示例#1
0
/*
 * Set up a listening endpoint, and give it to the event-handler.
 */
static int add_listener(char *where, int listen_id)
{
    COMSTACK l;
    void *ap;
    IOCHAN lst = NULL;
    const char *mode;

    if (control_block.dynamic)
        mode = "dynamic";
    else if (control_block.threads)
        mode = "threaded";
    else
        mode = "static";

    yaz_log(log_server, "Adding %s listener on %s id=%d", mode, where,
            listen_id);

    l = cs_create_host(where, 2, &ap);
    if (!l)
    {
        yaz_log(YLOG_FATAL, "Failed to listen on %s", where);
        return -1;
    }
    if (*control_block.cert_fname)
        cs_set_ssl_certificate_file(l, control_block.cert_fname);

    if (cs_bind(l, ap, CS_SERVER) < 0)
    {
        if (cs_errno(l) == CSYSERR)
            yaz_log(YLOG_FATAL|YLOG_ERRNO, "Failed to bind to %s", where);
        else
            yaz_log(YLOG_FATAL, "Failed to bind to %s: %s", where,
                    cs_strerror(l));
        cs_close(l);
        return -1;
    }
    if (!(lst = iochan_create(cs_fileno(l), listener, EVENT_INPUT |
                              EVENT_EXCEPT, listen_id)))
    {
        yaz_log(YLOG_FATAL|YLOG_ERRNO, "Failed to create IOCHAN-type");
        cs_close(l);
        return -1;
    }
    iochan_setdata(lst, l); /* user-defined data for listener is COMSTACK */
    l->user = lst;  /* user-defined data for COMSTACK is listener chan */

    /* Add listener to chain */
    lst->next = pListener;
    pListener = lst;
    return 0; /* OK */
}
示例#2
0
static int the_end(void *p) {
	if (cd) {
		cs_close (&cd);
		cd = 0;
	}
	return R_TRUE;
}
int hook_init2()
{
    if(g_capstone != 0) {
        cs_close(&g_capstone);
    }

    cs_opt_mem cs_mem;
    cs_mem.malloc = &_cs_malloc;
    cs_mem.calloc = &_cs_calloc;
    cs_mem.realloc = &_cs_realloc;
    cs_mem.free = &_cs_free;

    // TODO Is there an alternative besides doing your own implementation?
    cs_mem.vsnprintf = &vsnprintf;

    cs_option(0, CS_OPT_MEM, (size_t) (uintptr_t) &cs_mem);
    _capstone_init();

    // Memory for function stubs of all the hooks.
    slab_init(&g_function_stubs, 64, 128, PAGE_EXECUTE_READWRITE);

    // TODO At the moment this only works on Vista+, not on Windows XP. As
    // shown by Brad Spengler it's fairly trivial to achieve the same on
    // Windows XP but for now.. it's fine.
    register_dll_notification(&_ldr_dll_notification, NULL);
    return 0;
}
示例#4
0
static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len) {
	csh handle;
	cs_insn *insn;
	int mode, n, ret;
	mode = CS_MODE_BIG_ENDIAN;
	if (!strcmp (a->cpu, "v9"))
		mode |= CS_MODE_V9;
	ret = cs_open (CS_ARCH_XCORE, mode, &handle);
	op->type = R_ANAL_OP_TYPE_NULL;
	op->size = 0;
	op->delay = 0;
	r_strbuf_init (&op->esil);
	if (ret == CS_ERR_OK) {
		cs_option (handle, CS_OPT_DETAIL, CS_OPT_ON);
		// capstone-next
		n = cs_disasm (handle, (const ut8*)buf, len, addr, 1, &insn);
		if (n<1) {
			op->type = R_ANAL_OP_TYPE_ILL;
		} else {
			op->size = insn->size;
			switch (insn->id) {
			case XCORE_INS_DRET:
			case XCORE_INS_KRET:
			case XCORE_INS_RETSP:
				op->type = R_ANAL_OP_TYPE_RET;
				break;
			case XCORE_INS_DCALL:
			case XCORE_INS_KCALL:
			case XCORE_INS_ECALLF:
			case XCORE_INS_ECALLT:
				op->type = R_ANAL_OP_TYPE_CALL;
				op->jump = INSOP(0).imm;
				break;
			/* ??? */
			case XCORE_INS_BL:
			case XCORE_INS_BLA:
			case XCORE_INS_BLAT:
			case XCORE_INS_BT:
			case XCORE_INS_BF:
			case XCORE_INS_BU:
			case XCORE_INS_BRU:
				op->type = R_ANAL_OP_TYPE_CALL;
				op->jump = INSOP(0).imm;
				break;
			case XCORE_INS_SUB:
			case XCORE_INS_LSUB:
				op->type = R_ANAL_OP_TYPE_SUB;
				break;
			case XCORE_INS_ADD:
			case XCORE_INS_LADD:
				op->type = R_ANAL_OP_TYPE_ADD;
				break;
			}

