capstone/cs.c

1196 lines
28 KiB
C
Raw Normal View History

2014-04-29 03:21:04 +00:00
/* Capstone Disassembly Engine */
2015-03-04 09:45:23 +00:00
/* By Nguyen Anh Quynh <aquynh@gmail.com>, 2013-2015 */
#if defined (WIN32) || defined (WIN64) || defined (_WIN32) || defined (_WIN64)
#pragma warning(disable:4996)
#endif
#if defined(CAPSTONE_HAS_OSXKERNEL)
#include <libkern/libkern.h>
#else
#include <stddef.h>
2013-11-27 04:11:31 +00:00
#include <stdio.h>
#include <stdlib.h>
#endif
2013-11-27 04:11:31 +00:00
#include <string.h>
#include <capstone/capstone.h>
2013-11-27 04:11:31 +00:00
#include "utils.h"
#include "MCRegisterInfo.h"
2013-11-27 04:11:31 +00:00
#ifdef CAPSTONE_USE_SYS_DYN_MEM
#define INSN_CACHE_SIZE 32
#else
// reduce stack variable size for kernel/firmware
#define INSN_CACHE_SIZE 8
#endif
// default SKIPDATA mnemonic
#define SKIPDATA_MNEM ".byte"
2013-12-29 16:15:25 +00:00
cs_err (*arch_init[MAX_ARCH])(cs_struct *) = { NULL };
cs_err (*arch_option[MAX_ARCH]) (cs_struct *, cs_opt_type, size_t value) = { NULL };
void (*arch_destroy[MAX_ARCH]) (cs_struct *) = { NULL };
extern void ARM_enable(void);
extern void AArch64_enable(void);
2015-08-03 16:45:08 +00:00
extern void M68K_enable(void);
extern void Mips_enable(void);
extern void X86_enable(void);
extern void PPC_enable(void);
2014-03-10 03:58:57 +00:00
extern void Sparc_enable(void);
2014-03-23 00:35:45 +00:00
extern void SystemZ_enable(void);
2014-05-26 15:02:48 +00:00
extern void XCore_enable(void);
static void archs_enable(void)
{
static bool initialized = false;
if (initialized)
return;
#ifdef CAPSTONE_HAS_ARM
ARM_enable();
#endif
#ifdef CAPSTONE_HAS_ARM64
AArch64_enable();
#endif
2015-08-03 16:45:08 +00:00
#ifdef CAPSTONE_HAS_M68K
M68K_enable();
#endif
#ifdef CAPSTONE_HAS_MIPS
Mips_enable();
#endif
#ifdef CAPSTONE_HAS_POWERPC
PPC_enable();
#endif
2014-03-10 03:58:57 +00:00
#ifdef CAPSTONE_HAS_SPARC
Sparc_enable();
#endif
2014-03-23 00:35:45 +00:00
#ifdef CAPSTONE_HAS_SYSZ
SystemZ_enable();
#endif
2014-03-10 03:58:57 +00:00
#ifdef CAPSTONE_HAS_X86
X86_enable();
#endif
2014-05-26 15:02:48 +00:00
#ifdef CAPSTONE_HAS_XCORE
XCore_enable();
#endif
initialized = true;
}
unsigned int all_arch = 0;
#ifdef CAPSTONE_USE_SYS_DYN_MEM
2015-11-05 17:08:25 +00:00
#ifndef CAPSTONE_HAS_OSXKERNEL
cs_malloc_t cs_mem_malloc = malloc;
cs_calloc_t cs_mem_calloc = calloc;
cs_realloc_t cs_mem_realloc = realloc;
cs_free_t cs_mem_free = free;
cs_vsnprintf_t cs_vsnprintf = vsnprintf;
#else
2015-11-05 17:08:25 +00:00
extern void* kern_os_malloc(size_t size);
extern void kern_os_free(void* addr);
extern void* kern_os_realloc(void* addr, size_t nsize);
static void* kern_os_calloc(size_t num, size_t size) {
return kern_os_malloc(num * size); // malloc bzeroes the buffer
}
cs_malloc_t cs_mem_malloc = kern_os_malloc;
cs_calloc_t cs_mem_calloc = kern_os_calloc;
cs_realloc_t cs_mem_realloc = kern_os_realloc;
cs_free_t cs_mem_free = kern_os_free;
cs_vsnprintf_t cs_vsnprintf = vsnprintf;
#endif
#else
cs_malloc_t cs_mem_malloc = NULL;
cs_calloc_t cs_mem_calloc = NULL;
cs_realloc_t cs_mem_realloc = NULL;
cs_free_t cs_mem_free = NULL;
cs_vsnprintf_t cs_vsnprintf = NULL;
#endif
CAPSTONE_EXPORT
unsigned int cs_version(int *major, int *minor)
2013-12-10 05:31:20 +00:00
{
archs_enable();
if (major != NULL && minor != NULL) {
*major = CS_API_MAJOR;
*minor = CS_API_MINOR;
}
return (CS_API_MAJOR << 8) + CS_API_MINOR;
}
CAPSTONE_EXPORT
bool cs_support(int query)
{
archs_enable();
if (query == CS_ARCH_ALL)
return all_arch == ((1 << CS_ARCH_ARM) | (1 << CS_ARCH_ARM64) |
2013-12-29 16:15:25 +00:00
(1 << CS_ARCH_MIPS) | (1 << CS_ARCH_X86) |
