1 /* Capstone Disassembler Engine */ 2 /* By Nguyen Anh Quynh <aquynh (at) gmail.com>, 2013> */ 3 4 #include <stdio.h> 5 #include <stdlib.h> 6 7 #include <platform.h> 8 #include <capstone.h> 9 10 static csh handle; 11 12 struct platform { 13 cs_arch arch; 14 cs_mode mode; 15 unsigned char *code; 16 size_t size; 17 char *comment; 18 }; 19 20 static void print_string_hex(char *comment, unsigned char *str, size_t len) 21 { 22 unsigned char *c; 23 24 printf("%s", comment); 25 for (c = str; c < str + len; c++) { 26 printf("0x%02x ", *c & 0xff); 27 } 28 29 printf("\n"); 30 } 31 32 static void print_insn_detail(cs_insn *ins) 33 { 34 cs_arm64 *arm64; 35 int i; 36 37 // detail can be NULL if SKIPDATA option is turned ON 38 if (ins->detail == NULL) 39 return; 40 41 arm64 = &(ins->detail->arm64); 42 if (arm64->op_count) 43 printf("\top_count: %u\n", arm64->op_count); 44 45 for (i = 0; i < arm64->op_count; i++) { 46 cs_arm64_op *op = &(arm64->operands[i]); 47 switch(op->type) { 48 default: 49 break; 50 case ARM64_OP_REG: 51 printf("\t\toperands[%u].type: REG = %s\n", i, cs_reg_name(handle, op->reg)); 52 break; 53 case ARM64_OP_IMM: 54 printf("\t\toperands[%u].type: IMM = 0x%" PRIx64 "\n", i, op->imm); 55 break; 56 case ARM64_OP_FP: 57 #if defined(_KERNEL_MODE) 58 // Issue #681: Windows kernel does not support formatting float point 59 printf("\t\toperands[%u].type: FP = <float_point_unsupported>\n", i); 60 #else 61 printf("\t\toperands[%u].type: FP = %f\n", i, op->fp); 62 #endif 63 break; 64 case ARM64_OP_MEM: 65 printf("\t\toperands[%u].type: MEM\n", i); 66 if (op->mem.base != ARM64_REG_INVALID) 67 printf("\t\t\toperands[%u].mem.base: REG = %s\n", i, cs_reg_name(handle, op->mem.base)); 68 if (op->mem.index != ARM64_REG_INVALID) 69 printf("\t\t\toperands[%u].mem.index: REG = %s\n", i, cs_reg_name(handle, op->mem.index)); 70 if (op->mem.disp != 0) 71 printf("\t\t\toperands[%u].mem.disp: 0x%x\n", i, op->mem.disp); 72 73 break; 74 case ARM64_OP_CIMM: 75 printf("\t\toperands[%u].type: C-IMM = %u\n", i, (int)op->imm); 76 break; 77 case ARM64_OP_REG_MRS: 78 printf("\t\toperands[%u].type: REG_MRS = 0x%x\n", i, op->reg); 79 break; 80 case ARM64_OP_REG_MSR: 81 printf("\t\toperands[%u].type: REG_MSR = 0x%x\n", i, op->reg); 82 break; 83 case ARM64_OP_PSTATE: 84 printf("\t\toperands[%u].type: PSTATE = 0x%x\n", i, op->pstate); 85 break; 86 case ARM64_OP_SYS: 87 printf("\t\toperands[%u].type: SYS = 0x%x\n", i, op->sys); 88 break; 89 case ARM64_OP_PREFETCH: 90 printf("\t\toperands[%u].type: PREFETCH = 0x%x\n", i, op->prefetch); 91 break; 92 case ARM64_OP_BARRIER: 93 printf("\t\toperands[%u].type: BARRIER = 0x%x\n", i, op->barrier); 94 break; 95 } 96 97 if (op->shift.type != ARM64_SFT_INVALID && 98 op->shift.value) 99 printf("\t\t\tShift: type = %u, value = %u\n", 100 op->shift.type, op->shift.value); 101 102 if (op->ext != ARM64_EXT_INVALID) 103 