Questions tagged [capstone]
A lightweight multi-platform, multi-architecture disassembly framework.
12
questions
4
votes
1
answer
2k
views
Limitations of capstone's disassembly capabilities compared to IDA
I was wondering if there are any limitations of capstone's disassembling capabilities when compared to IDA.
If yes, are those limitations inherent, i.e. a result of the different design/techniques ...
2
votes
1
answer
1k
views
Capstone: What's the purpose of the 'address' argument in cs_disasm()?
I'm trying to play around with the Capstone Disassembler in C.
In the documentation they show the following use of the cs_disasm() function:
from here
count = cs_disasm(handle, CODE, sizeof(CODE)-1, ...
2
votes
0
answers
146
views
RISC-V assembler with strong Python support?
I'm using the Capstone disassembler for decoding a RISC-V ELF binary but need the ability to reassemble modifications that I'm making to it programmatically to accomplish a reverse-engineering goal. ...
2
votes
0
answers
368
views
Capstone in reverse mode
I am using capstone in python in order to dissassemble binary instructions.
Is there a way to work in the reverse mode ? I mean typing some asm instructions and ask capstone (in python) to generate ...
1
vote
1
answer
156
views
capstone disasm framework - check if argument read/written
I cam using the capstone disassembly framework to disassemble intel x86 code. I need to find out which operands are read to or written from (or both). According to the website, this is possible by ...
1
vote
1
answer
96
views
Capstone not disassembling vpunpcklqdq, vprold, and vshufi32x4
I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the vshufi32x4 instruction:
from capstone import *
from capstone.x86 ...
1
vote
0
answers
308
views
UC_ERR_WRITE_UNMAPPED when emulation starts on binary
Whenever I try to emulate my obfuscated driver it fails at uc_emu_start with UC_ERR_WRITE_UNMAPPED. I get all success return codes on: uc_mem_map and uc_mem_write but when I call uc_emu_start ; I get ...
1
vote
0
answers
327
views
Pointer disassembly
I'm using the Capstone engine to develop an ELF disassembler. I have implemented a linear sweep algorithm as the most basic version.
My goal is to implement the recursive traversal now.
Consider ...
0
votes
1
answer
335
views
Operand address in Capstone disassembly is not the same as in IDA/HIEW
I'm trying to disassembly x64 executable (dll) using Capstone. But operand address returned by it doesn't match disassembly from IDA/HIEW.
Here is the machine code:
0x48, 0x8D, 0x0D, 0xED, 0x44, ...
0
votes
1
answer
77
views
Displacement size (disp_size) of x86 instructions
Given the opcode 80 3d 1d b0 09 00 00.
The corresponding capstone instruction is
<CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0>
and has the following properties (c_i being ...
0
votes
1
answer
95
views
What should the instruction string be for capstone
The following program doesn't correctly disassemble string "d280001d", it just outputs:
0x1000:
I also tried "\xd2\x80\x00\x1d", which I got from shell-storm.org, still got the ...
0
votes
1
answer
437
views
How to DUMP the full hexa of each function extracted by analysis of binary file?
I used a script python from radare2-bindings to write a code analysing a binary file, i extracted the name , the start address and the size of each function , but i can't dump the hexa of each ...