2014-03-23 00:35:45 +00:00
(1 << CS_ARCH_PPC) | (1 << CS_ARCH_SPARC) |
2014-05-26 15:02:48 +00:00
(1 << CS_ARCH_SYSZ) | (1 << CS_ARCH_XCORE));
if ((unsigned int)query < CS_ARCH_MAX)
return all_arch & (1 << query);
if (query == CS_SUPPORT_DIET) {
#ifdef CAPSTONE_DIET
return true;
#else
return false;
#endif
}
if (query == CS_SUPPORT_X86_REDUCE) {
#if defined(CAPSTONE_HAS_X86) && defined(CAPSTONE_X86_REDUCE)
return true;
#else
return false;
#endif
}
// unsupported query
return false;
2013-12-10 05:31:20 +00:00
}
CAPSTONE_EXPORT
2013-11-27 04:11:31 +00:00
cs_err cs_errno(csh handle)
{
struct cs_struct *ud;
2013-11-27 04:11:31 +00:00
if (!handle)
return CS_ERR_CSH;
ud = (struct cs_struct *)(uintptr_t)handle;
2013-11-27 04:11:31 +00:00
return ud->errnum;
2013-11-27 04:11:31 +00:00
}
CAPSTONE_EXPORT
const char *cs_strerror(cs_err code)
{
switch(code) {
default:
return "Unknown error code";
case CS_ERR_OK:
return "OK (CS_ERR_OK)";
case CS_ERR_MEM:
return "Out of memory (CS_ERR_MEM)";
case CS_ERR_ARCH:
return "Invalid/unsupported architecture(CS_ERR_ARCH)";
case CS_ERR_HANDLE:
return "Invalid handle (CS_ERR_HANDLE)";
case CS_ERR_CSH:
return "Invalid csh (CS_ERR_CSH)";
case CS_ERR_MODE:
return "Invalid mode (CS_ERR_MODE)";
case CS_ERR_OPTION:
return "Invalid option (CS_ERR_OPTION)";
case CS_ERR_DETAIL:
return "Details are unavailable (CS_ERR_DETAIL)";
case CS_ERR_MEMSETUP:
return "Dynamic memory management uninitialized (CS_ERR_MEMSETUP)";
case CS_ERR_VERSION:
return "Different API version between core & binding (CS_ERR_VERSION)";
case CS_ERR_DIET:
return "Information irrelevant in diet engine (CS_ERR_DIET)";
case CS_ERR_SKIPDATA:
return "Information irrelevant for 'data' instruction in SKIPDATA mode (CS_ERR_SKIPDATA)";
2015-08-09 17:52:18 +00:00
case CS_ERR_X86_ATT:
return "AT&T syntax is unavailable (CS_ERR_X86_ATT)";
case CS_ERR_X86_INTEL:
return "INTEL syntax is unavailable (CS_ERR_X86_INTEL)";
case CS_ERR_X86_MASM:
return "MASM syntax is unavailable (CS_ERR_X86_MASM)";
}
}
CAPSTONE_EXPORT
2013-11-27 04:11:31 +00:00
cs_err cs_open(cs_arch arch, cs_mode mode, csh *handle)
{
2014-05-08 23:33:35 +00:00
cs_err err;
struct cs_struct *ud;
if (!cs_mem_malloc || !cs_mem_calloc || !cs_mem_realloc || !cs_mem_free || !cs_vsnprintf)
// Error: before cs_open(), dynamic memory management must be initialized
// with cs_option(CS_OPT_MEM)
return CS_ERR_MEMSETUP;
archs_enable();
if (arch < CS_ARCH_MAX && arch_init[arch]) {
ud = cs_mem_calloc(1, sizeof(*ud));
if (!ud) {
// memory insufficient
return CS_ERR_MEM;
}
2013-11-27 04:11:31 +00:00
ud->errnum = CS_ERR_OK;
ud->arch = arch;
ud->mode = mode;
ud->big_endian = mode & CS_MODE_BIG_ENDIAN;
// by default, do not break instruction into details
ud->detail = CS_OPT_OFF;
// default skipdata setup
ud->skipdata_setup.mnemonic = SKIPDATA_MNEM;
err = arch_init[ud->arch](ud);
if (err) {
cs_mem_free(ud);
*handle = 0;
return err;
}
*handle = (uintptr_t)ud;
return CS_ERR_OK;
} else {
*handle = 0;
return CS_ERR_ARCH;
}
2013-11-27 04:11:31 +00:00
}
CAPSTONE_EXPORT
cs_err cs_close(csh *handle)
2013-11-27 04:11:31 +00:00
{
struct cs_struct *ud;
struct insn_mnem *next, *tmp;
if (*handle == 0)
// invalid handle
2013-11-27 04:11:31 +00:00
return CS_ERR_CSH;
ud = (struct cs_struct *)(*handle);
2013-11-27 04:11:31 +00:00
if (ud->printer_info)
cs_mem_free(ud->printer_info);
2013-11-27 04:11:31 +00:00
// free the linked list of customized mnemonic
tmp = ud->mnem_list;
while(tmp) {
next = tmp->next;
cs_mem_free(tmp);
tmp = next;
}
cs_mem_free(ud->insn_cache);
memset(ud, 0, sizeof(*ud));
cs_mem_free(ud);
// invalidate this handle by ZERO out its value.
