/// <summary>
        ///     Create a Disassembler.
        /// </summary>
        /// <param name="architecture">
        ///     The disassembler's architecture.
        /// </param>
        /// <param name="mode">
        ///     The disassembler's mode.
        /// </param>
        protected CapstoneDisassembler(DisassembleArchitecture architecture, DisassembleMode mode)
        {
            this._architecture = architecture;
            this._mode         = mode;

            this._handle       = NativeCapstone.Create(this._architecture, this._mode);
            this.EnableDetails = false;
            this.Syntax        = DisassembleSyntaxOptionValue.Default;
        }
Ejemplo n.º 2
0
        /// <summary>
        ///     Build an Instruction.
        /// </summary>
        /// <param name="disassembler">
        ///     A disassembler.
        /// </param>
        /// <param name="hInstruction">
        ///     An instruction handle.
        /// </param>
        internal virtual void Build(CapstoneDisassembler disassembler, NativeInstructionHandle hInstruction)
        {
            // ...
            //
            // Throws an exception if the operation fails.
            var nativeInstruction = NativeCapstone.GetInstruction(hInstruction);

            this.Address = nativeInstruction.Address;
            this.DisassembleArchitecture = disassembler.DisassembleArchitecture;
            this.DisassembleMode         = this.CreateDisassembleMode(disassembler.NativeDisassembleMode);
            this.Id            = this.CreateId(nativeInstruction.Id);
            this.IsSkippedData = disassembler.EnableSkipDataMode && !(nativeInstruction.Id > 0);
            this.Mnemonic      = !CapstoneDisassembler.IsDietModeEnabled ? nativeInstruction.Mnemonic : null;
            this.Operand       = !CapstoneDisassembler.IsDietModeEnabled ? nativeInstruction.Operand : null;
            // ...
            //
            // ...
            SetBytes(this, ref nativeInstruction);
            SetDetails(this, disassembler, hInstruction, ref nativeInstruction);

            // <summary>
            //      Set Instruction's Machine Bytes.
            // </summary>
            void SetBytes(InstructionBuilder <TDetail, TDisassembleMode, TGroup, TGroupId, TInstruction, TId, TRegister, TRegisterId> @this, ref NativeInstruction cNativeInstruction)
            {
                @this.Bytes = new byte[0];
                if (cNativeInstruction.Id >= 0)
                {
                    @this.Bytes = new byte[cNativeInstruction.Size];
                    for (var cI = 0; cI < @this.Bytes.Length; cI++)
                    {
                        @this.Bytes[cI] = cNativeInstruction.Bytes[cI];
                    }
                }
            }

            // <summary>
            //      Set Instruction's Details.
            // </summary>
            void SetDetails(InstructionBuilder <TDetail, TDisassembleMode, TGroup, TGroupId, TInstruction, TId, TRegister, TRegisterId> @this, CapstoneDisassembler cDisassembler, NativeInstructionHandle cHInstruction, ref NativeInstruction cNativeInstruction)
            {
                var cHasDetails = cNativeInstruction.Details != IntPtr.Zero;
                var cIsInstructionDetailsEnabled = cDisassembler.EnableInstructionDetails;

                @this.Details = null;
                if (cHasDetails && cIsInstructionDetailsEnabled && cNativeInstruction.Id > 0)
                {
                    @this.Details = @this.CreateDetails(cDisassembler, cHInstruction);
                }
            }
        }
Ejemplo n.º 3
0
        /// <summary>
        ///     Create a Native Capstone.
        /// </summary>
        static NativeCapstone()
        {
            OperatingSystem os  = Environment.OSVersion;
            PlatformID      pid = os.Platform;

