 printf("****************\n");
267 printf("Platform: %s\n", platforms[i].comment);
268 print_string_hex(platforms[i].code, platforms[i].size);
269 printf("ERROR: Failed to disasm given code!\n");
270 }
271
272 printf("\n");
273
Nguyen Anh Quynh226d7dc2014-02-27 22:20:39 +0800274 cs_close(&handle);
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800275 }
276}
277
278int main()
279{
Nguyen Anh Quynh8f13f3c2013-12-04 22:57:04 +0800280 test();
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800281
282#if 0
Nguyen Anh Quynh42706a32014-05-09 07:33:35 +0800283#define offsetof(st, m) __builtin_offsetof(st, m)
Nguyen Anh Quynh723687e2013-11-29 22:36:45 +0800284
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800285 cs_insn insn;
286 printf("size: %lu\n", sizeof(insn));
Nguyen Anh Quynh8f13f3c2013-12-04 22:57:04 +0800287 printf("@id: %lu\n", offsetof(cs_insn, id));
288 printf("@address: %lu\n", offsetof(cs_insn, address));
289 printf("@size: %lu\n", offsetof(cs_insn, size));
290 printf("@bytes: %lu\n", offsetof(cs_insn, bytes));
291 printf("@mnemonic: %lu\n", offsetof(cs_insn, mnemonic));
292 printf("@op_str: %lu\n", offsetof(cs_insn, op_str));
293 printf("@regs_read: %lu\n", offsetof(cs_insn, regs_read));
294 printf("@regs_read_count: %lu\n", offsetof(cs_insn, regs_read_count));
295 printf("@regs_write: %lu\n", offsetof(cs_insn, regs_write));
296 printf("@regs_write_count: %lu\n", offsetof(cs_insn, regs_write_count));
297 printf("@groups: %lu\n", offsetof(cs_insn, groups));
298 printf("@groups_count: %lu\n", offsetof(cs_insn, groups_count));
299 printf("@arch: %lu\n", offsetof(cs_insn, x86));
Nguyen Anh Quynh26ee41a2013-11-27 12:11:31 +0800300#endif
301
302 return 0;
303}