// this is to make sure it is unusable after cs_close()
*handle = 0;
2013-11-27 04:11:31 +00:00
return CS_ERR_OK;
}
// fill insn with mnemonic & operands info
2014-01-23 15:42:40 +00:00
static void fill_insn(struct cs_struct *handle, cs_insn *insn, char *buffer, MCInst *mci,
PostPrinter_t postprinter, const uint8_t *code)
2013-11-27 04:11:31 +00:00
{
#ifndef CAPSTONE_DIET
char *sp, *mnem;
#endif
2014-10-30 12:34:22 +00:00
unsigned int copy_size = MIN(sizeof(insn->bytes), insn->size);
2013-11-27 04:11:31 +00:00
2014-10-30 12:34:22 +00:00
// fill the instruction bytes.
// we might skip some redundant bytes in front in the case of X86
memcpy(insn->bytes, code + insn->size - copy_size, copy_size);
insn->size = copy_size;
// alias instruction might have ID saved in OpcodePub
if (MCInst_getOpcodePub(mci))
insn->id = MCInst_getOpcodePub(mci);
// post printer handles some corner cases (hacky)
if (postprinter)
postprinter((csh)handle, insn, buffer, mci);
#ifndef CAPSTONE_DIET
2013-11-27 04:11:31 +00:00
// fill in mnemonic & operands
// find first space or tab
sp = buffer;
mnem = insn->mnemonic;
for (sp = buffer; *sp; sp++) {
if (*sp == ' '|| *sp == '\t')
break;
if (*sp == '|') // lock|rep prefix for x86
*sp = ' ';
// copy to @mnemonic
*mnem = *sp;
mnem++;
}
*mnem = '\0';
// we might have customized mnemonic
if (handle->mnem_list) {
struct insn_mnem *tmp = handle->mnem_list;
while(tmp) {
if (tmp->insn.id == insn->id) {
// found this instruction, so copy its mnemonic
(void)strncpy(insn->mnemonic, tmp->insn.mnemonic, sizeof(insn->mnemonic) - 1);
insn->mnemonic[sizeof(insn->mnemonic) - 1] = '\0';
break;
}
tmp = tmp->next;
}
}
// copy @op_str
if (*sp) {
// find the next non-space char
sp++;
for (; ((*sp == ' ') || (*sp == '\t')); sp++);
strncpy(insn->op_str, sp, sizeof(insn->op_str) - 1);
2013-11-27 04:11:31 +00:00
insn->op_str[sizeof(insn->op_str) - 1] = '\0';
} else
insn->op_str[0] = '\0';
#endif
2013-11-27 04:11:31 +00:00
}
// how many bytes will we skip when encountering data (CS_OPT_SKIPDATA)?
// this very much depends on instruction alignment requirement of each arch.
static uint8_t skipdata_size(cs_struct *handle)
{
switch(handle->arch) {
default:
// should never reach
return -1;
case CS_ARCH_ARM:
// skip 2 bytes on Thumb mode.
if (handle->mode & CS_MODE_THUMB)
return 2;
// otherwise, skip 4 bytes
return 4;
case CS_ARCH_ARM64:
case CS_ARCH_MIPS:
case CS_ARCH_PPC:
case CS_ARCH_SPARC:
// skip 4 bytes
return 4;
case CS_ARCH_SYSZ:
// SystemZ instruction's length can be 2, 4 or 6 bytes,
// so we just skip 2 bytes
return 2;
case CS_ARCH_X86:
// X86 has no restriction on instruction alignment
return 1;
2014-05-26 15:02:48 +00:00
case CS_ARCH_XCORE:
// XCore instruction's length can be 2 or 4 bytes,
// so we just skip 2 bytes
return 2;
2015-08-03 16:45:08 +00:00
case CS_ARCH_M68K:
// M68K has 2 bytes instruction alignment but contain multibyte instruction so we skip 2 bytes
return 2;
}
}
CAPSTONE_EXPORT
cs_err cs_option(csh ud, cs_opt_type type, size_t value)
{
struct cs_struct *handle;
cs_opt_mnem *opt;
archs_enable();
// cs_option() can be called with NULL handle just for CS_OPT_MEM
// This is supposed to be executed before all other APIs (even cs_open())
if (type == CS_OPT_MEM) {
cs_opt_mem *mem = (cs_opt_mem *)value;
cs_mem_malloc = mem->malloc;
cs_mem_calloc = mem->calloc;
cs_mem_realloc = mem->realloc;
cs_mem_free = mem->free;
cs_vsnprintf = mem->vsnprintf;
return CS_ERR_OK;
}
handle = (struct cs_struct *)(uintptr_t)ud;
2013-12-20 04:40:28 +00:00
if (!handle)
return CS_ERR_CSH;
switch(type) {
default:
break;
case CS_OPT_DETAIL:
handle->detail = (cs_opt_value)value;
return CS_ERR_OK;
case CS_OPT_SKIPDATA:
handle->skipdata = (value == CS_OPT_ON);
if (handle->skipdata) {
if (handle->skipdata_size == 0) {
// set the default skipdata size
handle->skipdata_size = skipdata_size(handle);
}
}
return CS_ERR_OK;
