Questions tagged [capstone]

A lightweight multi-platform, multi-architecture disassembly framework.

Filter by
Sorted by
Tagged with
4 votes
1 answer
2k views

Limitations of capstone's disassembly capabilities compared to IDA

I was wondering if there are any limitations of capstone's disassembling capabilities when compared to IDA. If yes, are those limitations inherent, i.e. a result of the different design/techniques ...
langlauf.io's user avatar
  • 1,560
2 votes
1 answer
1k views

Capstone: What's the purpose of the 'address' argument in cs_disasm()?

I'm trying to play around with the Capstone Disassembler in C. In the documentation they show the following use of the cs_disasm() function: from here count = cs_disasm(handle, CODE, sizeof(CODE)-1, ...
shaqed's user avatar
  • 133
2 votes
0 answers
146 views

RISC-V assembler with strong Python support?

I'm using the Capstone disassembler for decoding a RISC-V ELF binary but need the ability to reassemble modifications that I'm making to it programmatically to accomplish a reverse-engineering goal. ...
dingo_kinznerhook's user avatar
2 votes
0 answers
368 views

Capstone in reverse mode

I am using capstone in python in order to dissassemble binary instructions. Is there a way to work in the reverse mode ? I mean typing some asm instructions and ask capstone (in python) to generate ...
Bob5421's user avatar
  • 797
1 vote
1 answer
156 views

capstone disasm framework - check if argument read/written

I cam using the capstone disassembly framework to disassemble intel x86 code. I need to find out which operands are read to or written from (or both). According to the website, this is possible by ...
bernd feinman's user avatar
1 vote
1 answer
96 views

Capstone not disassembling vpunpcklqdq, vprold, and vshufi32x4

I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the vshufi32x4 instruction: from capstone import * from capstone.x86 ...
langlauf.io's user avatar
  • 1,560
1 vote
0 answers
308 views

UC_ERR_WRITE_UNMAPPED when emulation starts on binary

Whenever I try to emulate my obfuscated driver it fails at uc_emu_start with UC_ERR_WRITE_UNMAPPED. I get all success return codes on: uc_mem_map and uc_mem_write but when I call uc_emu_start ; I get ...
Ayyware's user avatar
  • 41
1 vote
0 answers
327 views

Pointer disassembly

I'm using the Capstone engine to develop an ELF disassembler. I have implemented a linear sweep algorithm as the most basic version. My goal is to implement the recursive traversal now. Consider ...
Marius.pharoe's user avatar
0 votes
1 answer
335 views

Operand address in Capstone disassembly is not the same as in IDA/HIEW

I'm trying to disassembly x64 executable (dll) using Capstone. But operand address returned by it doesn't match disassembly from IDA/HIEW. Here is the machine code: 0x48, 0x8D, 0x0D, 0xED, 0x44, ...
beatcracker's user avatar
0 votes
1 answer
77 views

Displacement size (disp_size) of x86 instructions

Given the opcode 80 3d 1d b0 09 00 00. The corresponding capstone instruction is <CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0> and has the following properties (c_i being ...
langlauf.io's user avatar
  • 1,560
0 votes
1 answer
95 views

What should the instruction string be for capstone

The following program doesn't correctly disassemble string "d280001d", it just outputs: 0x1000: I also tried "\xd2\x80\x00\x1d", which I got from shell-storm.org, still got the ...
yeeha's user avatar
  • 1
0 votes
1 answer
437 views

How to DUMP the full hexa of each function extracted by analysis of binary file?

I used a script python from radare2-bindings to write a code analysing a binary file, i extracted the name , the start address and the size of each function , but i can't dump the hexa of each ...
Y.hadj.younes's user avatar