		}
		cs_free (insn, n);
		cs_close (&handle);
	}
	return op->size;
}
示例#5
0
void disasm(uint64_t addr, uint32_t offset, size_t size, cs_arch arch, cs_mode mode, uint8_t *data)
{
    int i;
    csh handle = 0;
    cs_insn *insn;
    const uint8_t *code;

    if (cs_open(arch, mode, &handle) != CS_ERR_OK) {
        printf("ERROR: Failed to initialize engine!\n");
        exit(EXIT_FAILURE);
    }

    cs_option(handle, CS_OPT_SKIPDATA, CS_OPT_ON);
    cs_option(handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_ATT);   

    printf("Disassembly of section .text:\n");

    for (i = offset; i < offset + size; i++) {
        code = &data[i];
        insn = cs_malloc(handle);

        while(cs_disasm_iter(handle, &code, &size, &addr, insn)) {
            printf("0x%"PRIx64":\t%s\t\t%s\n", insn->address, insn->mnemonic, insn->op_str);
        }
        cs_free(insn, 1);
    }
    cs_close(&handle);
}
示例#6
0
static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
	static int omode = 0;
	int mode, n, ret;
	ut64 off = a->pc;
	cs_insn* insn = NULL;
	mode = CS_MODE_BIG_ENDIAN;
	if (cd && mode != omode) {
		cs_close (&cd);
		cd = 0;
	}
	op->size = 0;
	omode = mode;
	if (cd == 0) {
		ret = cs_open (CS_ARCH_SYSZ, mode, &cd);
		if (ret) return 0;
		cs_option (cd, CS_OPT_DETAIL, CS_OPT_OFF);
	}
	n = cs_disasm (cd, (const ut8*)buf, len, off, 1, &insn);
	if (n>0) {
		if (insn->size>0) {
			op->size = insn->size;
			char *ptrstr;
			snprintf (op->buf_asm, R_ASM_BUFSIZE, "%s%s%s",
					insn->mnemonic, insn->op_str[0]?" ":"",
					insn->op_str);
			ptrstr = strstr (op->buf_asm, "ptr ");
			if (ptrstr) {
				memmove (ptrstr, ptrstr+4, strlen (ptrstr+4)+1);
			}
		}
		cs_free (insn, n);
	}
	return op->size;
}
示例#7
0
static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
	csh handle;
	cs_insn* insn;
	int mode, n, ret = -1;
	mode = a->big_endian? CS_MODE_BIG_ENDIAN: CS_MODE_LITTLE_ENDIAN;
	if (a->cpu && *a->cpu) {
		if (!strcmp (a->cpu, "v9")) {
			mode |= CS_MODE_V9;
		}
	}
	memset (op, 0, sizeof (RAsmOp));
	op->size = 4;
	ret = cs_open (CS_ARCH_SPARC, mode, &handle);
	if (ret) goto fin;
	cs_option (handle, CS_OPT_DETAIL, CS_OPT_OFF);
	n = cs_disasm (handle, (ut8*)buf, len, a->pc, 1, &insn);
	if (n<1) {
		strcpy (op->buf_asm, "invalid");
		op->size = 4;
		ret = -1;
		goto beach;
	} else ret = 4;
	if (insn->size<1)
		goto beach;
	op->size = insn->size;
	snprintf (op->buf_asm, R_ASM_BUFSIZE, "%s%s%s",
		insn->mnemonic, insn->op_str[0]? " ": "",
		insn->op_str);
	// TODO: remove the '$'<registername> in the string
	cs_free (insn, n);
	beach:
	cs_close (&handle);
	fin:
	return ret;
}
示例#8
0
/** \brief COMSTACK synopsis from manual, doc/comstack.xml */
static int comstack_example(const char *server_address_str)
{
    COMSTACK stack;
    char *buf = 0;
    int size = 0, length_incoming;
    void *server_address_ip;
    int status;