case CS_OPT_SKIPDATA_SETUP:
if (value)
handle->skipdata_setup = *((cs_opt_skipdata *)value);
return CS_ERR_OK;
case CS_OPT_MNEMONIC:
opt = (cs_opt_mnem *)value;
if (opt->id) {
if (opt->mnemonic) {
struct insn_mnem *tmp;
// add new instruction, or replace existing instruction
// 1. find if we already had this insn in the linked list
tmp = handle->mnem_list;
while(tmp) {
if (tmp->insn.id == opt->id) {
// found this instruction, so replace its mnemonic
(void)strncpy(tmp->insn.mnemonic, opt->mnemonic, sizeof(tmp->insn.mnemonic) - 1);
tmp->insn.mnemonic[sizeof(tmp->insn.mnemonic) - 1] = '\0';
break;
}
tmp = tmp->next;
}
// 2. add this instruction if we have not had it yet
if (!tmp) {
tmp = cs_mem_malloc(sizeof(*tmp));
tmp->insn.id = opt->id;
(void)strncpy(tmp->insn.mnemonic, opt->mnemonic, sizeof(tmp->insn.mnemonic) - 1);
tmp->insn.mnemonic[sizeof(tmp->insn.mnemonic) - 1] = '\0';
// this new instruction is heading the list
tmp->next = handle->mnem_list;
handle->mnem_list = tmp;
}
return CS_ERR_OK;
} else {
struct insn_mnem *prev, *tmp;
// we want to delete an existing instruction
// iterate the list to find the instruction to remove it
tmp = handle->mnem_list;
prev = tmp;
while(tmp) {
if (tmp->insn.id == opt->id) {
// delete this instruction
if (tmp == prev) {
// head of the list
handle->mnem_list = tmp->next;
} else {
prev->next = tmp->next;
}
cs_mem_free(tmp);
break;
}
prev = tmp;
tmp = tmp->next;
}
}
}
return CS_ERR_OK;
2013-12-21 01:59:31 +00:00
}
2013-12-20 04:40:28 +00:00
2013-12-22 03:10:56 +00:00
return arch_option[handle->arch](handle, type, value);
}
// generate @op_str for data instruction of SKIPDATA
static void skipdata_opstr(char *opstr, const uint8_t *buffer, size_t size)
{
char *p = opstr;
int len;
size_t i;
if (!size) {
opstr[0] = '\0';
return;
}
len = sprintf(p, "0x%02x", buffer[0]);
p+= len;
for(i = 1; i < size; i++) {
len = sprintf(p, ", 0x%02x", buffer[i]);
p+= len;
}
}
2013-11-27 04:11:31 +00:00
// dynamicly allocate memory to contain disasm insn
// NOTE: caller must free() the allocated memory itself to avoid memory leaking
CAPSTONE_EXPORT
size_t cs_disasm(csh ud, const uint8_t *buffer, size_t size, uint64_t offset, size_t count, cs_insn **insn)
2013-11-27 04:11:31 +00:00
{
struct cs_struct *handle;
2013-11-27 04:11:31 +00:00
MCInst mci;
uint16_t insn_size;
size_t c = 0, i;
unsigned int f = 0; // index of the next instruction in the cache
cs_insn *insn_cache; // cache contains disassembled instructions
2013-11-27 04:11:31 +00:00
void *total = NULL;
size_t total_size = 0; // total size of output buffer containing all insns
2014-03-06 14:40:08 +00:00
bool r;
void *tmp;
size_t skipdata_bytes;
uint64_t offset_org; // save all the original info of the buffer
size_t size_org;
const uint8_t *buffer_org;
unsigned int cache_size = INSN_CACHE_SIZE;
2014-10-02 04:12:18 +00:00
size_t next_offset;
2013-11-27 04:11:31 +00:00
handle = (struct cs_struct *)(uintptr_t)ud;
if (!handle) {
2013-11-27 04:11:31 +00:00
// FIXME: how to handle this case:
// handle->errnum = CS_ERR_HANDLE;
2013-11-27 04:11:31 +00:00
return 0;
}
handle->errnum = CS_ERR_OK;
2013-11-27 04:11:31 +00:00
#ifdef CAPSTONE_USE_SYS_DYN_MEM
if (count > 0 && count <= INSN_CACHE_SIZE)
cache_size = (unsigned int) count;
#endif
// save the original offset for SKIPDATA
buffer_org = buffer;
offset_org = offset;
size_org = size;
total_size = sizeof(cs_insn) * cache_size;
total = cs_mem_malloc(total_size);
2014-12-15 03:22:46 +00:00
if (total == NULL) {
// insufficient memory
2014-12-15 01:45:19 +00:00
handle->errnum = CS_ERR_MEM;
return 0;
}
2014-12-15 03:22:46 +00:00
insn_cache = total;
2013-11-27 04:11:31 +00:00
while (size > 0) {
2014-06-16 07:54:32 +00:00
MCInst_Init(&mci);
2013-12-29 16:15:25 +00:00
mci.csh = handle;
2013-11-27 04:11:31 +00:00
// relative branches need to know the address & size of current insn
mci.address = offset;
if (handle->detail) {