            switch (pid)
            {
            case PlatformID.Win32NT:
            case PlatformID.Win32S:
            case PlatformID.Win32Windows:
            case PlatformID.WinCE:
                NativeCapstone.LoadLibrary();
                break;
            }
        }
Ejemplo n.º 4
0
 /// <summary>
 ///     Disable Disassemble Details Option.
 /// </summary>
 /// <param name="handle">
 ///     A Capstone handle. Should not be a null reference.
 /// </param>
 /// <exception cref="System.InvalidOperationException">
 ///     Thrown if the disassemble details option could not be disabled.
 /// </exception>
 public static void DisableDetailOption(SafeCapstoneHandle handle)
 {
     NativeCapstone.SetDisassembleDetails(handle, false);
 }
Ejemplo n.º 5
0
 /// <summary>
 ///     Enable Intel Disassemble Syntax Option.
 /// </summary>
 /// <param name="handle">
 ///     A Capstone handle. Should not be a null reference.
 /// </param>
 /// <exception cref="System.InvalidOperationException">
 ///     Thrown if the disassemble syntax option could not be set.
 /// </exception>
 public static void EnableIntelDisassembleSyntaxOption(SafeCapstoneHandle handle)
 {
     NativeCapstone.SetDisassembleSyntaxOption(handle, DisassembleSyntaxOptionValue.Intel);
 }
Ejemplo n.º 6
0
 /// <summary>
 ///     Enable Default Disassemble Syntax Option.
 /// </summary>
 /// <param name="handle">
 ///     A Capstone handle. Should not be a null reference.
 /// </param>
 /// <exception cref="System.InvalidOperationException">
 ///     Thrown if the disassemble syntax option could not be set.
 /// </exception>
 public static void EnableDefaultDisassembleSyntaxOption(SafeCapstoneHandle handle)
 {
     NativeCapstone.SetDisassembleSyntaxOption(handle, DisassembleSyntaxOptionValue.Default);
 }
Ejemplo n.º 7
0
 /// <summary>
 ///     Enable Disassemble Details Option.
 /// </summary>
 /// <param name="handle">
 ///     A Capstone handle. Should not be a null reference.
 /// </param>
 /// <exception cref="System.InvalidOperationException">
 ///     Thrown if the disassemble details option could not be enabled.
 /// </exception>
 public static void EnableDisassembleDetails(SafeCapstoneHandle handle)
 {
     NativeCapstone.SetDisassembleDetails(handle, true);
 }
Ejemplo n.º 8
0
        /// <summary>
        ///     Disassemble All Binary Code.
        /// </summary>
        /// <remarks>
        ///     Convenient method to disassemble binary code with the assumption that the address of the first
        ///     instruction in the collection of bytes to disassemble is 0x1000. Equivalent to calling
        ///     <c>NativeCapstone.DisassembleAll(handle, code, 0x1000)</c>.
        /// </remarks>
        /// <param name="handle">
        ///     A Capstone handle. Should not be a null reference.
        /// </param>
        /// <param name="code">
        ///     A collection of bytes representing the binary code to disassemble. Should not be a null reference.
        /// </param>
        /// <returns>
        ///     A native instruction handle.
        /// </returns>
        /// <exception cref="System.InvalidOperationException">
        ///     Thrown if the binary code could not be disassembled.
        /// </exception>
        public static SafeNativeInstructionHandle DisassembleAll(SafeCapstoneHandle handle, byte[] code)
        {
            var instructions = NativeCapstone.DisassembleAll(handle, code, 0x1000);

            return(instructions);
        }
Ejemplo n.º 9
0
        /// <summary>
        ///     Disassemble Binary Code.
        /// </summary>
        /// <remarks>
        ///     Convenient method to disassemble binary code with the assumption that the address of the first
        ///     instruction in the collection of bytes to disassemble is 0x1000. Equivalent to calling
        ///     <c>NativeCapstone.Disassemble(handle, code, 0x1000, count)</c>.
        /// </remarks>
        /// <param name="handle">
        ///     A Capstone handle. Should not be a null reference.
        /// </param>
        /// <param name="code">
        ///     A collection of bytes representing the binary code to disassemble. Should not be a null reference.
        /// </param>
        /// <param name="count">
        ///     The number of instructions to disassemble. A 0 indicates all instructions should be disassembled.
        /// </param>
        /// <returns>
        ///     A native instruction handle.
        /// </returns>
        /// <exception cref="System.InvalidOperationException">
        ///     Thrown if the binary code could not be disassembled.
        /// </exception>
        // public static SafeNativeInstructionHandle Disassemble(SafeCapstoneHandle handle, byte[] code, int count) {
        //     var instructionHandle = NativeCapstone.Disassemble(handle, code, 0x1000, count);
        //     return instructionHandle;
        // }