    char *protocol_package = "GET / HTTP/1.0\r\n\r\n";
    int protocol_package_length = strlen(protocol_package);

    stack = cs_create(tcpip_type, 1, PROTO_HTTP);
    if (!stack) {
        perror("cs_create");  /* use perror() here since we have no stack yet */
        return -1;
    }

    server_address_ip = cs_straddr(stack, server_address_str);
    if (!server_address_ip) {
        fprintf(stderr, "cs_straddr: address could not be resolved\n");
        return -1;
    }

    status = cs_connect(stack, server_address_ip);
    if (status) {
        fprintf(stderr, "cs_connect: %s\n", cs_strerror(stack));
        return -1;
    }

    status = cs_rcvconnect(stack);
    if (status) {
        fprintf(stderr, "cs_rcvconnect: %s\n", cs_strerror(stack));
        return -1;
    }

    status = cs_put(stack, protocol_package, protocol_package_length);
    if (status) {
        fprintf(stderr, "cs_put: %s\n", cs_strerror(stack));
        return -1;
    }

    /* Now get a response */
    length_incoming = cs_get(stack, &buf, &size);
    if (!length_incoming) {
        fprintf(stderr, "Connection closed\n");
        return -1;
    } else if (length_incoming < 0) {
        fprintf(stderr, "cs_get: %s\n", cs_strerror(stack));
        return -1;
    }

    /* Print result */
    fwrite(buf, length_incoming, 1, stdout);

    /* clean up */
    cs_close(stack);
    if (buf)
        xfree(buf);
    return 0;
}
示例#9
0
static bool the_end(void *p) {
	if (handle) {
		cs_close (&handle);
		handle = 0;
	}
	return true;
}
示例#10
0
static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
	static int omode = 0;
	int mode, n, ret;
	ut64 off = a->pc;
	cs_insn* insn;

	mode = (a->bits==64)? CS_MODE_64: 
		(a->bits==32)? CS_MODE_32: 0;
	if (handle && mode != omode) {
		cs_close (&handle);
		handle = 0;
	}
	op->size = 0;
	omode = mode;
	if (handle == 0) {
		ret = cs_open (CS_ARCH_PPC, mode, &handle);
		if (ret) return 0;
	}
	cs_option (handle, CS_OPT_DETAIL, CS_OPT_OFF);
	n = cs_disasm_ex (handle, (const ut8*)buf, len, off, 1, &insn);
	if (n>0) {
		if (insn->size>0) {
			op->size = insn->size;
			snprintf (op->buf_asm, R_ASM_BUFSIZE, "%s%s%s",
				insn->mnemonic, insn->op_str[0]?" ":"",
				insn->op_str);
		}
		cs_free (insn, n);
	}
	return op->size;
}
示例#11
0
static int the_end(void *p) {
	if (handle) {
		cs_close (&handle);
		handle = 0;
	}
	return R_TRUE;
}
示例#12
0
/*
 * We're setting up the connection in non-blocking mode, which is what
 * we want.  However, this means that the connect() (as well as
 * subsequent read()s) will be non-blocking, so that we'll need to
 * catch and service the "connection complete" callback in "receive.c"
 */
COMSTACK yaz_connect(char *addr)
{
    COMSTACK conn;
    void *inaddr;

