diff options
Diffstat (limited to 'docs/Capstone-Engine-Documentation/Capstone-Engine Documentation.md')
| -rw-r--r-- | docs/Capstone-Engine-Documentation/Capstone-Engine Documentation.md | 3406 |
1 files changed, 3406 insertions, 0 deletions
diff --git a/docs/Capstone-Engine-Documentation/Capstone-Engine Documentation.md b/docs/Capstone-Engine-Documentation/Capstone-Engine Documentation.md new file mode 100644 index 00000000..b1b1b80a --- /dev/null +++ b/docs/Capstone-Engine-Documentation/Capstone-Engine Documentation.md @@ -0,0 +1,3406 @@ +# Capstone-Engine API Documentation + +| Version | 4.0.2 | +| ------- | ----- | + +**Official API document by [kabeor](https://github.com/kabeor)** + +[Capstone Engine](https://github.com/capstone-engine/capstone)是一个支持多种硬件架构的二进制反汇编引擎。 + + +## 0x0 开发准备 + + Capstone官网： http://www.capstone-engine.org + +### 自行编译lib和dll方法 + + 源码： https://github.com/capstone-engine/capstone.git + + git clone下来 + 文件结构如下： + +``` + . <- 主要引擎core engine + README + 编译文档COMPILE.TXT 等 +├── arch <- 各语言反编译支持的代码实现 +│ ├── AArch64 <- ARM64 (aka ARMv8) 引擎 +│ ├── ARM <- ARM 引擎 +│ ├── EVM <- Ethereum 引擎 +│ ├── M680X <- M680X 引擎 +│ ├── M68K <- M68K 引擎 +| ├── MOS65XX <- MOS65XX 引擎 +│ ├── Mips <- Mips 引擎 +│ ├── PowerPC <- PowerPC 引擎 +│ ├── Sparc <- Sparc 引擎 +│ ├── SystemZ <- SystemZ 引擎 +│ ├── TMS320C64x <- TMS320C64x 引擎 +│ ├── X86 <- X86 引擎 +│ └── XCore <- XCore 引擎 +├── bindings <- 绑定 +│ ├── java <- Java 绑定 + 测试代码 +│ ├── ocaml <- Ocaml 绑定 + 测试代码 +│ ├── powershell <- powershell 绑定 + 测试代码 +│ ├── python <- python 绑定 + 测试代码 +│ └── vb6 <- vb6 绑定 + 测试代码 +├── contrib <- 社区代码 +├── cstool <- Cstool 检测工具源码 +├── docs <- 文档，主要是capstone的实现思路 +├── include <- C头文件 +├── msvc <- Microsoft Visual Studio 支持（Windows） +├── packages <- Linux/OSX/BSD包 +├── suite <- 项目开发所需工具 +├── tests <- C语言测试用例 +├── windows <- Windows 支持(Windows内核驱动编译) +├── windowsce <- Windows CE 支持 +└── xcode <- Xcode 支持 (MacOSX 编译) +``` + +下面演示Windows10使用Visual Studio2019编译 + +复制msvc文件夹到一个比较清爽的位置，内部结构如下： + + + +VS打开capstone.sln项目文件，解决方案自动载入这些 + + + +可以看到支持的所有语言都在这里了，如果都需要的话，直接编译就好了，只需要其中几种，则右键解决方案->属性->配置属性 如下 + + + +生成选项中勾选你需要的支持项即可 +编译后会在当前文件夹Debug目录下生成capstone.lib静态编译库和capstone.dll动态库这样就可以开始使用Capstone进行开发了 + +如果不想自己编译，官方也提供了官方编译版本 + +Win32： https://github.com/capstone-engine/capstone/releases/download/4.0.2/capstone-4.0.2-win32.zip + +Win64： https://github.com/capstone-engine/capstone/releases/download/4.0.2/capstone-4.0.2-win64.zip + +选x32或x64将影响后面开发的位数 + + + +### 引擎调用测试 + +新建一个VS项目，将capstone\include\capstone中的头文件以及编译好的lib和dll文件全部拷贝到新建项目的主目录下 + + + +在VS解决方案中，头文件添加现有项capstone.h，资源文件中添加capstone.lib，重新生成解决方案 + + + +那么现在来测试一下我们自己的capstone引擎吧 + +主文件写入如下代码 + +<details><summary> Code </summary> + +```c++ +#include <iostream> +#include <stdio.h> +#include <cinttypes> +#include "capstone.h" +using namespace std; + +#define CODE "\x55\x48\x8b\x05\xb8\x13\x00\x00" + +int main(void) +{ + csh handle; + cs_insn* insn; + size_t count; + + if (cs_open(CS_ARCH_X86, CS_MODE_64, &handle)) { + printf("ERROR: Failed to initialize engine!\n"); + return -1; + } + + count = cs_disasm(handle, (unsigned char*)CODE, sizeof(CODE) - 1, 0x1000, 0, &insn); + if (count) { + size_t j; + + for (j = 0; j < count; j++) { + printf("0x%""Ix"":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic, insn[j].op_str); + } + + cs_free(insn, count); + } + else + printf("ERROR: Failed to disassemble given code!\n"); + + cs_close(&handle); + + return 0; +} +``` + +</details> + +运行结果 + + + + +## 0x1 数据类型 + +### csh + +用于生成调用capstone API的句柄 + +```cpp +size_t csh +``` + +> 用法： `csh handle;` + + +### cs_arch + +架构选择 + +<details><summary> Code </summary> + +```cpp + enum cs_arch { + CS_ARCH_ARM = 0, ///< ARM 架构 (包括 Thumb, Thumb-2) + CS_ARCH_ARM64, ///< ARM-64, 也叫 AArch64 + CS_ARCH_MIPS, ///< Mips 架构 + CS_ARCH_X86, ///< X86 架构 (包括 x86 & x86-64) + CS_ARCH_PPC, ///< PowerPC 架构 + CS_ARCH_SPARC, ///< Sparc 架构 + CS_ARCH_SYSZ, ///< SystemZ 架构 + CS_ARCH_XCORE, ///< XCore 架构 + CS_ARCH_M68K, ///< 68K 架构 + CS_ARCH_TMS320C64X, ///< TMS320C64x 架构 + CS_ARCH_M680X, ///< 680X 架构 + CS_ARCH_EVM, ///< Ethereum 架构 + CS_ARCH_MAX, + CS_ARCH_ALL = 0xFFFF, // All 架构 - for cs_support() +} cs_arch; +``` + +</details> + +> 用法：API中cs_arch参数填入枚举内容，如API中cs_open(cs_arch arch, cs_mode mode, csh *handle);第一个参数填CS_ARCH_X86则支持X86 架构 + + +### cs_mode + +模式选择 + +<details><summary> Code </summary> + +```cpp +enum cs_mode { + CS_MODE_LITTLE_ENDIAN = 0, ///< little-endian 模式 (default 模式) + CS_MODE_ARM = 0, ///< 32-bit ARM + CS_MODE_16 = 1 << 1, ///< 16-bit 模式 (X86) + CS_MODE_32 = 1 << 2, ///< 32-bit 模式 (X86) + CS_MODE_64 = 1 << 3, ///< 64-bit 模式 (X86, PPC) + CS_MODE_THUMB = 1 << 4, ///< ARM's Thumb 模式, 包括 Thumb-2 + CS_MODE_MCLASS = 1 << 5, ///< ARM's Cortex-M 系列 + CS_MODE_V8 = 1 << 6, ///< ARMv8 A32解码方式 + CS_MODE_MICRO = 1 << 4, ///< MicroMips 模式 (MIPS) + CS_MODE_MIPS3 = 1 << 5, ///< Mips III ISA + CS_MODE_MIPS32R6 = 1 << 6, ///< Mips32r6 ISA + CS_MODE_MIPS2 = 1 << 7, ///< Mips II ISA + CS_MODE_V9 = 1 << 4, ///< SparcV9 模式 (Sparc) + CS_MODE_QPX = 1 << 4, ///< Quad Processing eXtensions 模式 (PPC) + CS_MODE_SPE = 1 << 5, ///< Signal Processing Engine 模式 (PPC) + CS_MODE_BOOKE = 1 << 6, ///< Book-E 模式 (PPC) + CS_MODE_M68K_000 = 1 << 1, ///< M68K 68000 模式 + CS_MODE_M68K_010 = 1 << 2, ///< M68K 68010 模式 + CS_MODE_M68K_020 = 1 << 3, ///< M68K 68020 模式 + CS_MODE_M68K_030 = 1 << 4, ///< M68K 68030 模式 + CS_MODE_M68K_040 = 1 << 5, ///< M68K 68040 模式 + CS_MODE_M68K_060 = 1 << 6, ///< M68K 68060 模式 + CS_MODE_BIG_ENDIAN = 1 << 31, ///< big-endian 模式 + CS_MODE_MIPS32 = CS_MODE_32, ///< Mips32 ISA (Mips) + CS_MODE_MIPS64 = CS_MODE_64, ///< Mips64 ISA (Mips) + CS_MODE_M680X_6301 = 1 << 1, ///< M680X Hitachi 6301,6303 模式 + CS_MODE_M680X_6309 = 1 << 2, ///< M680X Hitachi 6309 模式 + CS_MODE_M680X_6800 = 1 << 3, ///< M680X Motorola 6800,6802 模式 + CS_MODE_M680X_6801 = 1 << 4, ///< M680X Motorola 6801,6803 模式 + CS_MODE_M680X_6805 = 1 << 5, ///< M680X Motorola/Freescale 6805 模式 + CS_MODE_M680X_6808 = 1 << 6, ///< M680X Motorola/Freescale/NXP 68HC08 模式 + CS_MODE_M680X_6809 = 1 << 7, ///< M680X Motorola 6809 模式 + CS_MODE_M680X_6811 = 1 << 8, ///< M680X Motorola/Freescale/NXP 68HC11 模式 + CS_MODE_M680X_CPU12 = 1 << 9, ///< M680X Motorola/Freescale/NXP CPU12 + ///< 用于 M68HC12/HCS12 + CS_MODE_M680X_HCS08 = 1 << 10, ///< M680X Freescale/NXP HCS08 模式 + CS_MODE_BPF_CLASSIC = 0, ///< Classic BPF 模式 (默认) + CS_MODE_BPF_EXTENDED = 1 << 0, ///< Extended BPF 模式 + CS_MODE_RISCV32 = 1 << 0, ///< RISCV RV32G + CS_MODE_RISCV64 = 1 << 1, ///< RISCV RV64G + CS_MODE_RISCVC = 1 << 2, ///< RISCV 压缩指令模式 + CS_MODE_MOS65XX_6502 = 1 << 1, ///< MOS65XXX MOS 6502 + CS_MODE_MOS65XX_65C02 = 1 << 2, ///< MOS65XXX WDC 65c02 + CS_MODE_MOS65XX_W65C02 = 1 << 3, ///< MOS65XXX WDC W65c02 + CS_MODE_MOS65XX_65816 = 1 << 4, ///< MOS65XXX WDC 65816, 8-bit m/x + CS_MODE_MOS65XX_65816_LONG_M = (1 << 5), ///< MOS65XXX WDC 65816, 16-bit m, 8-bit x + CS_MODE_MOS65XX_65816_LONG_X = (1 << 6), ///< MOS65XXX WDC 65816, 8-bit m, 16-bit x + CS_MODE_MOS65XX_65816_LONG_MX = CS_MODE_MOS65XX_65816_LONG_M | CS_MODE_MOS65XX_65816_LONG_X, +} cs_mode; +``` + +</details> + +> 用法：API中cs_mode参数填入枚举内容，如API中cs_open(cs_arch arch, cs_mode mode, csh *handle);第二个参数填CS_MODE_64则支持X64模式 + + +### cs_opt_mem + +内存操作 + +<details><summary> Code </summary> + +```cpp +struct cs_opt_mem { + cs_malloc_t malloc; + cs_calloc_t calloc; + cs_realloc_t realloc; + cs_free_t free; + cs_vsnprintf_t vsnprintf; +} cs_opt_mem; +``` + +</details> + +> 用法：可使用用户自定义的malloc/calloc/realloc/free/vsnprintf()函数，默认使用系统自带malloc(), calloc(), realloc(), free() & vsnprintf() + + +### cs_opt_mnem + +自定义助记符 + +<details><summary> Code </summary> + +```cpp +struct cs_opt_mnem { + /// 需要自定义的指令ID + unsigned int id; + /// 自定义的助记符 + const char *mnemonic; +} cs_opt_mnem; +``` + +</details> + + +### cs_opt_type + +反编译的运行时选项 + +<details><summary> Code </summary> + +```cpp +enum cs_opt_type { + CS_OPT_INVALID = 0, ///< 无特殊要求 + CS_OPT_SYNTAX, ///< 汇编输出语法 + CS_OPT_DETAIL, ///< 将指令结构分解为多个细节 + CS_OPT_MODE, ///< 运行时改变引擎模式 + CS_OPT_MEM, ///< 用户定义的动态内存相关函数 + CS_OPT_SKIPDATA, ///< 在反汇编时跳过数据。