1 This directory contains cstool of Capstone Engine. 2 3 Cstool is a command-line tool to disassemble assembly hex-string. 4 For example, to decode a hexcode string for Intel 32bit, run: 5 6 $ cstool x32 "90 91" 7 8 0 90 nop 9 1 91 xchg eax, ecx 10 11 Cstool disassembles the input and prints out the assembly instructions. 12 On each line, the first column is the instruction offset, the second 13 column is opcodes, and the rest is the instruction itself. 14 15 Cstool is flexible enough to accept all kind of hexcode format. The following 16 inputs have the same output with the example above. 17 18 $ cstool x32 "0x90 0x91" 19 $ cstool x32 "\x90\x91" 20 $ cstool x32 "90,91" 21 $ cstool x32 "90;91" 22 $ cstool x32 "90+91" 23 $ cstool x32 "90:91" 24 25 To print out instruction details, run Cstool with -d option, like below. 26 27 $ cstool -d x32 "01 d8" 28 0 01d8 add eax, ebx 29 Prefix:0x00 0x00 0x00 0x00 30 Opcode:0x01 0x00 0x00 0x00 31 rex: 0x0 32 addr_size: 4 33 modrm: 0xd8 34 disp: 0x0 35 sib: 0x0 36 op_count: 2 37 operands[0].type: REG = eax 38 operands[0].size: 4 39 operands[1].type: REG = ebx 40 operands[1].size: 4 41 42 To see all the supported options, run ./cstool 43