// allocate memory for @detail pointer
insn_cache->detail = cs_mem_malloc(sizeof(cs_detail));
} else {
insn_cache->detail = NULL;
}
// save all the information for non-detailed mode
mci.flat_insn = insn_cache;
mci.flat_insn->address = offset;
#ifdef CAPSTONE_DIET
// zero out mnemonic & op_str
mci.flat_insn->mnemonic[0] = '\0';
mci.flat_insn->op_str[0] = '\0';
#endif
r = handle->disasm(ud, buffer, size, &mci, &insn_size, offset, handle->getinsn_info);
2013-11-27 04:11:31 +00:00
if (r) {
SStream ss;
SStream_Init(&ss);
mci.flat_insn->size = insn_size;
// map internal instruction opcode to public insn ID
handle->insn_id(handle, insn_cache, mci.Opcode);
2013-11-27 04:11:31 +00:00
handle->printer(&mci, &ss, handle->printer_info);
fill_insn(handle, insn_cache, ss.buffer, &mci, handle->post_printer, buffer);
2014-10-02 04:12:18 +00:00
next_offset = insn_size;
} else {
2014-10-02 04:37:32 +00:00
// encounter a broken instruction
// free memory of @detail pointer
if (handle->detail) {
cs_mem_free(insn_cache->detail);
}
// if there is no request to skip data, or remaining data is too small,
// then bail out
if (!handle->skipdata || handle->skipdata_size > size)
break;
if (handle->skipdata_setup.callback) {
skipdata_bytes = handle->skipdata_setup.callback(buffer_org, size_org,
2014-08-26 07:57:04 +00:00
(size_t)(offset - offset_org), handle->skipdata_setup.user_data);
if (skipdata_bytes > size)
// remaining data is not enough
break;
if (!skipdata_bytes)
// user requested not to skip data, so bail out
break;
} else
skipdata_bytes = handle->skipdata_size;
// we have to skip some amount of data, depending on arch & mode
insn_cache->id = 0; // invalid ID for this "data" instruction
insn_cache->address = offset;
insn_cache->size = (uint16_t)skipdata_bytes;
memcpy(insn_cache->bytes, buffer, skipdata_bytes);
strncpy(insn_cache->mnemonic, handle->skipdata_setup.mnemonic,
sizeof(insn_cache->mnemonic) - 1);
skipdata_opstr(insn_cache->op_str, buffer, skipdata_bytes);
insn_cache->detail = NULL;
2014-10-02 04:12:18 +00:00
next_offset = skipdata_bytes;
}
2014-10-02 04:37:32 +00:00
2014-10-02 04:12:18 +00:00
// one more instruction entering the cache
f++;
2014-10-02 04:37:32 +00:00
2014-10-02 04:12:18 +00:00
// one more instruction disassembled
c++;
if (count > 0 && c == count)
// already got requested number of instructions
2014-10-02 04:12:18 +00:00
break;
2014-10-02 04:37:32 +00:00
2014-10-02 04:12:18 +00:00
if (f == cache_size) {
// full cache, so expand the cache to contain incoming insns
2014-10-02 12:38:24 +00:00
cache_size = cache_size * 8 / 5; // * 1.6 ~ golden ratio
2014-10-02 04:12:18 +00:00
total_size += (sizeof(cs_insn) * cache_size);
tmp = cs_mem_realloc(total, total_size);
if (tmp == NULL) { // insufficient memory
if (handle->detail) {
insn_cache = (cs_insn *)total;
for (i = 0; i < c; i++, insn_cache++)
cs_mem_free(insn_cache->detail);
}
2014-10-02 04:12:18 +00:00
cs_mem_free(total);
*insn = NULL;
handle->errnum = CS_ERR_MEM;
return 0;
}
2014-10-02 04:12:18 +00:00
total = tmp;
// continue to fill in the cache after the last instruction
insn_cache = (cs_insn *)((char *)total + sizeof(cs_insn) * c);
// reset f back to 0, so we fill in the cache from begining
2014-10-02 04:12:18 +00:00
f = 0;
} else
insn_cache++;
buffer += next_offset;
size -= next_offset;
offset += next_offset;
2013-11-27 04:11:31 +00:00
}
if (!c) {
2014-10-02 04:37:32 +00:00
// we did not disassemble any instruction
cs_mem_free(total);
total = NULL;
} else if (f != cache_size) {
2014-10-02 04:37:32 +00:00
// total did not fully use the last cache, so downsize it
tmp = cs_mem_realloc(total, total_size - (cache_size - f) * sizeof(*insn_cache));
2013-11-27 04:11:31 +00:00
if (tmp == NULL) { // insufficient memory
// free all detail pointers
if (handle->detail) {
insn_cache = (cs_insn *)total;
for (i = 0; i < c; i++, insn_cache++)
cs_mem_free(insn_cache->detail);
