danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 1 | // Capstone Java binding |
| 2 | // By Nguyen Anh Quynh & Dang Hoang Vu, 2013 |
| 3 | |
danghvu | f86a7d5 | 2013-11-27 15:09:07 -0600 | [diff] [blame] | 4 | import capstone.Capstone; |
keenk | d03cab4 | 2018-07-13 03:52:19 -0500 | [diff] [blame^] | 5 | import static capstone.Capstone.CS_AC_READ; |
| 6 | import static capstone.Capstone.CS_AC_WRITE; |
| 7 | import capstone.Capstone.CsRegsAccess; |
danghvu | f86a7d5 | 2013-11-27 15:09:07 -0600 | [diff] [blame] | 8 | import capstone.X86; |
| 9 | |
danghvu | 2f66688 | 2013-12-01 13:32:16 -0600 | [diff] [blame] | 10 | import static capstone.X86_const.*; |
| 11 | |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 12 | public class TestX86 { |
| 13 | |
| 14 | static byte[] hexString2Byte(String s) { |
| 15 | // from http://stackoverflow.com/questions/140131/convert-a-string-representation-of-a-hex-dump-to-a-byte-array-using-java |
| 16 | int len = s.length(); |
| 17 | byte[] data = new byte[len / 2]; |
| 18 | for (int i = 0; i < len; i += 2) { |
| 19 | data[i / 2] = (byte) ((Character.digit(s.charAt(i), 16) << 4) |
| 20 | + Character.digit(s.charAt(i+1), 16)); |
| 21 | } |
| 22 | return data; |
| 23 | } |
| 24 | |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 25 | static final String X86_CODE64 = "55488b05b8130000"; |
danghvu | 7b08804 | 2013-11-27 10:58:31 -0600 | [diff] [blame] | 26 | static final String X86_CODE16 = "8d4c320801d881c6341200000523010000368b849123010000418d8439896700008d8789670000b4c6"; |
| 27 | static final String X86_CODE32 = "8d4c320801d881c6341200000523010000368b849123010000418d8439896700008d8789670000b4c6"; |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 28 | |
| 29 | public static Capstone cs; |
| 30 | |
| 31 | private static String hex(int i) { |
| 32 | return Integer.toString(i, 16); |
| 33 | } |
| 34 | |
| 35 | private static String hex(long i) { |
| 36 | return Long.toString(i, 16); |
| 37 | } |
| 38 | |
| 39 | private static String array2hex(byte[] arr) { |
| 40 | String ret = ""; |
| 41 | for (int i=0 ;i<arr.length; i++) |
| 42 | ret += String.format("0x%02x ", arr[i]); |
| 43 | return ret; |
| 44 | } |
| 45 | |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 46 | public static void print_ins_detail(Capstone.CsInsn ins) { |
| 47 | System.out.printf("0x%x:\t%s\t%s\n", ins.address, ins.mnemonic, ins.opStr); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 48 | |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 49 | X86.OpInfo operands = (X86.OpInfo) ins.operands; |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 50 | |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 51 | System.out.printf("\tPrefix: %s\n", array2hex(operands.prefix)); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 52 | |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 53 | System.out.printf("\tOpcode: %s\n", array2hex(operands.opcode)); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 54 | |
Nguyen Anh Quynh | 9f6ed71 | 2014-07-01 10:13:28 +0800 | [diff] [blame] | 55 | // print REX prefix (non-zero value is relevant for x86_64) |
| 56 | System.out.printf("\trex: 0x%x\n", operands.rex); |
| 57 | |
Nguyen Anh Quynh | e68ce0e | 2014-06-18 12:33:39 +0800 | [diff] [blame] | 58 | // print address size |
| 59 | System.out.printf("\taddr_size: %d\n", operands.addrSize); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 60 | |