printf("\t\t\tExt: %u\n", op->ext); 104 105 if (op->vas != ARM64_VAS_INVALID) 106 printf("\t\t\tVector Arrangement Specifier: 0x%x\n", op->vas); 107 108 if (op->vess != ARM64_VESS_INVALID) 109 printf("\t\t\tVector Element Size Specifier: %u\n", op->vess); 110 111 if (op->vector_index != -1) 112 printf("\t\t\tVector Index: %u\n", op->vector_index); 113 } 114 115 if (arm64->update_flags) 116 printf("\tUpdate-flags: True\n"); 117 118 if (arm64->writeback) 119 printf("\tWrite-back: True\n"); 120 121 if (arm64->cc) 122 printf("\tCode-condition: %u\n", arm64->cc); 123 124 printf("\n"); 125 } 126 127 static void test() 128 { 129 //#define ARM64_CODE "\xe1\x0b\x40\xb9" // ldr w1, [sp, #0x8] 130 //#define ARM64_CODE "\x21\x7c\x00\x53" // lsr w1, w1, #0x0 131 //#define ARM64_CODE "\x21\x7c\x02\x9b" 132 //#define ARM64_CODE "\x20\x04\x81\xda" // csneg x0, x1, x1, eq | cneg x0, x1, ne 133 //#define ARM64_CODE "\x20\x08\x02\x8b" // add x0, x1, x2, lsl #2 134 135 //#define ARM64_CODE "\x20\xcc\x20\x8b" 136 //#define ARM64_CODE "\xe2\x8f\x40\xa9" // ldp x2, x3, [sp, #8] 137 //#define ARM64_CODE "\x20\x40\x60\x1e" // fmov d0, d1 138 //#define ARM64_CODE "\x20\x7c\x7d\x93" // sbfiz x0, x1, #3, #32 139 140 //#define ARM64_CODE "\x20\x88\x43\xb3" // bfxil x0, x1, #3, #32 141 //#define ARM64_CODE "\x01\x71\x08\xd5" // sys #0, c7, c1, #0, x1 142 //#define ARM64_CODE "\x00\x71\x28\xd5" // sysl x0, #0, c7, c1, #0 143 144 //#define ARM64_CODE "\x20\xf4\x18\x9e" // fcvtzs x0, s1, #3 145 //#define ARM64_CODE "\x20\x74\x0b\xd5" // dc zva, x0: FIXME: handle as "sys" insn 146 //#define ARM64_CODE "\x00\x90\x24\x1e" // fmov s0, ##10.00000000 147 //#define ARM64_CODE "\xe1\x0b\x40\xb9" // ldr w1, [sp, #0x8] 148 //#define ARM64_CODE "\x20\x78\x62\xf8" // ldr x0, [x1, x2, lsl #3] 149 //#define ARM64_CODE "\x41\x14\x44\xb3" // bfm x1, x2, #4, #5 150 //#define ARM64_CODE "\x80\x23\x29\xd5" // sysl x0, #1, c2, c3, #4 151 //#define ARM64_CODE "\x20\x00\x24\x1e" // fcvtas w0, s1 152 //#define ARM64_CODE "\x41\x04\x40\xd2" // eor x1, x2, #0x3 153 //#define ARM64_CODE "\x9f\x33\x03\xd5" // dsb osh 154 //#define ARM64_CODE "\x41\x10\x23\x8a" // bic x1, x2, x3, lsl #4 155 //#define ARM64_CODE "\x16\x41\x3c\xd5" // mrs x22, sp_el1 156 //#define ARM64_CODE "\x41\x1c\x63\x0e" // bic v1.8b, v2.8b, v3.8b 157 //#define ARM64_CODE "\x41\xd4\xe3\x6e" // fabd v1.2d, v2.2d, v3.2d 158 //#define ARM64_CODE "\x20\x8c\x62\x2e" // cmeq v0.4h, v1.4h, v2.4h 159 //#define ARM64_CODE "\x20\x98\x20\x4e" // cmeq v0.16b, v1.16b, #0 160 //#define ARM64_CODE "\x20\x2c\x05\x4e" // smov x0, v1.b[2] 161 //#define ARM64_CODE "\x21\xe4\x00\x2f" // movi d1, #0xff 162 //#define ARM64_CODE "\x60\x78\x08\xd5" // at s1e0w, x0 // FIXME: same problem with dc ZVA 163 //#define ARM64_CODE "\x20\x00\xa0\xf2" // movk x0, #1, lsl #16 164 //#define ARM64_CODE "\x20\x08\x00\xb1" // adds x0, x1, #0x2 165 //#define ARM64_CODE "\x41\x04\x00\x0f" // movi v1.2s, #0x2 166 //#define ARM64_CODE "\x06\x00\x00\x14" // b 0x44 167 //#define ARM64_CODE "\x00\x90\x24\x1e" // fmov s0, ##10.00000000 168 //#define ARM64_CODE "\x5f\x3f\x03\xd5" // clrex 169 //#define ARM64_CODE "\x5f\x3e\x03\xd5" // clrex #14 170 //#define ARM64_CODE "\x20\x00\x02\xab" // adds x0, x1, x2 (alias of adds x0, x1, x2, lsl #0) 171 //#define ARM64_CODE "\x20\xf4\x18\x9e" // fcvtzs x0, s1, #3 172 //#define ARM64_CODE "\x20\xfc\x02\x9b" // mneg x0, x1, x2 173 //#define ARM64_CODE "\xd0\xb6\x1e\xd5" // msr s3_6_c11_c6_6, x16 174 175 //#define ARM64_CODE "\x21\x7c\x02\x9b\x21\x7c\x00\x53\x00\x40\x21\x4b\xe1\x0b\x40\xb9\x20\x04\x81\xda\x20\x08\x02\x8b" 176 177 //#define ARM64_CODE "\x09\x00\x38\xd5" // DBarrier 178 //#define ARM64_CODE "\x20\xe4\x3d\x0f\xa2\x00\xae\x9e" 179 //#define ARM64_CODE "\x9f\x37\x03\xd5\xbf\x33\x03\xd5\xdf\x3f\x03\xd5" // DBarrier 180 //#define ARM64_CODE "\x10\x5b\xe8\x3c" 181 //#define ARM64_CODE "\x00\x18\xa0\x5f\xa2\x00\xae\x9e" 182 183 #define ARM64_CODE "\x09\x00\x38\xd5\xbf\x40\x00\xd5\x0c\x05\x13\xd5\x20\x50\x02\x0e\x20\xe4\x3d\x0f\x00\x18\xa0\x5f\xa2\x00\xae\x9e\x9f\x37\x03\xd5\xbf\x33\x03\xd5\xdf\x3f\x03\xd5\x21\x7c\x02\x9b\x21\x7c\x00\x53\x00\x40\x21\x4b\xe1\x0b\x40\xb9\x20\x04\x81\xda\x20\x08\x02\x8b\x10\x5b\xe8\x3c" 184 185 struct platform platforms[] = { 186 { 187 CS_ARCH_ARM64, 188 CS_MODE_ARM, 189 (unsigned char *)ARM64_CODE, 190 sizeof(ARM64_CODE) - 1, 191 "ARM-64" 192 }, 193 }; 194 195 uint64_t address = 0x2c; 196 cs_insn *insn; 197 int i; 198 size_t count; 199 200 for (i = 0; i < sizeof(platforms)/sizeof(platforms[0]); i++) { 201 cs_err err = cs_open(platforms[i].arch, platforms[i].mode, &handle); 202 if (err) { 203 printf("Failed on cs_open() with error returned: %u\n", err); 204 continue; 205 } 206 207 cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON); 208 209 count = cs_disasm(handle, platforms[i].code, platforms[i].size, address, 0, &insn); 210 if (count) { 211 size_t j; 212 213 printf("****************\n"); 214 printf("Platform: %s\n", platforms[i].comment); 215 print_string_hex("Code: ", platforms[i].code, platforms[i].size); 216 printf("Disasm:\n"); 217 218 for (j = 0; j < count; j++) { 219 printf("0x%" PRIx64 ":\t%s\t%s\n", insn[j].address, insn[j].mnemonic, insn[j].op_str); 220 print_insn_detail(&insn[j]); 221 } 222 printf("0x%" PRIx64 ":\n", insn[j-1].address + insn[j-1].size); 223 224 // free memory allocated by cs_disasm() 225 cs_free(insn, count); 226 } else { 227 printf("****************\n"); 228 printf("Platform: %s\n", platforms[i].comment); 229 print_string_hex("Code: ", platforms[i].code, platforms[i].size); 230 printf("ERROR: Failed to disasm given code!\n"); 231 } 232 233 printf("\n"); 234 235 cs_close(&handle); 236 } 237 } 238 239 int main() 240 { 241 test(); 242 243 return 0; 244 } 245 246