}
cs_mem_free(total);
*insn = NULL;
handle->errnum = CS_ERR_MEM;
2013-11-27 04:11:31 +00:00
return 0;
}
total = tmp;
}
*insn = total;
return c;
}
CAPSTONE_EXPORT
CAPSTONE_DEPRECATED
size_t cs_disasm_ex(csh ud, const uint8_t *buffer, size_t size, uint64_t offset, size_t count, cs_insn **insn)
{
return cs_disasm(ud, buffer, size, offset, count, insn);
}
CAPSTONE_EXPORT
void cs_free(cs_insn *insn, size_t count)
2013-11-27 04:11:31 +00:00
{
size_t i;
// free all detail pointers
for (i = 0; i < count; i++)
cs_mem_free(insn[i].detail);
// then free pointer to cs_insn array
cs_mem_free(insn);
2013-11-27 04:11:31 +00:00
}
CAPSTONE_EXPORT
cs_insn *cs_malloc(csh ud)
{
cs_insn *insn;
struct cs_struct *handle = (struct cs_struct *)(uintptr_t)ud;
insn = cs_mem_malloc(sizeof(cs_insn));
if (!insn) {
// insufficient memory
handle->errnum = CS_ERR_MEM;
return NULL;
} else {
if (handle->detail) {
// allocate memory for @detail pointer
insn->detail = cs_mem_malloc(sizeof(cs_detail));
if (insn->detail == NULL) { // insufficient memory
cs_mem_free(insn);
handle->errnum = CS_ERR_MEM;
return NULL;
}
} else
insn->detail = NULL;
}
return insn;
}
2014-10-05 16:14:40 +00:00
// iterator for instruction "single-stepping"
CAPSTONE_EXPORT
bool cs_disasm_iter(csh ud, const uint8_t **code, size_t *size,
uint64_t *address, cs_insn *insn)
2014-10-05 16:14:40 +00:00
{
struct cs_struct *handle;
uint16_t insn_size;
MCInst mci;
bool r;
handle = (struct cs_struct *)(uintptr_t)ud;
if (!handle) {
return false;
2014-10-05 16:14:40 +00:00
}
handle->errnum = CS_ERR_OK;
MCInst_Init(&mci);
mci.csh = handle;
// relative branches need to know the address & size of current insn
mci.address = *address;
// save all the information for non-detailed mode
mci.flat_insn = insn;
2014-10-05 16:14:40 +00:00
mci.flat_insn->address = *address;
#ifdef CAPSTONE_DIET
// zero out mnemonic & op_str
mci.flat_insn->mnemonic[0] = '\0';
mci.flat_insn->op_str[0] = '\0';
#endif
r = handle->disasm(ud, *code, *size, &mci, &insn_size, *address, handle->getinsn_info);
if (r) {
2014-10-05 16:14:40 +00:00
SStream ss;
SStream_Init(&ss);
mci.flat_insn->size = insn_size;
// map internal instruction opcode to public insn ID
handle->insn_id(handle, insn, mci.Opcode);
2014-10-05 16:14:40 +00:00
handle->printer(&mci, &ss, handle->printer_info);
fill_insn(handle, insn, ss.buffer, &mci, handle->post_printer, *code);
2014-10-05 16:14:40 +00:00
*code += insn_size;
*size -= insn_size;
*address += insn_size;
} else { // encounter a broken instruction
size_t skipdata_bytes;
// if there is no request to skip data, or remaining data is too small,
// then bail out
if (!handle->skipdata || handle->skipdata_size > *size)
return false;
if (handle->skipdata_setup.callback) {
skipdata_bytes = handle->skipdata_setup.callback(*code, *size,
0, handle->skipdata_setup.user_data);
if (skipdata_bytes > *size)
// remaining data is not enough
return false;
if (!skipdata_bytes)
// user requested not to skip data, so bail out
return false;
} else
skipdata_bytes = handle->skipdata_size;
// we have to skip some amount of data, depending on arch & mode
insn->id = 0; // invalid ID for this "data" instruction
insn->address = *address;
insn->size = (uint16_t)skipdata_bytes;
memcpy(insn->bytes, *code, skipdata_bytes);
strncpy(insn->mnemonic, handle->skipdata_setup.mnemonic,
sizeof(insn->mnemonic) - 1);
skipdata_opstr(insn->op_str, *code, skipdata_bytes);
*code += skipdata_bytes;
*size -= skipdata_bytes;
*address += skipdata_bytes;
2014-10-05 16:14:40 +00:00
}
return true;
2014-10-05 16:14:40 +00:00
}
2013-11-27 04:11:31 +00:00
// return friendly name of regiser in a string
CAPSTONE_EXPORT
2013-12-11 21:14:42 +00:00
const char *cs_reg_name(csh ud, unsigned int reg)
2013-11-27 04:11:31 +00:00
{
2014-01-23 15:42:40 +00:00
struct cs_struct *handle = (struct cs_struct *)(uintptr_t)ud;
2013-11-27 04:11:31 +00:00
