The following program doesn't correctly disassemble string "d280001d", it just outputs:
0x1000:
I also tried "\xd2\x80\x00\x1d", which I got from shell-storm.org, still got the same issue. Anybody can help me on what is going wrong? I cannot find explanation about what kind of input string format capstone expects. Thanks
#include <stdio.h>
#include <inttypes.h>
#include <capstone/capstone.h>
#define CODE "1d0080d2" // expect: movz x29, #0
int main(void)
{
csh handle;
cs_insn *insn;
size_t count;
//if (cs_open(CS_ARCH_ARM64, CS_MODE_ARM, &handle) != CS_ERR_OK)
if (cs_open(CS_ARCH_ARM64, CS_MODE_ARM, &handle) != CS_ERR_OK)
return -1;
count = cs_disasm(handle, CODE, sizeof(CODE)-1, 0x1000, 0, &insn);
if (count > 0) {
size_t j;
for (j = 0; j < count; j++) {
// Assembly code address Address ,mnemonic It's the opcode ,op_str It's the operands
printf("0x%"PRIx64":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic,
insn[j].op_str);
}
cs_free(insn, count);
} else
printf("ERROR: Failed to disassemble given code!\n");
cs_close(&handle);
return 0;
}