    /* Second argument is `blocking', false => no immediate errors */
    if ((conn = cs_create_host(addr, 0, &inaddr)) == 0) {
	/* mostly likely `errno' will be ENOMEM or something useful */
        return 0;
    }

    switch (cs_connect(conn, inaddr)) {
    case -1:			/* can't connect */
	/* I think this never happens due to blocking=0 */
/*printf("cs_connect() failed\n");*/
        cs_close(conn);
        return 0;
    case 0:			/* success */
	/* I think this never happens due to blocking=0 */
/*printf("cs_connect() succeeded\n");*/
        break;
    case 1:			/* non-blocking -- "not yet" */
/*printf("cs_connect() not yet\n");*/
	break;
    }

    return conn;
}
示例#13
0
static bool the_end(void *p) {
	if (cd) {
		cs_close (&cd);
		cd = 0;
	}
	return true;
}
示例#14
0
static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
	static int omode = 0;
	int n, ret;
	ut64 off = a->pc;
	cs_insn* insn;
	
	int mode = (a->big_endian)? CS_MODE_BIG_ENDIAN: CS_MODE_LITTLE_ENDIAN;

	if (handle && mode != omode) {
		cs_close (&handle);
		handle = 0;
	}
	op->size = 0;
	omode = mode;
	op->buf_asm[0] = 0;
	if (handle == 0) {
		ret = cs_open (CS_ARCH_PPC, mode, &handle);
		if (ret) return 0;
	}
	cs_option (handle, CS_OPT_DETAIL, CS_OPT_OFF);
	n = cs_disasm (handle, (const ut8*)buf, len, off, 1, &insn);
	op->size = 4;
	if (n > 0 && insn->size > 0) {
		snprintf (op->buf_asm, R_ASM_BUFSIZE, "%s%s%s",
			insn->mnemonic, insn->op_str[0]?" ":"",
			insn->op_str);
		cs_free (insn, n);
		return op->size;
	}
	//op->size = -1;
	cs_free (insn, n);
	return 4;
}
示例#15
0
static void test()
{
#define M68K_CODE "\xf0\x10\xf0\x00\x48\xaf\xff\xff\x7f\xff\x11\xb0\x01\x37\x7f\xff\xff\xff\x12\x34\x56\x78\x01\x33\x10\x10\x10\x10\x32\x32\x32\x32\x4C\x00\x54\x04\x48\xe7\xe0\x30\x4C\xDF\x0C\x07\xd4\x40\x87\x5a\x4e\x71\x02\xb4\xc0\xde\xc0\xde\x5c\x00\x1d\x80\x71\x12\x01\x23\xf2\x3c\x44\x22\x40\x49\x0e\x56\x54\xc5\xf2\x3c\x44\x00\x44\x7a\x00\x00\xf2\x00\x0a\x28\x4E\xB9\x00\x00\x00\x12\x4E\x75"
	struct platform platforms[] = {
		{
			CS_ARCH_M68K,
			(cs_mode)(CS_MODE_BIG_ENDIAN | CS_MODE_M68K_040),
			(unsigned char*)M68K_CODE,
			sizeof(M68K_CODE) - 1,
			"M68K",
		},
	};

	uint64_t address = 0x01000;
	cs_insn *insn;
	int i;
	size_t count;

	for (i = 0; i < sizeof(platforms)/sizeof(platforms[0]); i++) {
		cs_err err = cs_open(platforms[i].arch, platforms[i].mode, &handle);
		if (err) {
			printf("Failed on cs_open() with error returned: %u\n", err);
			abort();
		}

		cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON);

		count = cs_disasm(handle, platforms[i].code, platforms[i].size, address, 0, &insn);
		if (count) {
			size_t j;

			printf("****************\n");
			printf("Platform: %s\n", platforms[i].comment);
			print_string_hex("Code: ", platforms[i].code, platforms[i].size);
			printf("Disasm:\n");

			for (j = 0; j < count; j++) {
				assert(address == insn[j].address && "this means the size of the previous instruction was incorrect");
				address += insn[j].size;
				printf("0x%" PRIx64 ":\t%s\t%s\n", insn[j].address, insn[j].mnemonic, insn[j].op_str);
				print_insn_detail(&insn[j]);
			}
			printf("0x%" PRIx64 ":\n", insn[j-1].address + insn[j-1].size);