if (!handle || handle->reg_name == NULL) {
return NULL;
}
return handle->reg_name(ud, reg);
2013-11-27 04:11:31 +00:00
}
CAPSTONE_EXPORT
2013-12-11 21:14:42 +00:00
const char *cs_insn_name(csh ud, unsigned int insn)
2013-11-27 04:11:31 +00:00
{
2014-01-23 15:42:40 +00:00
struct cs_struct *handle = (struct cs_struct *)(uintptr_t)ud;
2013-11-27 04:11:31 +00:00
if (!handle || handle->insn_name == NULL) {
return NULL;
}
return handle->insn_name(ud, insn);
2013-11-27 04:11:31 +00:00
}
CAPSTONE_EXPORT
const char *cs_group_name(csh ud, unsigned int group)
{
struct cs_struct *handle = (struct cs_struct *)(uintptr_t)ud;
if (!handle || handle->group_name == NULL) {
return NULL;
}
return handle->group_name(ud, group);
}
CAPSTONE_EXPORT
bool cs_insn_group(csh ud, const cs_insn *insn, unsigned int group_id)
2013-11-27 04:11:31 +00:00
{
struct cs_struct *handle;
if (!ud)
return false;
handle = (struct cs_struct *)(uintptr_t)ud;
if (!handle->detail) {
handle->errnum = CS_ERR_DETAIL;
2013-11-27 04:11:31 +00:00
return false;
}
2013-11-27 04:11:31 +00:00
if (!insn->id) {
handle->errnum = CS_ERR_SKIPDATA;
return false;
}
if (!insn->detail) {
handle->errnum = CS_ERR_DETAIL;
return false;
}
return arr_exist8(insn->detail->groups, insn->detail->groups_count, group_id);
2013-11-27 04:11:31 +00:00
}
CAPSTONE_EXPORT
bool cs_reg_read(csh ud, const cs_insn *insn, unsigned int reg_id)
2013-11-27 04:11:31 +00:00
{
struct cs_struct *handle;
if (!ud)
2013-11-27 04:11:31 +00:00
return false;
handle = (struct cs_struct *)(uintptr_t)ud;
if (!handle->detail) {
handle->errnum = CS_ERR_DETAIL;
return false;
}
if (!insn->id) {
handle->errnum = CS_ERR_SKIPDATA;
return false;
}
if (!insn->detail) {
handle->errnum = CS_ERR_DETAIL;
return false;
}
return arr_exist(insn->detail->regs_read, insn->detail->regs_read_count, reg_id);
2013-11-27 04:11:31 +00:00
}
CAPSTONE_EXPORT
bool cs_reg_write(csh ud, const cs_insn *insn, unsigned int reg_id)
2013-11-27 04:11:31 +00:00
{
struct cs_struct *handle;
if (!ud)
return false;
handle = (struct cs_struct *)(uintptr_t)ud;
if (!handle->detail) {
handle->errnum = CS_ERR_DETAIL;
2013-11-27 04:11:31 +00:00
return false;
}
2013-11-27 04:11:31 +00:00
if (!insn->id) {
handle->errnum = CS_ERR_SKIPDATA;
return false;
}
if (!insn->detail) {
handle->errnum = CS_ERR_DETAIL;
return false;
}
return arr_exist(insn->detail->regs_write, insn->detail->regs_write_count, reg_id);
2013-11-27 04:11:31 +00:00
}
CAPSTONE_EXPORT
int cs_op_count(csh ud, const cs_insn *insn, unsigned int op_type)
2013-11-27 04:11:31 +00:00
{
struct cs_struct *handle;
unsigned int count = 0, i;
2013-11-27 04:11:31 +00:00
if (!ud)
return -1;
handle = (struct cs_struct *)(uintptr_t)ud;
if (!handle->detail) {
handle->errnum = CS_ERR_DETAIL;
return -1;
}
if (!insn->id) {
handle->errnum = CS_ERR_SKIPDATA;
return -1;
}
if (!insn->detail) {
handle->errnum = CS_ERR_DETAIL;
return -1;
}
handle->errnum = CS_ERR_OK;
2013-11-27 04:11:31 +00:00
switch (handle->arch) {
default:
handle->errnum = CS_ERR_HANDLE;
2013-11-27 04:11:31 +00:00
return -1;
case CS_ARCH_ARM:
for (i = 0; i < insn->detail->arm.op_count; i++)
if (insn->detail->arm.operands[i].type == (arm_op_type)op_type)
2013-11-27 04:11:31 +00:00
count++;
break;
case CS_ARCH_ARM64:
for (i = 0; i < insn->detail->arm64.op_count; i++)
if (insn->detail->arm64.operands[i].type == (arm64_op_type)op_type)
2013-11-27 04:11:31 +00:00
count++;
break;
case CS_ARCH_X86:
for (i = 0; i < insn->detail->x86.op_count; i++)
if (insn->detail->x86.operands[i].type == (x86_op_type)op_type)
2013-11-27 04:11:31 +00:00
count++;
break;
case CS_ARCH_MIPS:
for (i = 0; i < insn->detail->mips.op_count; i++)
if (insn->detail->mips.operands[i].type == (mips_op_type)op_type)
2013-11-27 04:11:31 +00:00
count++;
break;
2013-12-29 16:15:25 +00:00
case CS_ARCH_PPC:
for (i = 0; i < insn->detail->ppc.op_count; i++)
if (insn->detail->ppc.operands[i].type == (ppc_op_type)op_type)