| 61 | // print modRM byte |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 62 | System.out.printf("\tmodrm: 0x%x\n", operands.modrm); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 63 | |
keenk | d03cab4 | 2018-07-13 03:52:19 -0500 | [diff] [blame^] | 64 | // print modRM offset |
| 65 | if (operands.encoding.modrmOffset != 0) { |
| 66 | System.out.printf("\tmodrm offset: 0x%x\n", operands.encoding.modrmOffset); |
| 67 | } |
| 68 | |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 69 | // print displacement value |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 70 | System.out.printf("\tdisp: 0x%x\n", operands.disp); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 71 | |
keenk | d03cab4 | 2018-07-13 03:52:19 -0500 | [diff] [blame^] | 72 | // print displacement offset |
| 73 | if (operands.encoding.dispOffset != 0) { |
| 74 | System.out.printf("\tdisp offset: 0x%x\n", operands.encoding.dispOffset); |
| 75 | } |
| 76 | |
| 77 | //print displacement size |
| 78 | if (operands.encoding.dispSize != 0) { |
| 79 | System.out.printf("\tdisp size: 0x%x\n", operands.encoding.dispSize); |
| 80 | } |
| 81 | |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 82 | // SIB is not available in 16-bit mode |
danghvu | f3ef696 | 2013-11-27 21:41:17 -0600 | [diff] [blame] | 83 | if ( (cs.mode & Capstone.CS_MODE_16) == 0) { |
danghvu | 35855b5 | 2013-11-26 22:42:30 -0600 | [diff] [blame] | 84 | // print SIB byte |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 85 | System.out.printf("\tsib: 0x%x\n", operands.sib); |
| 86 | if (operands.sib != 0) |
danghvu | 53bbee3 | 2014-09-27 15:41:45 -0500 | [diff] [blame] | 87 | System.out.printf("\t\tsib_base: %s\n\t\tsib_index: %s\n\t\tsib_scale: %d\n", |
| 88 | ins.regName(operands.sibBase), ins.regName(operands.sibIndex), operands.sibScale); |
danghvu | f3ef696 | 2013-11-27 21:41:17 -0600 | [diff] [blame] | 89 | } |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 90 | |
Nguyen Anh Quynh | debaa2e | 2015-03-07 13:46:21 +0800 | [diff] [blame] | 91 | if (operands.xopCC != 0) |
| 92 | System.out.printf("\txop_cc: %u\n", operands.xopCC); |
| 93 | |
Nguyen Anh Quynh | 4c5eabc | 2014-06-24 23:50:41 +0800 | [diff] [blame] | 94 | if (operands.sseCC != 0) |
| 95 | System.out.printf("\tsse_cc: %u\n", operands.sseCC); |
| 96 | |
| 97 | if (operands.avxCC != 0) |
| 98 | System.out.printf("\tavx_cc: %u\n", operands.avxCC); |
| 99 | |
Nguyen Anh Quynh | 1a66fec | 2014-06-26 12:09:15 +0800 | [diff] [blame] | 100 | if (operands.avxSae) |
| 101 | System.out.printf("\tavx_sae: TRUE\n"); |
| 102 | |
| 103 | if (operands.avxRm != 0) |
| 104 | System.out.printf("\tavx_rm: %u\n", operands.avxRm); |
| 105 | |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 106 | int count = ins.opCount(X86_OP_IMM); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 107 | if (count > 0) { |
| 108 | System.out.printf("\timm_count: %d\n", count); |
keenk | d03cab4 | 2018-07-13 03:52:19 -0500 | [diff] [blame^] | 109 | System.out.printf("\timm offset: 0x%x\n", operands.encoding.immOffset); |
| 110 | System.out.printf("\timm size: 0x%x\n", operands.encoding.immSize); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 111 | for (int i=0; i<count; i++) { |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 112 | int index = ins.opIndex(X86_OP_IMM, i + 1); |
| 113 | System.out.printf("\t\timms[%d]: 0x%x\n", i+1, (operands.op[index].value.imm)); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 114 | } |
| 115 | } |
| 116 | |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 117 | if (operands.op.length != 0) { |