			// free memory allocated by cs_disasm()
			cs_free(insn, count);
		} else {
			printf("****************\n");
			printf("Platform: %s\n", platforms[i].comment);
			print_string_hex("Code:", platforms[i].code, platforms[i].size);
			printf("ERROR: Failed to disasm given code!\n");
			abort();
		}

		printf("\n");

		cs_close(&handle);
	}
}
示例#16
0
static void test()
{
#define SYSZ_CODE "\xed\x00\x00\x00\x00\x1a\x5a\x0f\x1f\xff\xc2\x09\x80\x00\x00\x00\x07\xf7\xeb\x2a\xff\xff\x7f\x57\xe3\x01\xff\xff\x7f\x57\xeb\x00\xf0\x00\x00\x24\xb2\x4f\x00\x78\xec\x18\x00\x00\xc1\x7f"

	struct platform platforms[] = {
		{
			CS_ARCH_SYSZ,
			CS_MODE_BIG_ENDIAN,
			(unsigned char*)SYSZ_CODE,
			sizeof(SYSZ_CODE) - 1,
			"SystemZ",
		},
	};

	uint64_t address = 0x1000;
	cs_insn *insn;
	int i;
	size_t count;

	for (i = 0; i < sizeof(platforms)/sizeof(platforms[0]); i++) {
		cs_err err = cs_open(platforms[i].arch, platforms[i].mode, &handle);
		if (err) {
			printf("Failed on cs_open() with error returned: %u\n", err);
			continue;
		}

		cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON);

		count = cs_disasm(handle, platforms[i].code, platforms[i].size, address, 0, &insn);
		if (count) {
			size_t j;

			printf("****************\n");
			printf("Platform: %s\n", platforms[i].comment);
			print_string_hex("Code:", platforms[i].code, platforms[i].size);
			printf("Disasm:\n");

			for (j = 0; j < count; j++) {
				printf("0x%"PRIx64":\t%s\t%s\n", insn[j].address, insn[j].mnemonic, insn[j].op_str);
				print_insn_detail(&insn[j]);
			}
			printf("0x%"PRIx64":\n", insn[j-1].address + insn[j-1].size);

			// free memory allocated by cs_disasm()
			cs_free(insn, count);
		} else {
			printf("****************\n");
			printf("Platform: %s\n", platforms[i].comment);
			print_string_hex("Code:", platforms[i].code, platforms[i].size);
			printf("ERROR: Failed to disasm given code!\n");
		}

		printf("\n");

		cs_close(&handle);
	}
}
示例#17
0
int main()
{
    pthread_t t[2];
    cs_open("/sem",1);
    pthread_create(t,NULL,t1,NULL);
    sleep(1);
    pthread_create(t+1,NULL,t2,NULL);
    pthread_join(t[0],NULL);
    pthread_join(t[1],NULL);
    cs_close("/sem");
    return 0;
}
示例#18
0
static bool the_end(void *p) {
#if !USE_ITER_API
	if (insn) {
		cs_free (insn, n);
		insn = NULL;
	}
#endif
	if (cd) {
		cs_close (&cd);
		cd = 0;
	}
	return true;
}
示例#19
0
static int the_end(void *p) {
#if !USE_ITER_API
	if (insn) {
		cs_free (insn, n);
		insn = NULL;
	}
#endif
	if (cd) {
		cs_close (&cd);
		cd = 0;
	}
	return R_TRUE;
}
示例#20
0
static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
	cs_insn* insn = NULL;
	cs_mode mode = 0;
	int ret, n = 0;
	csh cd;
	mode = (a->bits==16)? CS_MODE_THUMB: CS_MODE_ARM;
	if (a->big_endian)
		mode |= CS_MODE_BIG_ENDIAN;
	else
		mode |= CS_MODE_LITTLE_ENDIAN;