然后引擎将处于SKIPDATA模式 + CS_OPT_SKIPDATA_SETUP, ///< 为SKIPDATA选项设置用户定义函数 + CS_OPT_MNEMONIC, ///<自定义指令助记符 + CS_OPT_UNSIGNED, ///< 以无符号形式打印立即操作数 +} cs_opt_type; +``` + +</details> + +> 用法：API cs_option(csh handle, cs_opt_type type, size_t value);中第二个参数 + + +### cs_opt_value + +运行时选项值(与cs_opt_type关联) + +<details><summary> Code </summary> + +```cpp +enum cs_opt_value { + CS_OPT_OFF = 0, ///< 关闭一个选项 - 默认为CS_OPT_DETAIL, CS_OPT_SKIPDATA, CS_OPT_UNSIGNED. + CS_OPT_ON = 3, ///< 打开一个选项 (CS_OPT_DETAIL, CS_OPT_SKIPDATA). + CS_OPT_SYNTAX_DEFAULT = 0, ///< 默认asm语法 (CS_OPT_SYNTAX). + CS_OPT_SYNTAX_INTEL, ///< X86 Intel asm语法 - 默认开启 X86 (CS_OPT_SYNTAX). + CS_OPT_SYNTAX_ATT, ///< X86 ATT 汇编语法 (CS_OPT_SYNTAX). + CS_OPT_SYNTAX_NOREGNAME, ///< 只打印寄存器名和编号 (CS_OPT_SYNTAX) + CS_OPT_SYNTAX_MASM, ///< X86 Intel Masm 语法 (CS_OPT_SYNTAX). + CS_OPT_SYNTAX_MOTOROLA, ///< MOS65XX 用 $ 作为hex头 +} cs_opt_value; +``` + +</details> + +> 用法：API cs_option(csh handle, cs_opt_type type, size_t value);中第三个参数 + + +### cs_op_type + +通用指令操作数类型，在所有架构中保持一致 + +<details><summary> Code </summary> + +```cpp +enum cs_op_type { + CS_OP_INVALID = 0, ///< 未初始化/无效的操作数 + CS_OP_REG, ///< 寄存器操作数 + CS_OP_IMM, ///< 立即操作数 + CS_OP_MEM, ///< 内存操作数 + CS_OP_FP, ///< 浮点数 +} cs_op_type; +``` + +</details> + +> 目前开放的API中未调用 + + +### cs_ac_type + +通用指令操作数访问类型，在所有架构中保持一致 +可以组合访问类型，例如:CS_AC_READ | CS_AC_WRITE + +<details><summary> Code </summary> + +```cpp +enum cs_ac_type { + CS_AC_INVALID = 0, ///< 未初始化/无效的访问类型 + CS_AC_READ = 1 << 0, ///< 操作数从内存或寄存器中读取 + CS_AC_WRITE = 1 << 1, ///< 操作数从内存或寄存器中写入 +} cs_ac_type; +``` + +</details> + +> 目前开放的API中未调用 + + +### cs_group_type + +公共指令组，在所有架构中保持一致 + +<details><summary> Code </summary> + +```cpp +cs_group_type { + CS_GRP_INVALID = 0, ///< 未初始化/无效指令组 + CS_GRP_JUMP, ///< 所有跳转指令(条件跳转+直接跳转+间接跳转) + CS_GRP_CALL, ///< 所有调用指令 + CS_GRP_RET, ///< 所有返回指令 + CS_GRP_INT, ///< 所有中断指令(int+syscall) + CS_GRP_IRET, ///< 所有中断返回指令 + CS_GRP_PRIVILEGE, ///< 所有特权指令 + CS_GRP_BRANCH_RELATIVE, ///< 所有相关分支指令 +} cs_group_type; +``` + +</details> + +> 目前开放的API中未调用 + + +### cs_opt_skipdata + +用户自定义设置SKIPDATA选项 + +<details><summary> Code </summary> + +```cpp +struct cs_opt_skipdata { + /// Capstone认为要跳过的数据是特殊的“指令” + /// 用户可以在这里指定该指令的“助记符”字符串 + /// 默认情况下(@mnemonic为NULL)， Capstone使用“.byte” + const char *mnemonic; + + /// 用户定义的回调函数，当Capstone命中数据时调用 + /// 如果这个回调返回的值是正数(>0)，Capstone将跳过这个字节数并继续。如果回调返回0,Capstone将停止反汇编并立即从cs_disasm()返回 + /// 注意:如果这个回调指针为空，Capstone会根据架构跳过一些字节，如下所示: + /// Arm: 2 bytes (Thumb mode) or 4 bytes. + /// Arm64: 4 bytes. + /// Mips: 4 bytes. + /// M680x: 1 byte. + /// PowerPC: 4 bytes. + /// Sparc: 4 bytes. + /// SystemZ: 2 bytes. + /// X86: 1 bytes. + /// XCore: 2 bytes. + /// EVM: 1 bytes. + /// RISCV: 4 bytes. + /// WASM: 1 bytes. + /// MOS65XX: 1 bytes. + /// BPF: 8 bytes. + cs_skipdata_cb_t callback; // 默认值为 NULL + + /// 用户自定义数据将被传递给@callback函数指针 + void *user_data; +} cs_opt_skipdata; +``` + +</details> + +> 目前开放的API中未调用 + + +### cs_detail + +注意:只有当CS_OPT_DETAIL = CS_OPT_ON时，cs_detail中的所有信息才可用 + +在arch/ARCH/ARCHDisassembler.c的ARCH_getInstruction中初始化为memset(., 0, offsetof(cs_detail, ARCH)+sizeof(cs_ARCH)) + +如果cs_detail发生了变化，特别是在union之后添加了字段，那么相应地更新arch/ arch/ archdisassembly.c + +<details><summary> Code </summary> + +```cpp +struct cs_detail { + uint16_t regs_read[16]; ///< 这个参数读取隐式寄存器列表 + uint8_t regs_read_count; ///< 这个参数读取隐式寄存器计数 + + uint16_t regs_write[20]; ///< 这个参数修改隐式寄存器列表 + uint8_t regs_write_count; ///< 这个参数修改隐式寄存器计数 + + uint8_t groups[8]; ///< 此指令所属的指令组的列表 + uint8_t groups_count; ///< 此指令所属的组的数 + + /// 特定于体系结构的信息 + union { + cs_x86 x86; ///< X86 架构, 包括 16-bit, 32-bit & 64-bit 模式 + cs_arm64 arm64; ///< ARM64 架构 (aka AArch64) + cs_arm arm; ///< ARM 架构 (包括 Thumb/Thumb2) + cs_m68k m68k; ///< M68K 架构 + cs_mips mips; ///< MIPS 架构 + cs_ppc ppc; ///< PowerPC 架构 + cs_sparc sparc; ///< Sparc 架构 + cs_sysz sysz; ///< SystemZ 架构 + cs_xcore xcore; ///< XCore 架构 + cs_tms320c64x tms320c64x; ///< TMS320C64x 架构 + cs_m680x m680x; ///< M680X 架构 + cs_evm evm; ///< Ethereum 架构 + cs_mos65xx mos65xx; ///< MOS65XX 架构 (包含 MOS6502) + cs_wasm wasm; ///< Web Assembly 架构 + cs_bpf bpf; ///< Berkeley Packet Filter 架构 (包含 eBPF) + cs_riscv riscv; ///< RISCV 架构 + }; +} cs_detail; +``` + +</details> + + +### cs_insn + +指令的详细信息 + +<details><summary> Code </summary> + +```cpp +struct cs_insn { + /// 指令ID(基本上是一个用于指令助记符的数字ID) + /// 应在相应架构的头文件中查找'[ARCH]_insn' enum中的指令id，如ARM.h中的'arm_insn'代表ARM, X86.h中的'x86_insn'代表X86等… + /// 即使在CS_OPT_DETAIL = CS_OPT_OFF时也可以使用此信息 + /// 注意:在Skipdata模式下，这个id字段的“data”指令为0 + unsigned int id; + + /// 指令地址 (EIP) + /// 即使在CS_OPT_DETAIL = CS_OPT_OFF时也可以使用此信息 + uint64_t address; + + /// 指令长度 + /// 即使在CS_OPT_DETAIL = CS_OPT_OFF时也可以使用此信息 + uint16_t size; + + /// 此指令的机器码，其字节数由上面的@size表示 + /// 即使在CS_OPT_DETAIL = CS_OPT_OFF时也可以使用此信息 + uint8_t bytes[24]; + + /// 指令的Ascii文本助记符 + /// 即使在CS_OPT_DETAIL = CS_OPT_OFF时也可以使用此信息 + char mnemonic[CS_MNEMONIC_SIZE]; + + /// 指令操作数的Ascii文本 + /// 即使在CS_OPT_DETAIL = CS_OPT_OFF时也可以使用此信息 + char op_str[160]; + + /// cs_detail指针 + /// 注意:只有同时满足以下两个要求时，detail指针才有效: + /// (1) CS_OP_DETAIL = CS_OPT_ON + /// (2) 引擎未处于Skipdata模式(CS_OP_SKIPDATA选项设置为CS_OPT_ON) + /// + /// 注意2:当处于Skipdata模式或detail模式关闭时，即使这个指针不是NULL，它的内容仍然是不相关的。 + cs_detail *detail; +} cs_insn; +``` + +</details> + + +### cs_err + +Capstone API遇到的各类型的错误时cs_errno()的返回值 + +<details><summary> Code </summary> + +```cpp +typedef enum cs_err { + CS_ERR_OK = 0, ///< 无错误 + CS_ERR_MEM, ///< 内存不足: cs_open(), cs_disasm(), cs_disasm_iter() + CS_ERR_ARCH, ///< 不支持的架构: cs_open() + CS_ERR_HANDLE, ///<句柄不可用: cs_op_count(), cs_op_index() + CS_ERR_CSH, ///< csh参数不可用: cs_close(), cs_errno(), cs_option() + CS_ERR_MODE, ///< 无效的或不支持的模式: cs_open() + CS_ERR_OPTION, ///< 无效的或不支持的选项: cs_option() + CS_ERR_DETAIL, ///< 信息不可用，因为detail选项是关闭的 + CS_ERR_MEMSETUP, ///< 动态内存管理未初始化(见 CS_OPT_MEM) + CS_ERR_VERSION, ///< 不支持版本 (bindings) + CS_ERR_DIET, ///< 在“diet”引擎中访问不相关的数据 + CS_ERR_SKIPDATA, ///< 在SKIPDATA模式下访问与“数据”指令无关的数据 + CS_ERR_X86_ATT, ///< X86 AT&T 语法不支持(在编译时退出) + CS_ERR_X86_INTEL, ///< X86 Intel 语法不支持(在编译时退出) + CS_ERR_X86_MASM, ///< X86 Intel 语法不支持(在编译时退出) +} cs_err; +``` + +</details> + + +## 0x2 API + +### cs_version + +`unsigned int CAPSTONE_API cs_version(int *major, int *minor);` + +用来输出capstone版本号 + +``` +major: API主版本 +minor: API次版本 +return: 返回主次版本的16进制，如4.0版本返回 0x0400 +``` + +该版本定义于cs.c中，编译后不可更改，不接受自定义版本 + + + + + + +<details><summary> 示例1 </summary> + +```c +#include <stdio.h> +#include <stdlib.h> + +#include "platform.h" +#include "capstone.h" + +static int test() +{ + return cs_version(NULL, NULL); +} + +int main() +{ + int version = test(); + printf("%X", version); + return 0; +} +``` + +</details> + + + + +<details><summary> 示例2，强行修改版本 </summary> + +```cpp +#include <stdio.h> +#include <stdlib.h> + +#include "platform.h" +#include "capstone.h" + +static int test() +{ + int ma[] = { 5 }; + int mi[] = { 6 }; + + return cs_version(ma, mi); +} + +int main() +{ + int version = test(); + printf("%X", version); + return 0; +} +``` + +</details> + + + +可见并不能改变 + +### cs_support + +`bool CAPSTONE_API cs_support(int query);` + +用来检查capstone库是否支持参数输入的架构或处于某编译选项 + +<details><summary> 源码实现 </summary> + + +```cpp +bool CAPSTONE_API cs_support(int query) +{ + if (query == CS_ARCH_ALL) + return all_arch == ((1 << CS_ARCH_ARM) | (1 << CS_ARCH_ARM64) | + (1 << CS_ARCH_MIPS) | (1 << CS_ARCH_X86) | + (1 << CS_ARCH_PPC) | (1 << CS_ARCH_SPARC) | + (1 << CS_ARCH_SYSZ) | (1 << CS_ARCH_XCORE) | + (1 << CS_ARCH_M68K) | (1 << CS_ARCH_TMS320C64X) | + (1 << CS_ARCH_M680X) | (1 << CS_ARCH_EVM)); + + if ((unsigned int)query < CS_ARCH_MAX) + return all_arch & (1 << query); + + if (query == CS_SUPPORT_DIET) { +#ifdef CAPSTONE_DIET + return true; +#else + return false; +#endif + } + + if (query == CS_SUPPORT_X86_REDUCE) { +#if defined(CAPSTONE_HAS_X86) && defined(CAPSTONE_X86_REDUCE) + return true; +#else + return false; +#endif + } + + // unsupported query + return false; +} +``` + +</details> + +示例1(CS_ARCH_ALL，检查是否支持所有架构) + + + +示例2(CS_ARCH_*，检查是否支持指定架构) + + + +示例3(检查是否处于DIET编译模式)： + + + +示例4(检查是否处于X86_REDUCE编译模式) + + + + +### cs_malloc_t + +`void* (CAPSTONE_API *cs_malloc_t)(size_t size);` + +cs的动态内存分配，用于 + +```cpp +struct cs_opt_mem { + cs_malloc_t malloc; + cs_calloc_t calloc; + cs_realloc_t realloc; + cs_free_t free; + cs_vsnprintf_t vsnprintf; +} cs_opt_mem; +``` + +在用户模式下，cs_mem_malloc默认使用系统malloc + +Windows driver模式下，`cs_malloc_t cs_mem_malloc = cs_winkernel_malloc;` + +cs_winkernel_malloc定义于\capstone-4.0.1\windows\winkernel_mm.c, + +<details><summary> 源码实现 </summary> + +```cpp +void * CAPSTONE_API cs_winkernel_malloc(size_t size) +{ + // 长度不能分配为0 + NT_ASSERT(size); + + // FP; NonPagedPool用于支持 Windows 7 +#pragma prefast(suppress : 30030) // 分配可执行的POOL_TYPE内存 + size_t number_of_bytes = 0; + CS_WINKERNEL_MEMBLOCK *block = NULL; + // 特定的值能造成溢出 + // 如果value中的和超出或低于类型容量，函数将返回NULL。 + if (!NT_SUCCESS(RtlSizeTAdd(size, sizeof(CS_WINKERNEL_MEMBLOCK), &number_of_bytes))) { + return NULL; + } + block = (CS_WINKERNEL_MEMBLOCK *)ExAllocatePoolWithTag( + NonPagedPool, number_of_bytes, CS_WINKERNEL_POOL_TAG); + if (!block) { + return NULL; + } + block->size = size; + + return block->data; +} +``` + +</details> + +> OSX kernel模式下，`cs_malloc_t cs_mem_malloc = kern_os_malloc;`，这里暂且不探讨。 + + +### cs_calloc_t + +`void* (CAPSTONE_API *cs_calloc_t)(size_t nmemb, size_t size);` + +cs申请内存并初始化 + +用于`struct cs_opt_mem`，定义于cs.c + +用户模式： `cs_calloc_t cs_mem_calloc = calloc;`,使用系统calloc + +Windows driver模式： `cs_calloc_t cs_mem_calloc = cs_winkernel_calloc;` + +<details><summary> 源码实现 </summary> + +```cpp +void * CAPSTONE_API cs_winkernel_calloc(size_t n, size_t size) +{ + size_t total = n * size; + + void *new_ptr = cs_winkernel_malloc(total); + if (!new_ptr) { + return NULL; + } + + return RtlFillMemory(new_ptr, total, 0); +} +``` + +</details> + +> OSX kernel模式： `cs_calloc_t cs_mem_calloc = cs_kern_os_calloc;` 直接调用kern_os_malloc + + +### cs_realloc_t + +`void* (CAPSTONE_API *cs_realloc_t)(void *ptr, size_t size);` + +cs重新分配内存 + +用于`struct cs_opt_mem`，定义于cs.c + +用户模式： `cs_realloc_t cs_mem_realloc = realloc;`,调用系统realloc + +Windows driver模式： `cs_realloc_t cs_mem_realloc = cs_winkernel_realloc;` + +<details><summary> 源码实现 </summary> + +```cpp +void * CAPSTONE_API cs_winkernel_realloc(void *ptr, size_t size) +{ + void *new_ptr = NULL; + size_t current_size = 0; + size_t smaller_size = 0; + + if (!ptr) { + return cs_winkernel_malloc(size); + } + + new_ptr = cs_winkernel_malloc(size); + if (!new_ptr) { + return NULL; + } + + current_size = CONTAINING_RECORD(ptr, CS_WINKERNEL_MEMBLOCK, data)->size; + smaller_size = (current_size < size) ? current_size : size; + RtlCopyMemory(new_ptr, ptr, smaller_size); + cs_winkernel_free(ptr); + + return new_ptr; +} +``` + +</details> + +> OSX kernel模式： `cs_realloc_t cs_mem_realloc = kern_os_realloc;` + + +### cs_free_t + +`typedef void (CAPSTONE_API *cs_free_t)(void *ptr);` + +cs释放内存 + +用于`struct cs_opt_mem`，定义于cs.c + +用户模式： `cs_free_t cs_mem_free = free;`,调用系统free + +Windows driver模式： `cs_free_t cs_mem_free = cs_winkernel_free;` + +<details><summary> 源码实现 </summary> + +```cpp +void CAPSTONE_API cs_winkernel_free(void *ptr) +{ + if (ptr) { + ExFreePoolWithTag(CONTAINING_RECORD(ptr, CS_WINKERNEL_MEMBLOCK, data), CS_WINKERNEL_POOL_TAG); + } +} +``` + +</details> + +> OSX kernel模式： `cs_free_t cs_mem_free = kern_os_free;` + + + +### cs_vsnprintf_t + +`int (CAPSTONE_API *cs_vsnprintf_t)(char *str, size_t size, const char *format, va_list ap);` + +按size大小输出到字符串str中 + +如果系统为wince，将使用_vsnprintf函数 + +vsnprintf ()和_vsnprintf()对于驱动程序都是可用的，但是它们有一些不同 + +在需要返回值和设置空终止符时应使用vsnprintf() + +Windows driver模式： `cs_vsnprintf_t cs_vsnprintf = cs_winkernel_vsnprintf;` + +<details><summary> 源码实现 </summary> + +```cpp +int CAPSTONE_API cs_winkernel_vsnprintf(char *buffer, size_t count, const char *format, va_list argptr) +{ + int result = _vsnprintf(buffer, count, format, argptr); + + // _vsnprintf()在字符串被截断时返回-1，在整个字符串被存储但“buffer”末尾没有“\0”时返回“count”。在这两种情况下，都需要手动添加空终止符。 + if (result == -1 || (size_t)result == count) { + buffer[count - 1] = '\0'; + } + + if (result == -1) { + // 在返回-1时，函数必须获取并返回一些本来要写入的字符。因此，通过重试使用temp buffer进行相同的转换，这个缓冲区就可能足够大来完成格式化，并且获得很多本应写入的字符。 + char* tmp = cs_winkernel_malloc(0x1000); + if (!tmp) { + return result; + } + + result = _vsnprintf(tmp, 0x1000, format, argptr); + NT_ASSERT(result != -1); + cs_winkernel_free(tmp); + } + + return result; +} +``` + +</details> + +> OSX kernel模式： `cs_vsnprintf_t cs_vsnprintf = vsnprintf;`，使用默认vsnprintf + + + +### cs_skipdata_cb_t + +`size_t (CAPSTONE_API *cs_skipdata_cb_t)(const uint8_t *code, size_t code_size, size_t offset, void *user_data);` + +SKIPDATA选项的用户自定义回调函数。 + +``` +code:包含要分解的代码的输入缓冲区。和传递给cs_disasm()的缓冲区相同。 +code_size:上面的code缓冲区的大小(以字节为单位)。 +offset:上面提到的输入缓冲区code中当前检查字节的位置。 +user_data:用户数据通过cs_opt_skipdata结构中的@user_data字段传递给cs_option()。 +return:返回要跳过的字节数，或者0表示立即停止反汇编。 +``` + +cs_skipdata_cb_t在`struct cs_opt_skipdata`中调用 + +<details><summary> 示例 </summary> + +```cpp +#include <stdio.h> +#include <stdlib.h> + +#include "platform.h" +#include "capstone.h" + +struct platform { + cs_arch arch; + cs_mode mode; + unsigned char* code; + size_t size; + const char* comment; + cs_opt_type opt_type; + cs_opt_value opt_value; + cs_opt_type opt_skipdata; + size_t skipdata; +}; + +static void print_string_hex(unsigned char* str, size_t len) //输出机器码 +{ + unsigned char* c; + + printf("Code: "); + for (c = str; c < str + len; c++) { + printf("0x%02x ", *c & 0xff); + } + printf("\n"); +} + +static void test() +{ + +#define X86_CODE32 "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x00\x91\x92" //测试用机器码 + +#define RANDOM_CODE "\xed\x00\x00\x00\x00\x1a\x5a\x0f\x1f\xff\xc2\x09\x80\x00\x00\x00\x07\xf7\xeb\x2a\xff\xff\x7f\x57\xe3\x01\xff\xff\x7f\x57\xeb\x00\xf0\x00\x00\x24\xb2\x4f\x00\x78" + + cs_opt_skipdata skipdata = { + // 把默认 "data" 描述符从 ".byte" 重命名为 "db" + "db", + }; + + struct platform platforms[2] = { //以默认描述符和自定义描述符两种方式建立一个数组 + { + CS_ARCH_X86, + CS_MODE_32, + (unsigned char*)X86_CODE32, + sizeof(X86_CODE32) - 1, + "X86 32 (Intel syntax) - Skip data", + }, + { + CS_ARCH_X86, + CS_MODE_32, + (unsigned char*)X86_CODE32, + sizeof(X86_CODE32) - 1, + "X86 32 (Intel syntax) - Skip data with custom mnemonic", + CS_OPT_INVALID, + CS_OPT_OFF, + CS_OPT_SKIPDATA_SETUP, + (size_t)& skipdata, + }, + + }; + + csh handle; //建立capstone句柄 + uint64_t address = 0x1000; //设置起始地址 + cs_insn* insn; //具体信息结构体 + cs_err err; //错误枚举 + int i; + size_t count; //成功反汇编行数 + + for (i = 0; i < sizeof(platforms) / sizeof(platforms[0]); i++) { + printf("****************\n"); + printf("Platform: %s\n", platforms[i].comment); + err = cs_open(platforms[i].arch, platforms[i].mode, &handle); //错误检查 + if (err) { + printf("Failed on cs_open() with error returned: %u\n", err); + abort(); + } + + if (platforms[i].opt_type) + cs_option(handle, platforms[i].opt_type, platforms[i].opt_value); + + // 打开SKIPDATA 模式 + cs_option(handle, CS_OPT_SKIPDATA, CS_OPT_ON); + cs_option(handle, platforms[i].opt_skipdata, platforms[i].skipdata); + + count = cs_disasm(handle, platforms[i].code, platforms[i].size, address, 0, &insn); + if (count) { + size_t j; + + print_string_hex(platforms[i].code, platforms[i].size); + printf("Disasm:\n"); + + for (j = 0; j < count; j++) { //输出汇编 + printf("0x%" PRIx64 ":\t%s\t\t%s\n", + insn[j].address, insn[j].mnemonic, insn[j].op_str); + } + + // 最后一行代码后打印偏移 + printf("0x%" PRIx64 ":\n", insn[j - 1].address + insn[j - 1].size); + + // 释放cs_disasm()申请的内存 + cs_free(insn, count); + } + else { + printf("****************\n"); + printf("Platform: %s\n", platforms[i].comment); + print_string_hex(platforms[i].code, platforms[i].size); + printf("ERROR: Failed to disasm given code!\n"); + abort(); + } + + printf("\n"); + + cs_close(&handle); + } +} + +int main() +{ + test(); + + return 0; +} +``` + +</details> + +运行结果如下，默认的.byte数据类型被改为db描述符 + + + + + + +### cs_open + +`cs_err CAPSTONE_API cs_open(cs_arch arch, cs_mode mode, csh *handle);` + +初始化cs句柄 + +``` +arch: 架构类型 (CS_ARCH_*) +mode: 硬件模式. CS_MODE_*在cs_mode数据类型中可查 +handle: 指向句柄, 返回时更新 +return: 创建成功返回CS_ERR_OK，否则返回cs_err枚举中对应的错误信息 +``` + +<details><summary> 源码实现 </summary> + +```cpp +cs_err CAPSTONE_API cs_open(cs_arch arch, cs_mode mode, csh *handle) +{ + cs_err err; + struct cs_struct *ud; + if (!cs_mem_malloc || !cs_mem_calloc || !cs_mem_realloc || !cs_mem_free || !cs_vsnprintf) + // Error: 使用cs_open()前, 必须使用cs_option(CS_OPT_MEM)进行动态内存管理的初始化 + return CS_ERR_MEMSETUP; + + if (arch < CS_ARCH_MAX && cs_arch_init[arch]) { + // 验证架构是否使用，方式：架构在枚举中且可初始化 + if (mode & cs_arch_disallowed_mode_mask[arch]) { + *handle = 0; + return CS_ERR_MODE; + } + + ud = cs_mem_calloc(1, sizeof(*ud)); + if (!ud) { + // 内存不足 + return CS_ERR_MEM; + } + + ud->errnum = CS_ERR_OK; + ud->arch = arch; + ud->mode = mode; + // 默认情况指令不打开detail模式 + ud->detail = CS_OPT_OFF; + + // 默认skipdata设置 + ud->skipdata_setup.mnemonic = SKIPDATA_MNEM; + + err = cs_arch_init[ud->arch](ud); + if (err) { + cs_mem_free(ud); + *handle = 0; + return err; + } + + *handle = (uintptr_t)ud; + + return CS_ERR_OK; + } else { + *handle = 0; + return CS_ERR_ARCH; + } +} +``` + +其中，cs_struct结构体包含更多细节设定，如下 + +```cpp +struct cs_struct { + cs_arch arch; + cs_mode mode; + Printer_t printer; // 打印asm + void *printer_info; // 打印信息 + Disasm_t disasm; // 反编译 + void *getinsn_info; // 打印辅助信息 + GetName_t reg_name; + GetName_t insn_name; + GetName_t group_name; + GetID_t insn_id; + PostPrinter_t post_printer; + cs_err errnum; + ARM_ITStatus ITBlock; // ARM特殊选项 + cs_opt_value detail, imm_unsigned; + int syntax; //ARM, Mips & PPC等架构的基本asm语法打印 + bool doing_mem; // 在InstPrinter代码中处理内存操作数 + unsigned short *insn_cache; //为mapping.c建立缓存索引 + GetRegisterName_t get_regname; + bool skipdata; // 如果反编译时要跳过数据，该项设置为True + uint8_t skipdata_size; //要跳过bytes的数量 + cs_opt_skipdata skipdata_setup; // 自定义skipdata设置 + const uint8_t *regsize_map; //映射register大小 (目前仅支持x86) + GetRegisterAccess_t reg_access; + struct insn_mnem *mnem_list; // 自定义指令助记符的链接list +}; +``` + +</details> + +示例(创建一个x86_64类型的cs句柄) + +`cs_open(CS_ARCH_X86, CS_MODE_64, &handle)` + + +### cs_close + +`cs_err CAPSTONE_API cs_close(csh *handle);` + +释放句柄 + +``` +handle: 指向一个cs_open()打开的句柄 +return: 释放成功返回CS_ERR_OK,否则返回cs_err枚举的错误信息 +``` + +释放句柄实质为将句柄值设置为0 + +<details><summary> 源码实现 </summary> + +```cpp +cs_err CAPSTONE_API cs_close(csh *handle) +{ + struct cs_struct *ud; + struct insn_mnem *next, *tmp; + + if (*handle == 0) + // 句柄不可用 + return CS_ERR_CSH; + + ud = (struct cs_struct *)(*handle); + + if (ud->printer_info) + cs_mem_free(ud->printer_info); + + // 释放自定义助记符的链接list + tmp = ud->mnem_list; + while(tmp) { + next = tmp->next; + cs_mem_free(tmp); + tmp = next; + } + + cs_mem_free(ud->insn_cache); + + memset(ud, 