| 118 | System.out.printf("\top_count: %d\n", operands.op.length); |
| 119 | for (int c=0; c<operands.op.length; c++) { |
| 120 | X86.Operand i = (X86.Operand) operands.op[c]; |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 121 | String imm = hex(i.value.imm); |
danghvu | 2f66688 | 2013-12-01 13:32:16 -0600 | [diff] [blame] | 122 | if (i.type == X86_OP_REG) |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 123 | System.out.printf("\t\toperands[%d].type: REG = %s\n", c, ins.regName(i.value.reg)); |
danghvu | 2f66688 | 2013-12-01 13:32:16 -0600 | [diff] [blame] | 124 | if (i.type == X86_OP_IMM) |
danghvu | 7b08804 | 2013-11-27 10:58:31 -0600 | [diff] [blame] | 125 | System.out.printf("\t\toperands[%d].type: IMM = 0x%x\n", c, i.value.imm); |
danghvu | 2f66688 | 2013-12-01 13:32:16 -0600 | [diff] [blame] | 126 | if (i.type == X86_OP_MEM) { |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 127 | System.out.printf("\t\toperands[%d].type: MEM\n",c); |
Nguyen Anh Quynh | 0467842 | 2014-06-24 14:35:47 +0800 | [diff] [blame] | 128 | String segment = ins.regName(i.value.mem.segment); |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 129 | String base = ins.regName(i.value.mem.base); |
| 130 | String index = ins.regName(i.value.mem.index); |
Nguyen Anh Quynh | 0467842 | 2014-06-24 14:35:47 +0800 | [diff] [blame] | 131 | if (segment != null) |
| 132 | System.out.printf("\t\t\toperands[%d].mem.segment: REG = %s\n", c, segment); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 133 | if (base != null) |
| 134 | System.out.printf("\t\t\toperands[%d].mem.base: REG = %s\n", c, base); |
| 135 | if (index != null) |
| 136 | System.out.printf("\t\t\toperands[%d].mem.index: REG = %s\n", c, index); |
| 137 | if (i.value.mem.scale != 1) |
danghvu | 7b08804 | 2013-11-27 10:58:31 -0600 | [diff] [blame] | 138 | System.out.printf("\t\t\toperands[%d].mem.scale: %d\n", c, i.value.mem.scale); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 139 | if (i.value.mem.disp != 0) |
danghvu | 7b08804 | 2013-11-27 10:58:31 -0600 | [diff] [blame] | 140 | System.out.printf("\t\t\toperands[%d].mem.disp: 0x%x\n", c, i.value.mem.disp); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 141 | } |
Nguyen Anh Quynh | 83800cd | 2014-06-18 14:21:36 +0800 | [diff] [blame] | 142 | |
Nguyen Anh Quynh | 0d71645 | 2014-06-24 22:51:56 +0800 | [diff] [blame] | 143 | // AVX broadcast type |
| 144 | if (i.avx_bcast != X86_AVX_BCAST_INVALID) { |
| 145 | System.out.printf("\t\toperands[%d].avx_bcast: %d\n", c, i.avx_bcast); |
| 146 | } |
| 147 | |
Nguyen Anh Quynh | 92a3d4c | 2014-06-25 23:10:39 +0800 | [diff] [blame] | 148 | // AVX zero opmask {z} |
Nguyen Anh Quynh | 7de200a | 2014-06-26 11:31:36 +0800 | [diff] [blame] | 149 | if (i.avx_zero_opmask) { |
| 150 | System.out.printf("\t\toperands[%d].avx_zero_opmask: TRUE\n", c); |
Nguyen Anh Quynh | 92a3d4c | 2014-06-25 23:10:39 +0800 | [diff] [blame] | 151 | } |
| 152 | |
Nguyen Anh Quynh | f1ec526 | 2014-06-25 22:03:18 +0800 | [diff] [blame] | 153 | System.out.printf("\t\toperands[%d].size: %d\n", c, i.size); |
keenk | d03cab4 | 2018-07-13 03:52:19 -0500 | [diff] [blame^] | 154 | switch(i.access) { |
| 155 | case CS_AC_READ: |
| 156 | System.out.printf("\t\toperands[%d].access: READ\n", c); |
| 157 | break; |
| 158 | case CS_AC_WRITE: |
| 159 | System.out.printf("\t\toperands[%d].access: WRITE\n", c); |
| 160 | break; |
| 161 | case CS_AC_READ | CS_AC_WRITE: |
| 162 | System.out.printf("\t\toperands[%d].access: READ | WRITE\n", c); |