	if (a->cpu && strstr (a->cpu, "m"))
		mode |= CS_MODE_MCLASS;
	if (a->cpu && strstr (a->cpu, "v8"))
		mode |= CS_MODE_V8;
	op->size = 4;
	op->buf_asm[0] = 0;
	ret = (a->bits==64)?
		cs_open (CS_ARCH_ARM64, mode, &cd):
		cs_open (CS_ARCH_ARM, mode, &cd);
	if (ret) {
		ret = -1;
		goto beach;
	}
	if (a->syntax == R_ASM_SYNTAX_REGNUM) {
		cs_option (cd, CS_OPT_SYNTAX, CS_OPT_SYNTAX_NOREGNAME);
	} else cs_option (cd, CS_OPT_SYNTAX, CS_OPT_SYNTAX_DEFAULT);
	cs_option (cd, CS_OPT_DETAIL, CS_OPT_OFF);
	n = cs_disasm (cd, buf, R_MIN (4, len),
		a->pc, 1, &insn);
	if (n<1) {
		ret = -1;
		goto beach;
	}
	if (insn->size<1) {
		ret = -1;
		goto beach;
	}
	op->size = insn->size;
	snprintf (op->buf_asm, R_ASM_BUFSIZE, "%s%s%s",
		insn->mnemonic,
		insn->op_str[0]?" ":"",
		insn->op_str);
	r_str_rmch (op->buf_asm, '#');
	cs_free (insn, n);
	beach:
	cs_close (&cd);
	if (!op->buf_asm[0])
		strcpy (op->buf_asm, "invalid");
	return op->size;
}
示例#21
0
文件: main.c 项目: AmesianX/capstone
static int teardown_issue(void **state)
{
	if (e_flag == 0)
		while (counter < size_lines && strncmp(list_lines[counter], "!# ", 3))
			counter++;
	else
		while (counter < size_lines && strncmp(list_lines[counter], "// !# ", 6))
			counter++;

	cs_close(*state);
	free(*state);
	function = NULL;
	return 0;
}
示例#22
0
void MCParser::reset(cs_arch arch, cs_mode mode) {
    if(valid())
        cs_close(&m_handle);
    m_arch = arch;
    m_mode = mode;
    cs_err err_no;
    err_no = cs_open(m_arch, m_mode, &m_handle);
    if (err_no) {
        throw std::runtime_error("Failed on cs_open() "
                                     "with error returned:" + err_no);
    }
    cs_option(m_handle, CS_OPT_DETAIL, CS_OPT_ON);
    m_valid = true;
}
示例#23
0
static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
	cs_insn* insn;
	int mode, n, ret = -1;
	mode = CS_MODE_BIG_ENDIAN;
	if (!op) {
		return 0;
	}
	// mode |= (a->bits == 64)? CS_MODE_64: CS_MODE_32;
	memset (op, 0, sizeof (RAsmOp));
	op->size = 4;
	if (cd != 0) {
		cs_close (&cd);
	}
	ret = cs_open (CS_ARCH_TMS320C64X, mode, &cd);
	if (ret) {
		goto fin;
	}
	if (a->syntax == R_ASM_SYNTAX_REGNUM) {
		cs_option (cd, CS_OPT_SYNTAX, CS_OPT_SYNTAX_NOREGNAME);
	} else {
		cs_option (cd, CS_OPT_SYNTAX, CS_OPT_SYNTAX_DEFAULT);
	}
	cs_option (cd, CS_OPT_DETAIL, CS_OPT_OFF);
	n = cs_disasm (cd, (ut8*)buf, len, a->pc, 1, &insn);
	if (n < 1) {
		strcpy (op->buf_asm, "invalid");
		op->size = 4;
		goto beach;
	} else {
		ret = 4;
	}
	if (insn->size < 1) {
		goto beach;
	}
	op->size = insn->size;
	snprintf (op->buf_asm, R_ASM_BUFSIZE, "%s%s%s",
		insn->mnemonic, insn->op_str[0]? " ": "",
		insn->op_str);
	// r_str_replace_in (op->buf_asm, sizeof (op->buf_asm), "*+", "", 1);
	// nasty, the disasm output comes with tabs and uppercase :(
	r_str_replace_char (op->buf_asm, '\t', 0);
	// r_str_replace_in (op->buf_asm, sizeof (op->buf_asm), "\t", "", 1);
	r_str_case (op->buf_asm, false);
	cs_free (insn, n);
beach:
	// cs_close (&cd);
fin:
	return op->size;
}
示例#24
0
static cs_insn *
disassemble_instruction_at (gconstpointer address)
{
  csh capstone;
  cs_insn * insn = NULL;