        /// <summary>
        ///     Disassemble All Binary Code.
        /// </summary>
        /// <param name="handle">
        ///     A Capstone handle. Should not be a null reference.
        /// </param>
        /// <param name="code">
        ///     A collection of bytes representing the binary code to disassemble. Should not be a null reference.
        /// </param>
        /// <param name="startingAddress">
        ///     The address of the first instruction in the collection of bytes to disassemble.
        /// </param>
        /// <returns>
        ///     A native instruction handle.
        /// </returns>
        /// <exception cref="System.InvalidOperationException">
        ///     Thrown if the binary code could not be disassembled.
        /// </exception>
        public static SafeNativeInstructionHandle DisassembleAll(SafeCapstoneHandle handle, byte[] code, ulong startingAddress)
        {
            var instructionHandle = NativeCapstone.Disassemble(handle, code, 0, startingAddress);

            return(instructionHandle);
        }
Ejemplo n.º 10
0
 /// <summary>
 ///     Create a Native Capstone.
 /// </summary>
 static NativeCapstone()
 {
     NativeCapstone.LoadLibrary();
 }
Ejemplo n.º 11
0
        /// <summary>
        ///     Build an Instruction Detail.
        /// </summary>
        /// <param name="disassembler">
        ///     A disassembler.
        /// </param>
        /// <param name="hInstruction">
        ///     An instruction handle.
        /// </param>
        internal virtual void Build(CapstoneDisassembler disassembler, NativeInstructionHandle hInstruction)
        {
            // ...
            //
            // Throws an exception if the operation fails.
            var nativeInstructionDetail = NativeCapstone.GetInstructionDetail(hInstruction).GetValueOrDefault();

            this.DisassembleArchitecture = disassembler.DisassembleArchitecture;
            this.DisassembleMode         = this.CreateDisassembleMode(disassembler.NativeDisassembleMode);
            // ...
            //
            // ...
            SetAccessedRegisters(this, disassembler, hInstruction);
            SetGroups(this, disassembler, ref nativeInstructionDetail);
            SetImplicitlyReadRegisters(this, disassembler, ref nativeInstructionDetail);
            SetImplicitlyWrittenRegisters(this, disassembler, ref nativeInstructionDetail);

            // <summary>
            //      Set Accessed Registers.
            // </summary>
            void SetAccessedRegisters(InstructionDetailBuilder <TDetail, TDisassembleMode, TGroup, TGroupId, TInstruction, TInstructionId, TRegister, TRegisterId> @this, CapstoneDisassembler cDisassembler, NativeInstructionHandle cHInstruction)
            {
                @this.AllReadRegisters    = new TRegister[0];
                @this.AllWrittenRegisters = new TRegister[0];
                if (!CapstoneDisassembler.IsDietModeEnabled)
                {
                    var isArchSupported = cDisassembler.DisassembleArchitecture != DisassembleArchitecture.M68K;
                    isArchSupported = isArchSupported && cDisassembler.DisassembleArchitecture != DisassembleArchitecture.Mips;
                    isArchSupported = isArchSupported && cDisassembler.DisassembleArchitecture != DisassembleArchitecture.PowerPc;
                    isArchSupported = isArchSupported && cDisassembler.DisassembleArchitecture != DisassembleArchitecture.XCore;
                    if (isArchSupported)
                    {
                        // ...
                        //
                        // Throws an exception if the operation fails.
                        var cAccessedRegisters = NativeCapstone.GetAccessedRegisters(cDisassembler.Handle, cHInstruction);

                        @this.AllReadRegisters = new TRegister[cAccessedRegisters.Item1.Length];
                        for (var cI = 0; cI < @this.AllReadRegisters.Length; cI++)
                        {
                            var cExplicitlyReadRegister = cAccessedRegisters.Item1[cI];
                            @this.AllReadRegisters[cI] = @this.CreateRegister(cDisassembler, cExplicitlyReadRegister);
                        }

                        @this.AllWrittenRegisters = new TRegister[cAccessedRegisters.Item2.Length];
                        for (var cI = 0; cI < @this.AllWrittenRegisters.Length; cI++)
                        {
                            var cExplicitlyWrittenRegister = cAccessedRegisters.Item2[cI];
                            @this.AllWrittenRegisters[cI] = @this.CreateRegister(cDisassembler, cExplicitlyWrittenRegister);
                        }
                    }
                }
            }