2013-12-29 16:15:25 +00:00
count++;
break;
2014-03-10 03:58:57 +00:00
case CS_ARCH_SPARC:
for (i = 0; i < insn->detail->sparc.op_count; i++)
if (insn->detail->sparc.operands[i].type == (sparc_op_type)op_type)
count++;
break;
2014-03-23 00:35:45 +00:00
case CS_ARCH_SYSZ:
for (i = 0; i < insn->detail->sysz.op_count; i++)
if (insn->detail->sysz.operands[i].type == (sysz_op_type)op_type)
count++;
break;
2014-05-26 15:02:48 +00:00
case CS_ARCH_XCORE:
for (i = 0; i < insn->detail->xcore.op_count; i++)
if (insn->detail->xcore.operands[i].type == (xcore_op_type)op_type)
count++;
break;
2013-11-27 04:11:31 +00:00
}
return count;
}
CAPSTONE_EXPORT
int cs_op_index(csh ud, const cs_insn *insn, unsigned int op_type,
2013-11-27 04:11:31 +00:00
unsigned int post)
{
struct cs_struct *handle;
unsigned int count = 0, i;
2013-11-27 04:11:31 +00:00
if (!ud)
return -1;
handle = (struct cs_struct *)(uintptr_t)ud;
if (!handle->detail) {
handle->errnum = CS_ERR_DETAIL;
return -1;
}
if (!insn->id) {
handle->errnum = CS_ERR_SKIPDATA;
return -1;
}
if (!insn->detail) {
handle->errnum = CS_ERR_DETAIL;
return -1;
}
handle->errnum = CS_ERR_OK;
2013-11-27 04:11:31 +00:00
switch (handle->arch) {
default:
handle->errnum = CS_ERR_HANDLE;
2013-11-27 04:11:31 +00:00
return -1;
case CS_ARCH_ARM:
for (i = 0; i < insn->detail->arm.op_count; i++) {
if (insn->detail->arm.operands[i].type == (arm_op_type)op_type)
2013-11-27 04:11:31 +00:00
count++;
if (count == post)
return i;
}
break;
case CS_ARCH_ARM64:
for (i = 0; i < insn->detail->arm64.op_count; i++) {
if (insn->detail->arm64.operands[i].type == (arm64_op_type)op_type)
2013-11-27 04:11:31 +00:00
count++;
if (count == post)
return i;
}
break;
case CS_ARCH_X86:
for (i = 0; i < insn->detail->x86.op_count; i++) {
if (insn->detail->x86.operands[i].type == (x86_op_type)op_type)
2013-11-27 04:11:31 +00:00
count++;
if (count == post)
return i;
}
break;
case CS_ARCH_MIPS:
for (i = 0; i < insn->detail->mips.op_count; i++) {
if (insn->detail->mips.operands[i].type == (mips_op_type)op_type)
2013-11-27 04:11:31 +00:00
count++;
if (count == post)
return i;
}
break;
2013-12-29 16:15:25 +00:00
case CS_ARCH_PPC:
for (i = 0; i < insn->detail->ppc.op_count; i++) {
if (insn->detail->ppc.operands[i].type == (ppc_op_type)op_type)
2013-12-29 16:15:25 +00:00
count++;
if (count == post)
return i;
}
break;
2014-03-10 03:58:57 +00:00
case CS_ARCH_SPARC:
for (i = 0; i < insn->detail->sparc.op_count; i++) {
if (insn->detail->sparc.operands[i].type == (sparc_op_type)op_type)
count++;
if (count == post)
return i;
}
break;
2014-03-23 00:35:45 +00:00
case CS_ARCH_SYSZ:
for (i = 0; i < insn->detail->sysz.op_count; i++) {
if (insn->detail->sysz.operands[i].type == (sysz_op_type)op_type)
count++;
if (count == post)
return i;
}
break;
2014-05-26 15:02:48 +00:00
case CS_ARCH_XCORE:
for (i = 0; i < insn->detail->xcore.op_count; i++) {
if (insn->detail->xcore.operands[i].type == (xcore_op_type)op_type)
count++;
if (count == post)
return i;
}
break;
2013-11-27 04:11:31 +00:00
}
return -1;
}
CAPSTONE_EXPORT
cs_err cs_regs_access(csh ud, const cs_insn *insn,
cs_regs regs_read, uint8_t *regs_read_count,
cs_regs regs_write, uint8_t *regs_write_count)
{
struct cs_struct *handle;
if (!ud)
return -1;
handle = (struct cs_struct *)(uintptr_t)ud;
#ifdef CAPSTONE_DIET
// This API does not work in DIET mode
handle->errnum = CS_ERR_DIET;
return CS_ERR_DIET;
#else
if (!handle->detail) {
handle->errnum = CS_ERR_DETAIL;
return CS_ERR_DETAIL;
}
if (!insn->id) {
handle->errnum = CS_ERR_SKIPDATA;
return CS_ERR_SKIPDATA;
}
if (!insn->detail) {
handle->errnum = CS_ERR_DETAIL;
return CS_ERR_DETAIL;
}
if (handle->reg_access) {
handle->reg_access(insn, regs_read, regs_read_count, regs_write, regs_write_count);
} else {
// this arch is unsupported yet
handle->errnum = CS_ERR_ARCH;
return CS_ERR_ARCH;
}
return CS_ERR_OK;
#endif
}