0, sizeof(*ud)); + cs_mem_free(ud); + + // handle值设置为0，保证这个句柄在cs_close()释放后不可使用 + *handle = 0; + + return CS_ERR_OK; +} +``` + +</details> + +示例 + +`cs_close(&handle);` + + +### cs_option + +`cs_err CAPSTONE_API cs_option(csh handle, cs_opt_type type, size_t value);` + +反编译引擎的运行时选项 + +``` +handle: cs_open()打开的句柄 +type: 设置选项的类型 +value: 与type对应的选项值 +return: 设置成功返回CS_ERR_OK,否则返回cs_err枚举的错误信息 +``` + +注意: 在CS_OPT_MEM的情况下，handle可以是任何值，因此cs_option(handle, CS_OPT_MEM, value)必须在cs_open()之前被调用 + +<details><summary> 源码实现 </summary> + +```cpp +cs_err CAPSTONE_API cs_option(csh ud, cs_opt_type type, size_t value) +{ + struct cs_struct *handle; + cs_opt_mnem *opt; + + // 支持在所有API前支持 (even cs_open()) + if (type == CS_OPT_MEM) { + cs_opt_mem *mem = (cs_opt_mem *)value; + + cs_mem_malloc = mem->malloc; + cs_mem_calloc = mem->calloc; + cs_mem_realloc = mem->realloc; + cs_mem_free = mem->free; + cs_vsnprintf = mem->vsnprintf; + + return CS_ERR_OK; + } + + handle = (struct cs_struct *)(uintptr_t)ud; + if (!handle) + return CS_ERR_CSH; + + switch(type) { + default: + break; + + case CS_OPT_UNSIGNED: + handle->imm_unsigned = (cs_opt_value)value; + return CS_ERR_OK; + + case CS_OPT_DETAIL: + handle->detail = (cs_opt_value)value; + return CS_ERR_OK; + + case CS_OPT_SKIPDATA: + handle->skipdata = (value == CS_OPT_ON); + if (handle->skipdata) { + if (handle->skipdata_size == 0) { + handle->skipdata_size = skipdata_size(handle); + } + } + return CS_ERR_OK; + + case CS_OPT_SKIPDATA_SETUP: + if (value) + handle->skipdata_setup = *((cs_opt_skipdata *)value); + return CS_ERR_OK; + + case CS_OPT_MNEMONIC: + opt = (cs_opt_mnem *)value; + if (opt->id) { + if (opt->mnemonic) { + struct insn_mnem *tmp; + + // 添加新指令或替换现有指令 + // 查看当前insn释放在list中 + tmp = handle->mnem_list; + while(tmp) { + if (tmp->insn.id == opt->id) { + // f找到指令，替换助记符 + (void)strncpy(tmp->insn.mnemonic, opt->mnemonic, sizeof(tmp->insn.mnemonic) - 1); + tmp->insn.mnemonic[sizeof(tmp->insn.mnemonic) - 1] = '\0'; + break; + } + tmp = tmp->next; + } + + // 2. 如果没有就添加这条指令 + if (!tmp) { + tmp = cs_mem_malloc(sizeof(*tmp)); + tmp->insn.id = opt->id; + (void)strncpy(tmp->insn.mnemonic, opt->mnemonic, sizeof(tmp->insn.mnemonic) - 1); + tmp->insn.mnemonic[sizeof(tmp->insn.mnemonic) - 1] = '\0'; + // 新指令放在list最前面 + tmp->next = handle->mnem_list; + handle->mnem_list = tmp; + } + return CS_ERR_OK; + } else { + struct insn_mnem *prev, *tmp; + + tmp = handle->mnem_list; + prev = tmp; + while(tmp) { + if (tmp->insn.id == opt->id) { + // 删除指令 + if (tmp == prev) { + handle->mnem_list = tmp->next; + } else { + prev->next = tmp->next; + } + cs_mem_free(tmp); + break; + } + prev = tmp; + tmp = tmp->next; + } + } + } + return CS_ERR_OK; + + case CS_OPT_MODE: + // 验证所请求的模式是否有效 + if (value & cs_arch_disallowed_mode_mask[handle->arch]) { + return CS_ERR_OPTION; + } + break; + } + + return cs_arch_option[handle->arch](handle, type, value); +} +``` +</details> + + +<details><summary> 示例，更改反汇编后显示的语法 </summary> + +```cpp +#include <iostream> +#include <stdio.h> + +#include "capstone.h" +#include "platform.h" + +using namespace std; + +#define CODE "\x55\x48\x8b\x05\xb8\x13\x00\x00" + +int main(void) +{ + csh handle; + cs_insn* insn; + size_t count; + + if (cs_open(CS_ARCH_X86, CS_MODE_64, &handle)) { + printf("ERROR: Failed to initialize engine!\n"); + return -1; + } + cs_option(handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_ATT); // 以AT&T语法显示 + count = cs_disasm(handle, (unsigned char*)CODE, sizeof(CODE) - 1, 0x1000, 0, &insn); + if (count) { + size_t j; + + for (j = 0; j < count; j++) { + printf("0x%""Ix"":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic, insn[j].op_str); + } + + cs_free(insn, count); + } + else + printf("ERROR: Failed to disassemble given code!\n"); + + cs_close(&handle); + + return 0; +} +``` + +</details> + +输出 + + + + +### cs_errno + +`cs_err CAPSTONE_API cs_errno(csh handle);` + +API出错时返回错误消息 + +``` +handle: cs_open()打开的句柄 +return: 无错误返回CS_ERR_OK,否则返回cs_err枚举的错误信息 +``` + +判断到句柄不存在直接返回CS_ERR_CSH + +<details><summary> 示例 </summary> + +```cpp +#include <iostream> +#include <stdio.h> + +#include "capstone.h" +#include "platform.h" + +using namespace std; + +#define CODE "\x55\x48\x8b\x05\xb8\x13\x00\x00" + +int main(void) +{ + csh handle = 0; + cs_insn* insn; + size_t count; + + if (cs_open(CS_ARCH_X86, CS_MODE_64, &handle)) { + printf("ERROR: Failed to initialize engine!\n"); + return -1; + } + + cs_close(&handle); + std::cout << cs_errno(handle); //关闭句柄后检查将报错 + return 0; +} +``` + +</details> + +输出，错误码4即CS_ERR_CSH + + + + +### cs_strerror + +`const char * CAPSTONE_API cs_strerror(cs_err code);` + +将上个API输出的错误码转换为详细错误信息 + +<details><summary> 源码实现 </summary> + +```cpp +const char * CAPSTONE_API cs_strerror(cs_err code) +{ + switch(code) { + default: + return "Unknown error code"; + case CS_ERR_OK: + return "OK (CS_ERR_OK)"; + case CS_ERR_MEM: + return "Out of memory (CS_ERR_MEM)"; + case CS_ERR_ARCH: + return "Invalid/unsupported architecture(CS_ERR_ARCH)"; + case CS_ERR_HANDLE: + return "Invalid handle (CS_ERR_HANDLE)"; + case CS_ERR_CSH: + return "Invalid csh (CS_ERR_CSH)"; + case CS_ERR_MODE: + return "Invalid mode (CS_ERR_MODE)"; + case CS_ERR_OPTION: + return "Invalid option (CS_ERR_OPTION)"; + case CS_ERR_DETAIL: + return "Details are unavailable (CS_ERR_DETAIL)"; + case CS_ERR_MEMSETUP: + return "Dynamic memory management uninitialized (CS_ERR_MEMSETUP)"; + case CS_ERR_VERSION: + return "Different API version between core & binding (CS_ERR_VERSION)"; + case CS_ERR_DIET: + return "Information irrelevant in diet engine (CS_ERR_DIET)"; + case CS_ERR_SKIPDATA: + return "Information irrelevant for 'data' instruction in SKIPDATA mode (CS_ERR_SKIPDATA)"; + case CS_ERR_X86_ATT: + return "AT&T syntax is unavailable (CS_ERR_X86_ATT)"; + case CS_ERR_X86_INTEL: + return "INTEL syntax is unavailable (CS_ERR_X86_INTEL)"; + case CS_ERR_X86_MASM: + return "MASM syntax is unavailable (CS_ERR_X86_MASM)"; + } +} +``` +</details> + + +<details><summary> 示例，结合cs_errno使用 </summary> + +```cpp +#include <iostream> +#include <stdio.h> + +#include "capstone.h" +#include "platform.h" + +using namespace std; + +#define CODE "\x55\x48\x8b\x05\xb8\x13\x00\x00" + +int main(void) +{ + csh handle = 0; + cs_insn* insn; + size_t count; + + if (cs_open(CS_ARCH_X86, CS_MODE_64, &handle)) { + printf("ERROR: Failed to initialize engine!\n"); + return -1; + } + + cs_close(&handle); + std::cout << cs_strerror(cs_errno(handle)); //直接输出报错信息 + return 0; +} +``` + +</details> + +输出 + + + + +### cs_disasm + +```cpp +size_t CAPSTONE_API cs_disasm(csh handle, + const uint8_t *code, size_t code_size, + uint64_t address, + size_t count, + cs_insn **insn); +``` + +给定缓冲区、大小、地址和编号，反编译机器码 + +API动态地分配内存来包含分解的指令，生成的指令将放在*insn中 + +注意： 必须释放分配的内存，以避免内存泄漏。对于需要动态分配稀缺内存的系统(如OS内核或固件)，API cs_disasm_iter()可能是比cs_disasm()更好的选择。原因是，使用cs_disasm()时，基于有限的可用内存，必须预先计算要分解多少条指令。 + +``` +handle: cs_open()返回的句柄 +code: 包含要反汇编的机器码的缓冲区。 +code_size:上面代码缓冲区的大小。 +address:给定原始代码缓冲区中的第一条指令的地址。 +insn: 由这个API填写的指令数组。注意: insn将由这个函数分配，应该用cs_free () API释放 +count: 需要分解的指令数量，或输入0分解所有指令 +return:成功反汇编指令的数量，如果该函数未能反汇编给定的代码，则为0，失败时，调用cs_errno()获取错误代码。 +``` + +<details><summary> 源码实现 </summary> + +```cpp +size_t CAPSTONE_API cs_disasm(csh ud, const uint8_t *buffer, size_t size, uint64_t offset, size_t count, cs_insn **insn) +{ + struct cs_struct *handle; + MCInst mci; + uint16_t insn_size; + size_t c = 0, i; + unsigned int f = 0; // 缓存中下一条指令的索引 + cs_insn *insn_cache; // 缓存反汇编后的指令 + void *total = NULL; + size_t total_size = 0; //所有insn的输出缓冲区的总大小 + bool r; + void *tmp; + size_t skipdata_bytes; + uint64_t offset_org; // 保存缓冲区的所有原始信息 + size_t size_org; + const uint8_t *buffer_org; + unsigned int cache_size = INSN_CACHE_SIZE; + size_t next_offset; + + handle = (struct cs_struct *)(uintptr_t)ud; + if (!handle) { + // 修复方式: + // handle->errnum = CS_ERR_HANDLE; + return 0; + } + + handle->errnum = CS_ERR_OK; + + // 重设ARM架构的IT block + if (handle->arch == CS_ARCH_ARM) + handle->ITBlock.size = 0; + +#ifdef CAPSTONE_USE_SYS_DYN_MEM + if (count > 0 && count <= INSN_CACHE_SIZE) + cache_size = (unsigned int) count; +#endif + + // 保存SKIPDATA原始偏移量 + buffer_org = buffer; + offset_org = offset; + size_org = size; + + total_size = sizeof(cs_insn) * cache_size; + total = cs_mem_malloc(total_size); + if (total == NULL) { + // 内存不足 + handle->errnum = CS_ERR_MEM; + return 0; + } + + insn_cache = total; + + while (size > 0) { + MCInst_Init(&mci); + mci.csh = handle; + + mci.address = offset; + + if (handle->detail) { + //给detail指针分配内存 + insn_cache->detail = cs_mem_malloc(sizeof(cs_detail)); + } else { + insn_cache->detail = NULL; + } + + // 为non-detailed模式保存所有信息 + mci.flat_insn = insn_cache; + mci.flat_insn->address = offset; +#ifdef CAPSTONE_DIET + //mnemonic & op_str0填充 + mci.flat_insn->mnemonic[0] = '\0'; + mci.flat_insn->op_str[0] = '\0'; +#endif + + r = handle->disasm(ud, buffer, size, &mci, &insn_size, offset, handle->getinsn_info); + if (r) { + SStream ss; + SStream_Init(&ss); + + mci.flat_insn->size = insn_size; + + //将内部指令操作码映射到公共insn ID + handle->insn_id(handle, insn_cache, mci.Opcode); + + handle->printer(&mci, &ss, handle->printer_info); + fill_insn(handle, insn_cache, ss.buffer, &mci, handle->post_printer, buffer); + + // 调整opcode (X86) + if (handle->arch == CS_ARCH_X86) + insn_cache->id += mci.popcode_adjust; + + next_offset = insn_size; + } else { + // 遇到中断指令 + + // 为detail指针释放内存 + if (handle->detail) { + cs_mem_free(insn_cache->detail); + } + + if (!handle->skipdata || handle->skipdata_size > size) + break; + + if (handle->skipdata_setup.callback) { + skipdata_bytes = handle->skipdata_setup.callback(buffer_org, size_org, + (size_t)(offset - offset_org), handle->skipdata_setup.user_data); + if (skipdata_bytes > size) + break; + + if (!skipdata_bytes) + break; + } else + skipdata_bytes = handle->skipdata_size; + + insn_cache->id = 0; + insn_cache->address = offset; + insn_cache->size = (uint16_t)skipdata_bytes; + memcpy(insn_cache->bytes, buffer, skipdata_bytes); +#ifdef CAPSTONE_DIET + insn_cache->mnemonic[0] = '\0'; + insn_cache->op_str[0] = '\0'; +#else + strncpy(insn_cache->mnemonic, handle->skipdata_setup.mnemonic, + sizeof(insn_cache->mnemonic) - 1); + skipdata_opstr(insn_cache->op_str, buffer, skipdata_bytes); +#endif + insn_cache->detail = NULL; + + next_offset = skipdata_bytes; + } + + // 一条新指令进入缓存 + f++; + + // 反汇编了一条指令 + c++; + if (count > 0 && c == count) + break; + + if (f == cache_size) { + cache_size = cache_size * 8 / 5; + total_size += (sizeof(cs_insn) * cache_size); + tmp = cs_mem_realloc(total, total_size); + if (tmp == NULL) { //内存不足 + if (handle->detail) { + insn_cache = (cs_insn *)total; + for (i = 0; i < c; i++, insn_cache++) + cs_mem_free(insn_cache->detail); + } + + cs_mem_free(total); + *insn = NULL; + handle->errnum = CS_ERR_MEM; + return 0; + } + + total = tmp; + //在最后一条指令之后继续填充缓存 + insn_cache = (cs_insn *)((char *)total + sizeof(cs_insn) * c); + + // 将f重置为0，从一开始就填入缓存 + f = 0; + } else + insn_cache++; + + buffer += next_offset; + size -= next_offset; + offset += next_offset; + } + + if (!c) { + //未反汇编任何指令 + cs_mem_free(total); + total = NULL; + } else if (f != cache_size) { + // 没有完全使用最后一个缓存，缩小大小 + tmp = cs_mem_realloc(total, total_size - (cache_size - f) * sizeof(*insn_cache)); + if (tmp == NULL) { // 内存不足 + // 释放所有detail指针 + if (handle->detail) { + insn_cache = (cs_insn *)total; + for (i = 0; i < c; i++, insn_cache++) + cs_mem_free(insn_cache->detail); + } + + cs_mem_free(total); + *insn = NULL; + + handle->errnum = CS_ERR_MEM; + return 0; + } + + total = tmp; + } + + *insn = total; + + return c; +} +``` + +</details> + + +<details><summary> 示例，x86_64 </summary> + +```cpp +#include <iostream> +#include <stdio.h> + +#include "capstone.h" +#include "platform.h" + +using namespace std; + +#define CODE "\x55\x48\x8b\x05\xb8\x13\x00\x00\xe9\xea\xbe\xad\xde\xff\x25\x23\x01\x00\x00\xe8\xdf\xbe\xad\xde\x74\xff" + +int main(void) +{ + csh handle = 0; + cs_insn* insn; + size_t count; + + if (cs_open(CS_ARCH_X86, CS_MODE_64, &handle)) { + printf("ERROR: Failed to initialize engine!\n"); + return -1; + } + + count = cs_disasm(handle, (unsigned char*)CODE, sizeof(CODE) - 1, 0x1000, 0, &insn); //所有指令，基址0x1000，放入insn + if (count) { + size_t j; + + for (j = 0; j < count; j++) { + printf("0x%""Ix"":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic, insn[j].op_str); + } + + cs_free(insn, count); + } + else + printf("ERROR: Failed to disassemble given code!\n"); + + cs_close(&handle); + + return 0; +} +``` + +</details> + +输出 + + + + +### cs_free + +`void CAPSTONE_API cs_free(cs_insn *insn, size_t count);` + +释放被 cs_malloc() 或 cs_disasm() 分配的内存(insn参数) + +``` +insn: 由cs_disasm()或cs_malloc()中的@insn参数返回的指针 +count: 赋值由cs_disasm()返回的cs_insn结构的数量，或赋值为1表示由cs_malloc()分配给空闲内存的数量 +``` + +<details><summary> 源码实现 </summary> + +```cpp +void CAPSTONE_API cs_free(cs_insn *insn, size_t count) +{ + size_t i; + + // free 所有 detail 指针 + for (i = 0; i < count; i++) + cs_mem_free(insn[i].detail); + + cs_mem_free(insn); +} +``` + +直接调用cs_mem_free,也就是默认的free + +</details> + + +<details><summary> 示例(释放cs_disasm申请的内存) </summary> + +```cpp + count = cs_disasm(handle, (unsigned char*)CODE, sizeof(CODE) - 1, 0x1000, 0, &insn); //计数由cs_disasm申请的内存 + if (count) { + size_t j; + + for (j = 0; j < count; j++) { + printf("0x%""Ix"":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic, insn[j].op_str); + } + + cs_free(insn, count); //循环依次释放每条insn的内存 + } +``` + +</details> + + +### cs_malloc + +`cs_insn * CAPSTONE_API cs_malloc(csh handle);` + +被用于在API cs_disasm_iter()中为一条指令分配内存 + +``` +handle: cs_open()返回的句柄 +``` + +<details><summary> 源码实现 </summary> + +```cpp +cs_insn * CAPSTONE_API cs_malloc(csh ud) +{ + cs_insn *insn; + struct cs_struct *handle = (struct cs_struct *)(uintptr_t)ud; + + insn = cs_mem_malloc(sizeof(cs_insn)); + if (!insn) { + // insufficient memory + handle->errnum = CS_ERR_MEM; + return NULL; + } else { + if (handle->detail) { + // allocate memory for @detail pointer + insn->detail = cs_mem_malloc(sizeof(cs_detail)); + if (insn->detail == NULL) { // insufficient memory + cs_mem_free(insn); + handle->errnum = CS_ERR_MEM; + return NULL; + } + } else + insn->detail = NULL; + } + + return insn; +} +``` + +</details> + +当这条指令所占的内存不再使用时，使用cs_free(insn, 1)释放，示例在下面cs_disasm_iter处 + + +### cs_disasm_iter + +```cpp +bool CAPSTONE_API cs_disasm_iter(csh handle, + const uint8_t **code, size_t *size, + uint64_t *address, cs_insn *insn); +``` + +给定buff、大小、地址和要解码的指令数，更快速的反汇编机器码， +这个API将生成的指令放入insn中的给定的缓存中。 + +注意1: 此API将更新code、size和address以指向输入缓冲区中的下一条指令。所以，虽然每次反汇编一条指令可以使用cs_disasm(count=1)来实现，但一些基准测试显示，在循环中使用cs_disasm_iter()可以方便地快速迭代所有指令，在随机输入时可以快30%。 + +注意2:可以使用cs_malloc()创建insn中的缓存。 + +注意3:对于动态分配内存可能产生内存不足的系统(比如OS内核或固件)，建议使用cs_disasm()这个API, 因为cs_disasm()是根据要分解的指令的数量来分配内存。 + +``` +handle: cs_open()返回的句柄 +code: 要反汇编的机器码所在的缓冲区 +size: 机器码缓冲区的大小 +address: 所给机器码缓冲区中第一个insn的地址 +insn: 指向这个API要填充的指令的指针。 +return:如果这个API成功反汇编了一条指令返回true，否则将返回false。 +``` + +失败时，调用cs_errno()获取错误代码。 + +<details><summary> 代码实现，在cs_disasm基础上使用动态内存分配 </summary> + +```cpp +bool CAPSTONE_API cs_disasm_iter(csh ud, const uint8_t **code, size_t *size, + uint64_t *address, cs_insn *insn) +{ + struct cs_struct *handle; + uint16_t insn_size; + MCInst mci; + bool r; + + handle = (struct cs_struct *)(uintptr_t)ud; + if (!handle) { + return false; + } + + handle->errnum = CS_ERR_OK; + + MCInst_Init(&mci); + mci.csh = handle; + + mci.address = *address; + + // 为无detail模式保存相关信息 + mci.flat_insn = insn; + mci.flat_insn->address = *address; +#ifdef CAPSTONE_DIET + mci.flat_insn->mnemonic[0] = '\0'; + mci.flat_insn->op_str[0] = '\0'; +#endif + + r = handle->disasm(ud, *code, *size, &mci, &insn_size, *address, handle->getinsn_info); + if (r) { + SStream ss; + SStream_Init(&ss); + + mci.flat_insn->size = insn_size; + + // 将内部指令操作码映射到公共insn ID + handle->insn_id(handle, insn, mci.Opcode); + + handle->printer(&mci, &ss, handle->printer_info); + + fill_insn(handle, insn, ss.buffer, &mci, handle->post_printer, *code); + + // 调整伪操作码(X86) + if (handle->arch == CS_ARCH_X86) + insn->id += mci.popcode_adjust; + + *code += insn_size; + *size -= insn_size; + *address += insn_size; + } else { // 遇到中断指令 + size_t skipdata_bytes; + + // 如果没有跳过数据的请求，或者剩余数据太小，则退出 + if (!handle->skipdata || handle->skipdata_size > *size) + return false; + + if (handle->skipdata_setup.callback) { + skipdata_bytes = handle->skipdata_setup.callback(*code, *size, + 0, handle->skipdata_setup.user_data); + if (skipdata_bytes > *size) + // 剩余数据太小 + return false; + + if (!skipdata_bytes) + return false; + } else + skipdata_bytes = handle->skipdata_size; + + // 基于架构和模式跳过一些数据 + insn->id = 0; // 此“数据”指令的ID无效 + insn->address = *address; + insn->size = (uint16_t)skipdata_bytes; +#ifdef CAPSTONE_DIET + insn->mnemonic[0] = '\0'; + insn->op_str[0] = '\0'; +#else + memcpy(insn->bytes, *code, skipdata_bytes); + strncpy(insn->mnemonic, handle->skipdata_setup.mnemonic, + sizeof(insn->mnemonic) - 1); + skipdata_opstr(insn->op_str, *code, skipdata_bytes); +#endif + + *code += skipdata_bytes; + *size -= skipdata_bytes; + *address += skipdata_bytes; + } + + return true; +} +``` + +</details> + + +<details><summary> 示例 </summary> + +```cpp +#include <iostream> +#include <stdio.h> + +#include "capstone.h" +#include "platform.h" + +using namespace std; + +struct platform { + cs_arch arch; + cs_mode mode; + unsigned char* code; + size_t size; + const char* comment; + cs_opt_type opt_type; + cs_opt_value opt_value; +}; + +static void print_string_hex(unsigned char* str, size_t len) +{ + unsigned char* c; + + printf("Code: "); + for (c = str; c < str + len; c++) { + printf("0x%02x ", *c & 0xff); + } + printf("\n"); +} + +static void test() +{ +#define X86_CODE16 "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00" +#define X86_CODE32 "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00" +#define X86_CODE64 "\x55\x48\x8b\x05\xb8\x13\x00\x00" + + struct platform platforms[4] = { //架构及模式 + { + CS_ARCH_X86, + CS_MODE_16, + (unsigned char*)X86_CODE16, + sizeof(X86_CODE32) - 1, + "X86 16bit (Intel syntax)" + }, + { + CS_ARCH_X86, + CS_MODE_32, + (unsigned char*)X86_CODE32, + sizeof(X86_CODE32) - 1, + "X86 32bit (ATT syntax)", + CS_OPT_SYNTAX, + CS_OPT_SYNTAX_ATT, + }, + { + CS_ARCH_X86, + CS_MODE_32, + (unsigned char*)X86_CODE32, + sizeof(X86_CODE32) - 1, + "X86 32 (Intel syntax)" + }, + { + CS_ARCH_X86, + CS_MODE_64, + (unsigned char*)X86_CODE64, + sizeof(X86_CODE64) - 1, + "X86 64 (Intel syntax)" + }, + + csh handle; + uint64_t address; + cs_insn* insn; + cs_detail* detail; + int i; + cs_err err; + const uint8_t* code; + size_t size; + + for (i = 0; i < sizeof(platforms) / sizeof(platforms[0]); i++) { + printf("****************\n"); + printf("Platform: %s\n", platforms[i].comment); + err = cs_open(platforms[i].arch, platforms[i].mode, &handle); + if (err) { + printf("Failed on cs_open() with error returned: %u\n", err); + abort(); + } + + if (platforms[i].opt_type) + cs_option(handle, platforms[i].opt_type, platforms[i].opt_value); + + cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON); + + // 为cs_disasm_iter()分配内存 + insn = cs_malloc(handle); + + print_string_hex(platforms[i].code, platforms[i].size); //原机器码 + printf("Disasm:\n"); + + address = 0x1000; + code = platforms[i].code; + size = platforms[i].size; + while (cs_disasm_iter(handle, &code, &size, &address, insn)) { //cs_disasm_iter反汇编 + int n; + + printf("0x%" PRIx64 ":\t%s\t\t%s // insn-ID: %u, insn-mnem: %s\n", + insn->address, insn->mnemonic, insn->op_str, + insn->id, cs_insn_name(handle, insn->id)); + + // 打印此指令使用的隐式寄存器 + detail = insn->detail; + + if (detail->regs_read_count > 0) { + printf("\tImplicit registers read: "); + for (n = 0; n < detail->regs_read_count; n++) { + printf("%s ", cs_reg_name(handle, detail->regs_read[n])); + } + printf("\n"); + } + + // 打印此指令修改的隐式寄存器 + if (detail->regs_write_count > 0) { + printf("\tImplicit registers modified: "); + for (n = 0; n < detail->regs_write_count; n++) { + printf("%s ", cs_reg_name(handle, detail->regs_write[n])); + } + printf("\n"); + } + + // 打印此指令所属指令集 + if (detail->groups_count > 0) { + printf("\tThis instruction belongs to groups: "); + for (n = 0; n < detail->groups_count; n++) { + printf("%s ", cs_group_name(handle, detail->groups[n])); + } + printf("\n"); + } + } + + printf("\n"); + + // 释放cs_malloc()分配的内存 + cs_free(insn, 1); + + cs_close(&handle); + } +} + +int main() +{ + test(); + + return 0; +} +``` + +</details> + +输出 + + + + +### cs_reg_name + +`const char * CAPSTONE_API cs_reg_name(csh handle, unsigned int reg_id);` + +获取寄存器的名字(string类型) +寄存器id可在相关架构的头文件(建立项目时复制到项目文件夹的那些头文件)内找到 + +注意： 当处于diet模式时此API不可用，因为引擎不会存储寄存器名 + +``` +handle: cs_open()返回的句柄 +reg_id: 寄存器id +return: 寄存器的字符名, 如果reg_id不可用返回NULL +``` + +<details><summary> 源码实现 </summary> + +```cpp +const char * CAPSTONE_API cs_reg_name(csh ud, unsigned int reg) +{ + struct cs_struct *handle = (struct cs_struct *)(uintptr_t)ud; + + if (!handle || handle->reg_name == NULL) { + return NULL; + } + + return handle->reg_name(ud, reg); +} +``` + +</details> + + +<details><summary> 示例(打印RAX) </summary> + +```cpp +#include <iostream> +#include <stdio.h> + +#include "capstone.h" +#include "platform.h" + +using namespace std; + +int main(void) +{ + csh handle = 0; + cs_insn* insn; + size_t count; + + if (cs_open(CS_ARCH_X86, CS_MODE_64, &handle)) { + printf("ERROR: Failed to initialize engine!\n"); + return -1; + } + + printf("%s", cs_reg_name(handle, X86_REG_RAX)); + cs_close(&handle); + + return 0; +} +``` + +</details> + +输出 + + + + +### cs_insn_name + +`const char * CAPSTONE_API cs_insn_name(csh handle, unsigned int insn_id);` + +获取指令的名字(string类型) + +指令id可在相关架构的头文件(建立项目时复制到项目文件夹的那些头文件)内找到 + +注意： 当处于diet模式时此API不可用，因为引擎不会存储寄存器名 + +``` +handle: cs_open()返回的句柄 +insn_id: 指令id +return: 指令的字符名, 如果insn_id不可用返回NULL +``` + +<details><summary> 源码实现 </summary> + +```cpp +const char * CAPSTONE_API cs_insn_name(csh ud, unsigned int insn) +{ + struct cs_struct *handle = (struct cs_struct *)(uintptr_t)ud; + + if (!handle || handle->insn_name == NULL) { + return NULL; + } + + return handle->insn_name(ud, insn); +} +``` + +</details> + + +<details><summary> 示例 </summary> + +```cpp +#include <iostream> +#include <stdio.h> + +#include "capstone.h" +#include "platform.h" + +using namespace std; + +struct platform { + cs_arch arch; + cs_mode mode; + unsigned char* code; + size_t size; + const char* comment; + cs_opt_type opt_type; + cs_opt_value opt_value; +}; + +static void print_string_hex(unsigned char* str, size_t len) +{ + unsigned char* c; + + printf("Code: "); + for (c = str; c < str + len; c++) { + printf("0x%02x ", *c & 0xff); + } + printf("\n"); +} + +static void test() +{ + +#define X86_CODE64 "\x55\x48\x8b\x05\xb8\x13\x00\x00\xe9\xea\xbe\xad\xde\xff\x25\x23\x01\x00\x00\xe8\xdf\xbe\xad\xde\x74\xff" + + struct platform platforms[] = { + { + CS_ARCH_X86, + CS_MODE_64, + (unsigned char*)X86_CODE64, + sizeof(X86_CODE64) - 1, + "X86 64 (Intel syntax)" + }, + }; + + csh handle; + uint64_t address; + cs_insn* insn; + cs_detail* detail; + int i; + cs_err err; + const uint8_t* code; + size_t size; + + for (i = 0; i < sizeof(platforms) / sizeof(platforms[0]); i++) { + printf("****************\n"); + printf("Platform: %s\n", platforms[i].comment); + err = cs_open(platforms[i].arch, platforms[i].mode, &handle); + if (err) { + printf("Failed on cs_open() with error returned: %u\n", err); + abort(); + } + + if (platforms[i].opt_type) + cs_option(handle, platforms[i].opt_type, platforms[i].opt_value); + + cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON); + + insn = cs_malloc(handle); + + print_string_hex(platforms[i].code, platforms[i].size); + printf("Disasm:\n"); + + address = 0x1000; + code = platforms[i].code; + size = platforms[i].size; + while (cs_disasm_iter(handle, &code, &size, &address, insn)) { + int n; + + printf("0x%" PRIx64 ":\t%s\t\t%s", + insn->address, insn->mnemonic, insn->op_str); + printf(" instruction: %s", cs_insn_name(handle, insn->id)); //输出该行的操作指令 + cout << endl; + + printf("\n"); + cs_free(insn, 1); + cs_close(&handle); + } +} + +int main() +{ + test(); + + return 0; +} +``` + +</details> + +输出 + + + + +### cs_group_name + +`const char * CAPSTONE_API cs_group_name(csh handle, unsigned int group_id);` + +输出指令类型名字 + +指令id可在相关架构的头文件(建立项目时复制到项目文件夹的那些头文件)内找到 + +注意： 当处于diet模式时此API不可用，因为引擎不会存储寄存器名 + +``` +handle: cs_open()返回的句柄 +insn_id: 指令类型id +return: 指令类型的字符名, 如果insn_id不可用返回NULL +``` + +示例都与上面类似，略。 + + +### cs_insn_group + +`bool CAPSTONE_API cs_insn_group(csh handle, const cs_insn *insn, unsigned int group_id);` + +检查反汇编后的指令是否属于某个特定指令类型 + +注意：只有当detail选项为ON时这个API可用 (默认OFF). + +在“diet”模式下，此API没有用，因为引擎不更新insn->groups数组 + +``` +handle: cs_open()返回的句柄 +insn: 从cs_disasm()或cs_disasm_iter()接收的反汇编指令结构 +group_id: 要检查此指令是否属于的指令类型。 +return: 如果该指令确实属于给定的指令类型，则为true，否则为false。 +``` + +<details><summary> 源码实现 </summary> + +```cpp +bool CAPSTONE_API cs_insn_group(csh ud, const cs_insn *insn, unsigned int group_id) +{ + struct cs_struct *handle; + if (!ud) + return false; + + handle = (struct cs_struct *)(uintptr_t)ud; + + if (!handle->detail) { + handle->errnum = CS_ERR_DETAIL; + return false; + } + + if (!insn->id) { + handle->errnum = CS_ERR_SKIPDATA; + return false; + } + + if (!insn->detail) { + handle->errnum = CS_ERR_DETAIL; + return false; + } + + return arr_exist8(insn->detail->groups, insn->detail->groups_count, group_id); +} +``` + +</details> + + +<details><summary> 示例(判断是否属于跳转指令) </summary> + +```cpp +#include <iostream> +#include <stdio.h> + +#include "capstone.h" +#include "platform.h" + +using namespace std; + +struct platform { + cs_arch arch; + cs_mode mode; + unsigned char* code; + size_t size; + const char* comment; + cs_opt_type opt_type; + cs_opt_value opt_value; +}; + +static void print_string_hex(unsigned char* str, size_t len) +{ + unsigned char* c; + + printf("Code: "); + for (c = str; c < str + len; c++) { + printf("0x%02x ", *c & 0xff); + } + printf("\n"); +} + +static void test() +{ + +#define X86_CODE64 "\x55\x48\x8b\x05\xb8\x13\x00\x00\xe9\xea\xbe\xad\xde\xff\x25\x23\x01\x00\x00\xe8\xdf\xbe\xad\xde\x74\xff" + + struct platform platforms[] = { + { + CS_ARCH_X86, + CS_MODE_64, + (unsigned char*)X86_CODE64, + sizeof(X86_CODE64) - 1, + "X86 64 (Intel syntax)" + }, + }; + + csh handle; + uint64_t address; + cs_insn* insn; + cs_detail* detail; + int i; + cs_err err; + const uint8_t* code; + size_t size; + + for (i = 0; i < sizeof(platforms) / sizeof(platforms[0]); i++) { + printf("****************\n"); + printf("Platform: %s\n", platforms[i].comment); + err = cs_open(platforms[i].arch, platforms[i].mode, &handle); + if (err) { + printf("Failed on cs_open() with error returned: %u\n", err); + abort(); + } + + if (platforms[i].opt_type) + cs_option(handle, platforms[i].opt_type, platforms[i].opt_value); + + cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON); + + insn = cs_malloc(handle); + + print_string_hex(platforms[i].code, platforms[i].size); + printf("Disasm:\n"); + + address = 0x1000; + code = platforms[i].code; + size = platforms[i].size; + while (cs_disasm_iter(handle, &code, &size, &address, insn)) { + int n; + + printf("0x%" PRIx64 ":\t%s\t\t%s ", + insn->address, insn->mnemonic, insn->op_str); + cout << "is JUMP: " <<cs_insn_group(handle, insn, CS_GRP_JUMP) << endl; //判断是否为跳转指令 + cout << endl; + + printf("\n"); + cs_free(insn, 1); + cs_close(&handle); + } +} + +int main() +{ + test(); + + return 0; +} +``` + +</details> + +输出 + + + + +### cs_reg_read + +`bool CAPSTONE_API cs_reg_read(csh handle, const cs_insn *insn, unsigned int reg_id);` + +检查反汇编指令是否隐式使用特定寄存器。 + +注意:此API仅在启用detail选项时有效(默认为关闭) + +在“diet”模式下，此API没有用，因为引擎不更新insn->regs_read数组 + +``` +insn: 从cs_disasm()或cs_disasm_iter()接收的反汇编指令结构 +reg_id: 标注想要检查的这个指令是否使用了它。 +return: 如果该指令确实隐式使用了给定寄存器，则为true，否则为false。 +``` + +<details><summary> 源码实现 </summary> + +```cpp +bool CAPSTONE_API cs_reg_read(csh ud, const cs_insn *insn, unsigned int reg_id) +{ + struct cs_struct *handle; + if (!ud) + return false; + + handle = (struct cs_struct *)(uintptr_t)ud; + + if (!handle->detail) { + handle->errnum = CS_ERR_DETAIL; + return false; + } + + if (!insn->id) { + handle->errnum = CS_ERR_SKIPDATA; + return false; + } + + if (!insn->detail) { + handle->errnum = CS_ERR_DETAIL; + return false; + } + + return arr_exist(insn->detail->regs_read, insn->detail->regs_read_count, reg_id); +} +``` +</details> + +示例同API cs_disasm_iter + + +### cs_reg_write + +`bool CAPSTONE_API cs_reg_write(csh handle, const cs_insn *insn, unsigned int reg_id);` + +检查反汇编指令是否隐式修改了特定寄存器。 + +注意:此API仅在启用detail选项时有效(默认为关闭) + +在“diet”模式下，此API没有用，因为引擎不更新insn->regs_read数组 + +``` +insn: 从cs_disasm()或cs_disasm_iter()接收的反汇编指令结构 +reg_id: 标注想要检查的这个指令是否修改了它。 +return: 如果该指令确实隐式修改了给定寄存器，则为true，否则为false。 +``` + +<details><summary> 源码实现 </summary> + +```cpp +bool CAPSTONE_API cs_reg_write(csh ud, const cs_insn *insn, unsigned int reg_id) +{ + struct cs_struct *handle; + if (!ud) + return false; + + handle = (struct cs_struct *)(uintptr_t)ud; + + if (!handle->detail) { + handle->errnum = CS_ERR_DETAIL; + return false; + } + + if (!insn->id) { + handle->errnum = CS_ERR_SKIPDATA; + return false; + } + + if (!insn->detail) { + handle->errnum = CS_ERR_DETAIL; + return false; + } + + return arr_exist(insn->detail->regs_write, insn->detail->regs_write_count, reg_id); +} +``` +</details> + +示例同API cs_disasm_iter + + +### cs_op_count + +`int CAPSTONE_API cs_op_count(csh handle, const cs_insn *insn, unsigned int op_type);` + +计算给定类型的操作数的数量 + +注意：只有当detail选项为ON时这个API可用 (默认OFF). + +``` +handle: cs_open()返回的句柄 +insn: 从cs_disasm()或cs_disasm_iter()接收的反汇编指令结构 +op_type: 要找到的操作数类型。 +return: 指令insn中给定类型op_type的操作数的数量，返回-1表示查找失败。 +``` + +<details><summary> 源码实现 </summary> + +```cpp +int CAPSTONE_API cs_op_count(csh ud, const cs_insn *insn, unsigned int op_type) +{ + struct cs_struct *handle; + unsigned int count = 0, i; + if (!ud) + return -1; + + handle = (struct cs_struct *)(uintptr_t)ud; + + if (!handle->detail) { + handle->errnum = CS_ERR_DETAIL; + return -1; + } + + if (!insn->id) { + handle->errnum = CS_ERR_SKIPDATA; + return -1; + } + + if (!insn->detail) { + handle->errnum = CS_ERR_DETAIL; + return -1; + } + + handle->errnum = CS_ERR_OK; + + switch (handle->arch) { + default: + handle->errnum = CS_ERR_HANDLE; + return -1; + case CS_ARCH_ARM: + for (i = 0; i < insn->detail->arm.op_count; i++) + if (insn->detail->arm.operands[i].type == (arm_op_type)op_type) + count++; + break; + case CS_ARCH_ARM64: + for (i = 0; i < insn->detail->arm64.op_count; i++) + if (insn->detail->arm64.operands[i].type == (arm64_op_type)op_type) + count++; + break; + case CS_ARCH_X86: + for (i = 0; i < insn->detail->x86.op_count; i++) + if (insn->detail->x86.operands[i].type == (x86_op_type)op_type) + count++; + break; + case CS_ARCH_MIPS: + for (i = 0; i < insn->detail->mips.op_count; i++) + if (insn->detail->mips.operands[i].type == (mips_op_type)op_type) + count++; + break; + case CS_ARCH_PPC: + for (i = 0; i < insn->detail->ppc.op_count; i++) + if (insn->detail->ppc.operands[i].type == (ppc_op_type)op_type) + count++; + break; + case CS_ARCH_SPARC: + for (i = 0; i < insn->detail->sparc.op_count; i++) + if (insn->detail->sparc.operands[i].type == (sparc_op_type)op_type) + count++; + break; + case CS_ARCH_SYSZ: + for (i = 0; i < insn->detail->sysz.op_count; i++) + if (insn->detail->sysz.operands[i].type == (sysz_op_type)op_type) + count++; + break; + case CS_ARCH_XCORE: + for (i = 0; i < insn->detail->xcore.op_count; i++) + if (insn->detail->xcore.operands[i].type == (xcore_op_type)op_type) + count++; + break; + case CS_ARCH_M68K: + for (i = 0; i < insn->detail->m68k.op_count; i++) + if (insn->detail->m68k.operands[i].type == (m68k_op_type)op_type) + count++; + break; + case CS_ARCH_TMS320C64X: + for (i = 0; i < insn->detail->tms320c64x.op_count; i++) + if (insn->detail->tms320c64x.operands[i].type == (tms320c64x_op_type)op_type) + count++; + break; + case CS_ARCH_M680X: + for (i = 0; i < insn->detail->m680x.op_count; i++) + if (insn->detail->m680x.operands[i].type == (m680x_op_type)op_type) + count++; + break; + case CS_ARCH_EVM: +#if 0 + for (i = 0; i < insn->detail->evm.op_count; i++) + if (insn->detail->evm.operands[i].type == (evm_op_type)op_type) + count++; +#endif + break; + } + + return count; +} +``` + +</details> + + +<details><summary> x86指令操作码类型示例(判断寄存操作码) </summary> + +```cpp +typedef enum x86_op_type { + X86_OP_INVALID = 0, ///< = CS_OP_INVALID (未初始化). + X86_OP_REG, ///< = CS_OP_REG (寄存操作码). + X86_OP_IMM, ///< = CS_OP_IMM (立即操作码). + X86_OP_MEM, ///< = CS_OP_MEM (内存操作码). +} x86_op_type; +``` + +```cpp +#include <iostream> +#include <stdio.h> + +#include "capstone.h" +#include "platform.h" + +using namespace std; + +struct platform { + cs_arch arch; + cs_mode mode; + unsigned char* code; + size_t size; + const char* comment; + cs_opt_type opt_type; + cs_opt_value opt_value; +}; + +static void print_string_hex(unsigned char* str, size_t len) +{ + unsigned char* c; + + printf("Code: "); + for (c = str; c < str + len; c++) { + printf("0x%02x ", *c & 0xff); + } + printf("\n"); +} + +static void test() +{ + +#define X86_CODE64 "\x55\x48\x8b\x05\xb8\x13\x00\x00\xe9\xea\xbe\xad\xde\xff\x25\x23\x01\x00\x00\xe8\xdf\xbe\xad\xde\x74\xff" + + struct platform platforms[] = { + { + CS_ARCH_X86, + CS_MODE_64, + (unsigned char*)X86_CODE64, + sizeof(X86_CODE64) - 1, + "X86 64 (Intel syntax)" + }, + }; + + csh handle; + uint64_t address; + cs_insn* insn; + cs_detail* detail; + int i; + cs_err err; + const uint8_t* code; + size_t size; + + for (i = 0; i < sizeof(platforms) / sizeof(platforms[0]); i++) { + printf("****************\n"); + printf("Platform: %s\n", platforms[i].comment); + err = cs_open(platforms[i].arch, platforms[i].mode, &handle); + if (err) { + printf("Failed on cs_open() with error returned: %u\n", err); + abort(); + } + + if (platforms[i].opt_type) + cs_option(handle, platforms[i].opt_type, platforms[i].opt_value); + + cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON); + + insn = cs_malloc(handle); + + print_string_hex(platforms[i].code, platforms[i].size); + printf("Disasm:\n"); + + address = 0x1000; + code = platforms[i].code; + size = platforms[i].size; + while (cs_disasm_iter(handle, &code, &size, &address, insn)) { + int n; + + printf("0x%" PRIx64 ":\t%s\t\t%s ", + insn->address, insn->mnemonic, insn->op_str); + cout << "is REG: " << cs_op_count(handle, insn, X86_OP_REG) << endl; //判断是否为寄存操作码 + cout << endl; + + printf("\n"); + cs_free(insn, 1); + cs_close(&handle); + } +} + +int main() +{ + test(); + + return 0; +} +``` + +</details> + +输出 + + + + +### cs_op_index + +`int CAPSTONE_API cs_op_index(csh handle, const cs_insn *insn, unsigned int op_type, unsigned int position);` + +检索给定类型的操作数在`<arch>.operands[]`数组中的位置, 使用返回的位置访问操作数 + +注意：只有当detail选项为ON时这个API可用 (默认OFF). + +``` +handle: cs_open()返回的句柄 +insn: 从cs_disasm()或cs_disasm_iter()接收的反汇编指令结构 +op_type: 要找到的操作数类型。 +position: 要查找的操作数的位置。范围一定在`[1, cs_op_count(handle, insn, op_type)]`内 +return: 指令insn的`<arch>.operands[]`数组中给定类型op_type的操作数的索引，失败时返回-1。 +``` + +<details><summary> 源码实现 </summary> + +```cpp +int CAPSTONE_API cs_op_index(csh ud, const cs_insn *insn, unsigned int op_type, + unsigned int post) +{ + struct cs_struct *handle; + unsigned int count = 0, i; + if (!ud) + return -1; + + handle = (struct cs_struct *)(uintptr_t)ud; + + if (!handle->detail) { + handle->errnum = CS_ERR_DETAIL; + return -1; + } + + if (!insn->id) { + handle->errnum = CS_ERR_SKIPDATA; + return -1; + } + + if (!insn->detail) { + handle->errnum = CS_ERR_DETAIL; + return -1; + } + + handle->errnum = CS_ERR_OK; + + switch (handle->arch) { + default: + handle->errnum = CS_ERR_HANDLE; + return -1; + case CS_ARCH_ARM: + for (i = 0; i < insn->detail->arm.op_count; i++) { + if (insn->detail->arm.operands[i].type == (arm_op_type)op_type) + count++; + if (count == post) + return i; + } + break; + case CS_ARCH_ARM64: + for (i = 0; i < insn->detail->arm64.op_count; i++) { + if (insn->detail->arm64.operands[i].type == (arm64_op_type)op_type) + count++; + if (count == post) + return i; + } + break; + case CS_ARCH_X86: + for (i = 0; i < insn->detail->x86.op_count; i++) { + if (insn->detail->x86.operands[i].type == (x86_op_type)op_type) + count++; + if (count == post) + return i; + } + break; + case CS_ARCH_MIPS: + for (i = 0; i < insn->detail->mips.op_count; i++) { + if (insn->detail->mips.operands[i].type == (mips_op_type)op_type) + count++; + if (count == post) + return i; + } + break; + case CS_ARCH_PPC: + for (i = 0; i < insn->detail->ppc.op_count; i++) { + if (insn->detail->ppc.operands[i].type == (ppc_op_type)op_type) + count++; + if (count == post) + return i; + } + break; + case CS_ARCH_SPARC: + for (i = 0; i < insn->detail->sparc.op_count; i++) { + if (insn->detail->sparc.operands[i].type == (sparc_op_type)op_type) + count++; + if (count == post) + return i; + } + break; + case CS_ARCH_SYSZ: + for (i = 0; i < insn->detail->sysz.op_count; i++) { + if (insn->detail->sysz.operands[i].type == (sysz_op_type)op_type) + count++; + if (count == post) + return i; + } + break; + case CS_ARCH_XCORE: + for (i = 0; i < insn->detail->xcore.op_count; i++) { + if (insn->detail->xcore.operands[i].type == (xcore_op_type)op_type) + count++; + if (count == post) + return i; + } + break; + case CS_ARCH_M68K: + for (i = 0; i < insn->detail->m68k.op_count; i++) { + if (insn->detail->m68k.operands[i].type == (m68k_op_type)op_type) + count++; + if (count == post) + return i; + } + break; + case CS_ARCH_TMS320C64X: + for (i = 0; i < insn->detail->tms320c64x.op_count; i++) { + if (insn->detail->tms320c64x.operands[i].type == (tms320c64x_op_type)op_type) + count++; + if (count == post) + return i; + } + break; + case CS_ARCH_M680X: + for (i = 0; i < insn->detail->m680x.op_count; i++) { + if (insn->detail->m680x.operands[i].type == (m680x_op_type)op_type) + count++; + if (count == post) + return i; + } + break; + } + + return -1; +} +``` +</details> + + +<details><summary> 示例 </summary> + +```cpp +#include <iostream> +#include <stdio.h> + +#include "capstone.h" +#include "platform.h" + +using namespace std; + +struct platform { + cs_arch arch; + cs_mode mode; + unsigned char* code; + size_t size; + const char* comment; + cs_opt_type opt_type; + cs_opt_value opt_value; +}; + +static void print_string_hex(unsigned char* str, size_t len) +{ + unsigned char* c; + + printf("Code: "); + for (c = str; c < str + len; c++) { + printf("0x%02x ", *c & 0xff); + } + printf("\n"); +} + +static void test() +{ +#define X86_CODE64 "\x55\x48\x8b\x05\xb8\x13\x00\x00\xe9\xea\xbe\xad\xde\xff\x25\x23\x01\x00\x00\xe8\xdf\xbe\xad\xde\x74\xff" + struct platform platforms[] = { + { + CS_ARCH_X86, + CS_MODE_64, + (unsigned char*)X86_CODE64, + sizeof(X86_CODE64) - 1, + "X86 64 (Intel syntax)" + }, + }; + + csh handle; + uint64_t address; + cs_insn* insn; + cs_detail* detail; + int i; + cs_err err; + const uint8_t* code; + size_t size; + + cs_x86* x86; + + int count; + + for (i = 0; i < sizeof(platforms) / sizeof(platforms[0]); i++) { + printf("****************\n"); + printf("Platform: %s\n", platforms[i].comment); + err = cs_open(platforms[i].arch, platforms[i].mode, &handle); + if (err) { + printf("Failed on cs_open() with error returned: %u\n", err); + abort(); + } + + if (platforms[i].opt_type) + cs_option(handle, platforms[i].opt_type, platforms[i].opt_value); + + cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON); + + insn = cs_malloc(handle); + x86 = &(insn->detail->x86); + print_string_hex(platforms[i].code, platforms[i].size); + printf("Disasm:\n"); + + address = 0x1000; + code = platforms[i].code; + size = platforms[i].size; + while (cs_disasm_iter(handle, &code, &size, &address, insn)) { + int n; + + printf("0x%" PRIx64 ":\t%s\t\t%s ", + insn->address, insn->mnemonic, insn->op_str); + cout << endl; + + count = cs_op_count(handle, insn, X86_OP_IMM); //查找立即数 + if (count) { + printf("\timm_count: %u\n", count); + for (i = 1; i < count + 1; i++) { + int index = cs_op_index(handle, insn, X86_OP_IMM, i); + printf("\timms[%u]: 0x%" PRIx64 "\n", i, x86->operands[index].imm); + if (x86->encoding.imm_offset != 0) { + printf("\timm_offset: 0x%x\n", x86->encoding.imm_offset); + } + if (x86->encoding.imm_size != 0) { + printf("\timm_size: 0x%x\n", x86->encoding.imm_size); + } + } + } + } + + printf("\n"); + cs_free(insn, 1); + cs_close(&handle); + } +} + +int main() +{ + test(); + return 0; +} +``` + +</details> + +输出 + + + +### cs_regs_access + +```cpp +cs_err CAPSTONE_API cs_regs_access(csh handle, const cs_insn *insn, + cs_regs regs_read, uint8_t *regs_read_count, + cs_regs regs_write, uint8_t *regs_write_count); +``` + +检索由一条指令显式或隐式访问的所有寄存器 + +注意： 在“diet”模式下，此API不可用，因为引擎不存储寄存器 + +``` +handle: cs_open()返回的句柄 +insn: 从cs_disasm()或cs_disasm_iter()返回的反汇编指令结构 +regs_read:返回时，这个数组包含所有按指令读取的寄存器。 +regs_read_count:保存在regs_read数组中的寄存器数。 +regs_write:返回时，这个数组包含所有由指令修改的寄存器。 +regs_write_count:保存在regs_write数组中的寄存器数。 +成功时返回CS_ERR_OK，失败时返回其他值(详细错误请参阅cs_err enum)。 +``` + +<details><summary> 源码实现 </summary> + +```cpp +cs_err CAPSTONE_API cs_regs_access(csh ud, const cs_insn *insn, + cs_regs regs_read, uint8_t *regs_read_count, + cs_regs regs_write, uint8_t *regs_write_count) +{ + struct cs_struct *handle; + + if (!ud) + return -1; + + handle = (struct cs_struct *)(uintptr_t)ud; + +#ifdef CAPSTONE_DIET + // This API does not work in DIET mode + handle->errnum = CS_ERR_DIET; + return CS_ERR_DIET; +#else + if (!handle->detail) { + handle->errnum = CS_ERR_DETAIL; + return CS_ERR_DETAIL; + } + + if (!insn->id) { + handle->errnum = CS_ERR_SKIPDATA; + return CS_ERR_SKIPDATA; + } + + if (!insn->detail) { + handle->errnum = CS_ERR_DETAIL; + return CS_ERR_DETAIL; + } + + if (handle->reg_access) { + handle->reg_access(insn, regs_read, regs_read_count, regs_write, regs_write_count); + } else { + // this arch is unsupported yet + handle->errnum = CS_ERR_ARCH; + return CS_ERR_ARCH; + } + + return CS_ERR_OK; +#endif +} +``` + +</details> + + +<details><summary> 示例 </summary> + +```cpp +#include <iostream> +#include <stdio.h> + +#include "capstone.h" +#include "platform.h" + +using namespace std; + +struct platform { + cs_arch arch; + cs_mode mode; + unsigned char* code; + size_t size; + const char* comment; + cs_opt_type opt_type; + cs_opt_value opt_value; +}; + +static void print_string_hex(unsigned char* str, size_t len) +{ + unsigned char* c; + + printf("Code: "); + for (c = str; c < str + len; c++) { + printf("0x%02x ", *c & 0xff); + } + printf("\n"); +} + +static void test() +{ +#define X86_CODE64 "\x55\x48\x8b\x05\xb8\x13\x00\x00\xe9\xea\xbe\xad\xde\xff\x25\x23\x01\x00\x00\xe8\xdf\xbe\xad\xde\x74\xff" + struct platform platforms[] = { + { + CS_ARCH_X86, + CS_MODE_64, + (unsigned char*)X86_CODE64, + sizeof(X86_CODE64) - 1, + "X86 64 (Intel syntax)" + }, + }; + + csh handle; + uint64_t address; + cs_insn* insn; + cs_detail* detail; + int i; + cs_err err; + const uint8_t* code; + size_t size; + + cs_x86* x86; + cs_regs regs_read, regs_write; + uint8_t regs_read_count, regs_write_count; + + int count; + + for (i = 0; i < sizeof(platforms) / sizeof(platforms[0]); i++) { + printf("****************\n"); + printf("Platform: %s\n", platforms[i].comment); + err = cs_open(platforms[i].arch, platforms[i].mode, &handle); + if (err) { + printf("Failed on cs_open() with error returned: %u\n", err); + abort(); + } + + if (platforms[i].opt_type) + cs_option(handle, platforms[i].opt_type, platforms[i].opt_value); + + cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON); + + insn = cs_malloc(handle); + x86 = &(insn->detail->x86); + print_string_hex(platforms[i].code, platforms[i].size); + printf("Disasm:\n"); + + address = 0x1000; + code = platforms[i].code; + size = platforms[i].size; + while (cs_disasm_iter(handle, &code, &size, &address, insn)) { + int n; + + printf("0x%" PRIx64 ":\t%s\t\t%s ", + insn->address, insn->mnemonic, insn->op_str); + cout << endl; + + if (!cs_regs_access(handle, insn, //每条指令所有读取和修改的寄存器 + regs_read, ®s_read_count, + regs_write, ®s_write_count)) { + if (regs_read_count) { + printf("\tRegisters read:"); + for (i = 0; i < regs_read_count; i++) { + printf(" %s", cs_reg_name(handle, regs_read[i])); + } + printf("\n"); + } + + if (regs_write_count) { + printf("\tRegisters modified:"); + for (i = 0; i < regs_write_count; i++) { + printf(" %s", cs_reg_name(handle, regs_write[i])); + } + printf("\n"); + } + } + } + + printf("\n"); + cs_free(insn, 1); + cs_close(&handle); + } +} + +int main() +{ + test(); + return 0; +} +``` + +</details> + +输出 + + |