  cs_open (CS_ARCH_ARM64, CS_MODE_LITTLE_ENDIAN, &capstone);
  cs_option (capstone, CS_OPT_DETAIL, CS_OPT_ON);

  cs_disasm (capstone, address, 16, GPOINTER_TO_SIZE (address), 1, &insn);

  cs_close (&capstone);

  return insn;
}
示例#25
0
文件: wtfile.c 项目: endeav0r/wtfile
void check_disassembly (const unsigned char * buf, size_t size) {
    unsigned int i;

    struct _wtfile_writer * ww = wtfile_writer_open("disassembly.txt");

    if (size < DISASM_SIZE)
        return;

    for (i = 0; capstone_ops[i].description != NULL; i++) {
        struct _capstone_op * cop = &capstone_ops[i];

        csh handle;
        cs_insn * insn;
        size_t count;

        if (cs_open(cop->arch, cop->mode, &handle) != CS_ERR_OK) {
            fprintf(stderr,
                    "error opening %s in capstone, results may be incomplete\n",
                    cop->description);
            continue;
        }

        size_t offset = 0;
        for (offset = 0; offset < size - DISASM_SIZE; offset++) {
            if (offset > DISASM_LIMIT)
                break;
            count = cs_disasm(handle, &(buf[offset]), DISASM_SIZE, 0, 0, &insn);
            if (count > (DISASM_SIZE / 8)) {
                char tmp[4096];
/*************************** RESET INDENT *******************************/
uint32_t t;
t = snprintf(tmp, 4096, "--------------------------------------\n");
t += snprintf(&(tmp[t]), 4096 - t,
             "Possible disassembly for %s starting at 0x%x\n",
             cop->description, offset);
unsigned int j;
for (j = 0; j < 4; j++) {
    t += snprintf(&(tmp[t]), 4096 - t, "%s\t%s\n", insn[j].mnemonic, insn[j].op_str);
}
t += snprintf(&(tmp[t]), 4096 - t, "\n");

wtfile_writer_write(ww, tmp, strlen(tmp));
            }
            if (count > 0) cs_free(insn, count);
        }
        cs_close(&handle);
    }
}
示例#26
0
int instruction_length_at_address(uint64_t address) {
  csh handle;
  cs_insn *insn;
  size_t count;
  int retval = 0;

  if (cs_open(CS_ARCH_X86, CS_MODE_64, &handle) != CS_ERR_OK)
    return -1;
  count = cs_disasm_ex(handle, (uint8_t *)address, 12, 0x1000, 0, &insn);
  if (count > 0) {
    retval = insn[0].size;
    cs_free(insn, count);
  }
  cs_close(&handle);
  return retval;
}
示例#27
0
static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
	static int omode = -1, obits = -1;
	int n, ret;
	ut64 off = a->pc;
	cs_insn* insn;
	int mode = (a->bits == 64) ? CS_MODE_64 : (a->bits == 32) ? CS_MODE_32 : 0;
	mode |= a->big_endian ? CS_MODE_BIG_ENDIAN : CS_MODE_LITTLE_ENDIAN;

	if (a->cpu && strncmp (a->cpu, "vle", 3) == 0) {
		// vle is big-endian only
		if (!a->big_endian) {
			return -1;
		}
		ret = decompile_vle (a, op, buf, len);
		if (ret >= 0) {
			return op->size;
		}
	}
	if (mode != omode || a->bits != obits) {
		cs_close (&handle);
		handle = 0;
		omode = mode;
		obits = a->bits;
	}
	if (handle == 0) {
		ret = cs_open (CS_ARCH_PPC, mode, &handle);
		if (ret != CS_ERR_OK) {
			return -1;
		}
	}
	op->size = 4;
	op->buf_asm[0] = 0;
	cs_option (handle, CS_OPT_DETAIL, CS_OPT_OFF);

