0

The following program doesn't correctly disassemble string "d280001d", it just outputs:

0x1000:

I also tried "\xd2\x80\x00\x1d", which I got from shell-storm.org, still got the same issue. Anybody can help me on what is going wrong? I cannot find explanation about what kind of input string format capstone expects. Thanks

#include <stdio.h>
#include <inttypes.h>
#include <capstone/capstone.h>
#define CODE "1d0080d2" // expect: movz  x29, #0

int main(void)
{

  csh handle;
  cs_insn *insn;
  size_t count;
  //if (cs_open(CS_ARCH_ARM64, CS_MODE_ARM, &handle) != CS_ERR_OK)
  if (cs_open(CS_ARCH_ARM64, CS_MODE_ARM, &handle) != CS_ERR_OK)
    return -1;

  count = cs_disasm(handle, CODE, sizeof(CODE)-1, 0x1000, 0, &insn);
  if (count > 0) {
    size_t j;
    for (j = 0; j < count; j++) {
      // Assembly code address Address ,mnemonic It's the opcode ,op_str It's the operands 
      printf("0x%"PRIx64":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic,
      insn[j].op_str);
    }
    cs_free(insn, count);
  } else
    printf("ERROR: Failed to disassemble given code!\n");

  cs_close(&handle);
  return 0;
}

1 Answer 1

1

You CODE def needs the data formatted like this:

#define CODE "\x1d\x00\x80\xd2" // expect: movz  x29, #0

You don't need to change the endian format, please see the Capstone docs for guidance: https://www.capstone-engine.org/lang_c.html

Output:

$ ./cap 
0x1000: movz        x29, #0
3
  • Thanks for the help. I actually tried different enumeration of the 4 byte orders (including "\x1d\x00\x80\xd2") and nothing works. I am wondering if there is something wrong with the way I build my capstone.
    – yeeha
    Jul 17, 2022 at 15:42
  • I built capstone with the following command: CAPSTONE_ARCHS="aarch64" CAPSTONE_USE_SYS_DYN_MEM=no CAPSTONE_DIET=yes CAPSTONE_X86_REDUCE=yes sh -x ./make.sh debug
    – yeeha
    Jul 17, 2022 at 16:01
  • I didn't do anything special: gcc -lcapstone -o cap cap.c Jul 17, 2022 at 22:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.