| 163 | break; |
| 164 | } |
| 165 | } |
| 166 | |
| 167 | // Print out all registers accessed by this instruction (either implicit or explicit) |
| 168 | CsRegsAccess regsAccess = ins.regsAccess(); |
| 169 | if (regsAccess != null) { |
| 170 | short[] regsRead = regsAccess.regsRead; |
| 171 | short[] regsWrite = regsAccess.regsWrite; |
| 172 | |
| 173 | if (regsRead.length > 0) { |
| 174 | System.out.printf("\tRegisters read:"); |
| 175 | for (int i = 0; i < regsRead.length; i++) { |
| 176 | System.out.printf(" %s", ins.regName(regsRead[i])); |
| 177 | } |
| 178 | System.out.print("\n"); |
| 179 | } |
| 180 | |
| 181 | if (regsWrite.length > 0) { |
| 182 | System.out.printf("\tRegister modified:"); |
| 183 | for (int i = 0; i < regsWrite.length; i++) { |
| 184 | System.out.printf(" %s", ins.regName(regsWrite[i])); |
| 185 | } |
| 186 | System.out.print("\n"); |
| 187 | } |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 188 | } |
| 189 | } |
| 190 | } |
| 191 | |
| 192 | public static void main(String argv[]) { |
| 193 | |
Akihiko Odaki | 01f6dda | 2016-09-04 10:28:16 +0900 | [diff] [blame] | 194 | final TestBasic.platform[] all_tests = { |
| 195 | new TestBasic.platform(Capstone.CS_ARCH_X86, Capstone.CS_MODE_16, hexString2Byte(X86_CODE16), "X86 16bit (Intel syntax)"), |
| 196 | new TestBasic.platform(Capstone.CS_ARCH_X86, Capstone.CS_MODE_32, Capstone.CS_OPT_SYNTAX_ATT, hexString2Byte(X86_CODE32), "X86 32 (AT&T syntax)"), |
| 197 | new TestBasic.platform(Capstone.CS_ARCH_X86, Capstone.CS_MODE_32, hexString2Byte(X86_CODE32), "X86 32 (Intel syntax)"), |
| 198 | new TestBasic.platform(Capstone.CS_ARCH_X86, Capstone.CS_MODE_64, hexString2Byte(X86_CODE64), "X86 64 (Intel syntax)"), |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 199 | }; |
| 200 | |
| 201 | for (int i=0; i<all_tests.length; i++) { |
Akihiko Odaki | 01f6dda | 2016-09-04 10:28:16 +0900 | [diff] [blame] | 202 | TestBasic.platform test = all_tests[i]; |
danghvu | f3ef696 | 2013-11-27 21:41:17 -0600 | [diff] [blame] | 203 | System.out.println(new String(new char[16]).replace("\0", "*")); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 204 | System.out.println("Platform: " + test.comment); |
Akihiko Odaki | 01f6dda | 2016-09-04 10:28:16 +0900 | [diff] [blame] | 205 | System.out.println("Code: " + TestBasic.stringToHex(test.code)); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 206 | System.out.println("Disasm:"); |
| 207 | |
| 208 | cs = new Capstone(test.arch, test.mode); |
Nguyen Anh Quynh | 6a1107c | 2014-01-07 23:47:18 +0800 | [diff] [blame] | 209 | cs.setDetail(Capstone.CS_OPT_ON); |
danghvu | 0500691 | 2013-12-05 19:33:38 -0600 | [diff] [blame] | 210 | if (test.syntax != 0) { |
| 211 | cs.setSyntax(test.syntax); |
| 212 | } |
danghvu | 4ef20d5 | 2013-12-16 23:25:57 -0600 | [diff] [blame] | 213 | Capstone.CsInsn[] all_ins = cs.disasm(test.code, 0x1000); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 214 | |
| 215 | for (int j = 0; j < all_ins.length; j++) { |
| 216 | print_ins_detail(all_ins[j]); |
| 217 | System.out.println(); |
| 218 | } |
danghvu | f3ef696 | 2013-11-27 21:41:17 -0600 | [diff] [blame] | 219 | |
| 220 | System.out.printf("0x%x:\n\n", all_ins[all_ins.length-1].address + all_ins[all_ins.length-1].size); |
Nguyen Anh Quynh | 0ea529a | 2014-11-19 10:58:31 +0800 | [diff] [blame] | 221 | |
| 222 | // Close when done |
| 223 | cs.close(); |
danghvu | 6a6947f | 2013-11-26 22:28:41 -0600 | [diff] [blame] | 224 | } |
| 225 | } |
| 226 | |
| 227 | } |