	n = cs_disasm (handle, (const ut8*) buf, len, off, 1, &insn);
	op->size = 4;
	if (n > 0 && insn->size > 0) {
		snprintf (op->buf_asm, R_ASM_BUFSIZE, "%s%s%s",
				insn->mnemonic, insn->op_str[0] ? " " : "",
				insn->op_str);
		cs_free (insn, n);
		return op->size;
	}
	//op->size = -1;
	cs_free (insn, n);
	return 4;
}
示例#28
0
COMSTACK cs_create_host_proxy(const char *vhost, int blocking, void **vp,
                              const char *proxy_host)
{
    enum oid_proto proto = PROTO_Z3950;
    const char *host = 0;
    COMSTACK cs;
    CS_TYPE t;
    char *connect_host = 0;

    if (!cs_parse_host(vhost, &host, &t, &proto, &connect_host))
        return 0;

    if (proxy_host)
    {
        enum oid_proto proto1;

        xfree(connect_host);
        if (!cs_parse_host(proxy_host, &host, &t, &proto1, &connect_host))
            return 0;
    }

    if (t == tcpip_type)
    {
        const char *bind_host = strchr(vhost, ' ');
        if (bind_host && bind_host[1])
            bind_host++;
        else
            bind_host = 0;
        cs = yaz_tcpip_create2(-1, blocking, proto, connect_host ? host : 0,
                               bind_host);
    }
    else
    {
        cs = cs_create(t, blocking, proto);
    }
    if (cs)
    {
        if (!(*vp = cs_straddr(cs, connect_host ? connect_host : host)))
        {
            cs_close (cs);
            cs = 0;
        }
    }
    xfree(connect_host);
    return cs;
}
示例#29
0
static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
	csh handle;
	cs_insn* insn;
	int mode, n, ret = -1;
	mode = a->big_endian? CS_MODE_BIG_ENDIAN: CS_MODE_LITTLE_ENDIAN;
	if (a->cpu && *a->cpu) {
		if (!strcmp (a->cpu, "gp64")) {
			mode |= CS_MODE_MIPSGP64;
		} else if (!strcmp (a->cpu, "micro")) {
			mode |= CS_MODE_MICRO;
		} else if (!strcmp (a->cpu, "r6")) {
			mode |= CS_MODE_MIPS32R6;
		} else if (!strcmp (a->cpu, "v3")) {
			mode |= CS_MODE_MIPS3;
		}
	}
	mode |= (a->bits==64)? CS_MODE_64: CS_MODE_32;
	memset (op, 0, sizeof (RAsmOp));
	op->size = 4;
	ret = cs_open (CS_ARCH_MIPS, mode, &handle);
	if (ret) goto fin;
	if (a->syntax == R_ASM_SYNTAX_REGNUM) {
		cs_option (handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_NOREGNAME);
	} else cs_option (handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_DEFAULT);
	cs_option (handle, CS_OPT_DETAIL, CS_OPT_OFF);
	n = cs_disasm (handle, (ut8*)buf, len, a->pc, 1, &insn);
	if (n<1) {
		strcpy (op->buf_asm, "invalid");
		op->size = 4;
		ret = -1;
		goto beach;
	} else ret = 4;
	if (insn->size<1)
		goto beach;
	op->size = insn->size;
	snprintf (op->buf_asm, R_ASM_BUFSIZE, "%s%s%s",
		insn->mnemonic, insn->op_str[0]? " ": "",
		insn->op_str);
	// remove the '$'<registername> in the string
	r_str_replace_char (op->buf_asm, '$', 0);
	cs_free (insn, n);
	beach:
	cs_close (&handle);
	fin:
	return op->size;
}
示例#30
0
static cs_insn *
disassemble_instruction_at (gconstpointer address)
{
  csh capstone;
  cs_err err;
  cs_insn * insn = NULL;

  err = cs_open (CS_ARCH_ARM, CS_MODE_ARM, &capstone);
  g_assert (err == CS_ERR_OK);
  err = cs_option (capstone, CS_OPT_DETAIL, CS_OPT_ON);
  g_assert (err == CS_ERR_OK);

  cs_disasm (capstone, address, 4, GPOINTER_TO_SIZE (address), 1, &insn);

  cs_close (&capstone);

  return insn;
}