What should the instruction string be for capstone

Question

The following program doesn't correctly disassemble string "d280001d", it just outputs:

0x1000:

I also tried "\xd2\x80\x00\x1d", which I got from shell-storm.org, still got the same issue. Anybody can help me on what is going wrong? I cannot find explanation about what kind of input string format capstone expects. Thanks

#include <stdio.h>
#include <inttypes.h>
#include <capstone/capstone.h>
#define CODE "1d0080d2" // expect: movz  x29, #0

int main(void)
{

  csh handle;
  cs_insn *insn;
  size_t count;
  //if (cs_open(CS_ARCH_ARM64, CS_MODE_ARM, &handle) != CS_ERR_OK)
  if (cs_open(CS_ARCH_ARM64, CS_MODE_ARM, &handle) != CS_ERR_OK)
    return -1;

  count = cs_disasm(handle, CODE, sizeof(CODE)-1, 0x1000, 0, &insn);
  if (count > 0) {
    size_t j;
    for (j = 0; j < count; j++) {
      // Assembly code address Address ,mnemonic It's the opcode ,op_str It's the operands 
      printf("0x%"PRIx64":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic,
      insn[j].op_str);
    }
    cs_free(insn, count);
  } else
    printf("ERROR: Failed to disassemble given code!\n");

  cs_close(&handle);
  return 0;
}

Answer 1

You CODE def needs the data formatted like this:

#define CODE "\x1d\x00\x80\xd2" // expect: movz  x29, #0

You don't need to change the endian format, please see the Capstone docs for guidance: https://www.capstone-engine.org/lang_c.html

Output:

$ ./cap 
0x1000: movz        x29, #0