Capstone: What's the purpose of the 'address' argument in cs_disasm()?

Question

I'm trying to play around with the Capstone Disassembler in C.

In the documentation they show the following use of the cs_disasm() function: from here

count = cs_disasm(handle, CODE, sizeof(CODE)-1, 0x1000, 0, &insn)

The thing that bugs me is that 0x1000. In the documentation (source code actually) it says:

@address: address of the first instruction in given raw code buffer.

I can't really understand what does that really mean, because from what I understand the insn array is being dynamically allocated and filled, and that's where the instructions will reside (or are they?)

Why is it a fixed value like 0x1000? is that actually address in the memory of the program? (isn't that an illegal address space for a C program to use?)

Thanks in advance

Answer 1

that address is the virtual address you want to disassemble

for example you have a relative jump

the opcodes will be say 0x74 {imm } where {imm} is relative to the current address either in positive direction or in negative direction

so if the current address is 0x1000 a relative jump with {5} imm from 0x1000 in positive direction should land you in in 0x1005

if the address was 0x2000 it should land you in 0x2005

that is the disassembly on the current line should state

jmp 0x1005 or jmp 0x2005 etc etc

if you do not give the address the disassembly will just say jmp 5

here is a piece of similar python code

Python 2.7 (32-bit) interactive window [PTVS 15.6.18072.2-15.0]

>>> from capstone import *
>>> CODE = b"\x74\xd9"
>>> md = Cs(CS_ARCH_X86,CS_MODE_32)
>>> for i in md.disasm(CODE , 0x1000):
...     print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))
... 
0x1000: je  0xfdb  <<<< (0x1000 - 0x25)

>>> for i in md.disasm(CODE , 0x25):
...     print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))
... 
0x25:   je  0    <<<< (0x25 - 0x25)