            // <summary>
            //      Set Instruction's Groups.
            // </summary>
            void SetGroups(InstructionDetailBuilder <TDetail, TDisassembleMode, TGroup, TGroupId, TInstruction, TInstructionId, TRegister, TRegisterId> @this, CapstoneDisassembler cDisassembler, ref NativeInstructionDetail cNativeInstructionDetail)
            {
                @this.Groups = new TGroup[cNativeInstructionDetail.GroupCount];
                if (!CapstoneDisassembler.IsDietModeEnabled)
                {
                    for (var cI = 0; cI < @this.Groups.Length; cI++)
                    {
                        var cGroup = cNativeInstructionDetail.Groups[cI];
                        @this.Groups[cI] = @this.CreateInstructionGroup(cDisassembler, cGroup);
                    }
                }
            }

            // <summary>
            //      Set Implicitly Read Registers.
            // </summary>
            void SetImplicitlyReadRegisters(InstructionDetailBuilder <TDetail, TDisassembleMode, TGroup, TGroupId, TInstruction, TInstructionId, TRegister, TRegisterId> @this, CapstoneDisassembler cDisassembler, ref NativeInstructionDetail cNativeInstructionDetail)
            {
                @this.ImplicitlyReadRegisters = new TRegister[cNativeInstructionDetail.ImplicitlyReadRegisterCount];
                if (!CapstoneDisassembler.IsDietModeEnabled)
                {
                    for (var cI = 0; cI < @this.ImplicitlyReadRegisters.Length; cI++)
                    {
                        var cImplicitlyReadRegister = cNativeInstructionDetail.ImplicitlyReadRegisters[cI];
                        @this.ImplicitlyReadRegisters[cI] = @this.CreateRegister(cDisassembler, cImplicitlyReadRegister);
                    }
                }
            }

            // <summary>
            //      Set Implicitly Written Registers.
            // </summary>
            void SetImplicitlyWrittenRegisters(InstructionDetailBuilder <TDetail, TDisassembleMode, TGroup, TGroupId, TInstruction, TInstructionId, TRegister, TRegisterId> @this, CapstoneDisassembler cDisassembler, ref NativeInstructionDetail cNativeInstructionDetail)
            {
                @this.ImplicitlyWrittenRegisters = new TRegister[cNativeInstructionDetail.ImplicitlyWrittenRegisterCount];
                if (!CapstoneDisassembler.IsDietModeEnabled)
                {
                    for (var cI = 0; cI < @this.ImplicitlyWrittenRegisters.Length; cI++)
                    {
                        var cImplicitlyWrittenRegister = cNativeInstructionDetail.ImplicitlyWrittenRegisters[cI];
                        @this.ImplicitlyWrittenRegisters[cI] = @this.CreateRegister(cDisassembler, cImplicitlyWrittenRegister);
                    }
                }
            }
        }
Ejemplo n.º 12
0
        /// <summary>
        ///     Disassemble Binary Code.
        /// </summary>
        /// <remarks>
        ///     Convenient method to disassemble binary code with the assumption that the address of the first
        ///     instruction in the collection of bytes to disassemble is 0x1000. Equivalent to calling
        ///     <c>NativeCapstone.Disassemble(handle, code, 0x1000, count)</c>.
        /// </remarks>
        /// <param name="handle">
        ///     A Capstone handle. Should not be a null reference.
        /// </param>
        /// <param name="code">
        ///     A collection of bytes representing the binary code to disassemble. Should not be a null reference.
        /// </param>
        /// <param name="count">
        ///     The number of instructions to disassemble. A 0 indicates all instructions should be disassembled.
        /// </param>
        /// <returns>
        ///     A native instruction handle.
        /// </returns>
        /// <exception cref="System.InvalidOperationException">
        ///     Thrown if the binary code could not be disassembled.
        /// </exception>
        public static SafeNativeInstructionHandle Disassemble(SafeCapstoneHandle handle, byte[] code, int count)
        {
            var instructionHandle = NativeCapstone.Disassemble(handle, code, 0x1000, count);

            return(instructionHandle);
        }