|
|
|
@ -16,23 +16,19 @@ import com.sun.jna.ptr.IntByReference;
|
|
|
|
|
import java.util.List;
|
|
|
|
|
import java.util.Arrays;
|
|
|
|
|
import java.lang.RuntimeException;
|
|
|
|
|
import java.lang.Math;
|
|
|
|
|
|
|
|
|
|
public class Capstone {
|
|
|
|
|
|
|
|
|
|
public int arch;
|
|
|
|
|
public int mode;
|
|
|
|
|
private int syntax;
|
|
|
|
|
private int detail;
|
|
|
|
|
protected static abstract class OpInfo {};
|
|
|
|
|
protected static abstract class UnionOpInfo extends Structure {};
|
|
|
|
|
|
|
|
|
|
protected static abstract class OpInfo {}
|
|
|
|
|
protected static abstract class UnionOpInfo extends Structure {}
|
|
|
|
|
public static class UnionArch extends Union {
|
|
|
|
|
public static class ByValue extends UnionArch implements Union.ByValue {};
|
|
|
|
|
|
|
|
|
|
protected static int max(int a, int b, int c, int d) {
|
|
|
|
|
if (a<b) a = b;
|
|
|
|
|
if (c<d) c = d;
|
|
|
|
|
if (a<c) a = c;
|
|
|
|
|
return a;
|
|
|
|
|
public Arm.UnionOpInfo arm;
|
|
|
|
|
public Arm64.UnionOpInfo arm64;
|
|
|
|
|
public X86.UnionOpInfo x86;
|
|
|
|
|
public Mips.UnionOpInfo mips;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
protected static class _cs_insn extends Structure {
|
|
|
|
@ -42,39 +38,49 @@ public class Capstone {
|
|
|
|
|
public byte[] bytes;
|
|
|
|
|
public byte[] mnemonic;
|
|
|
|
|
public byte[] operands;
|
|
|
|
|
public byte[] regs_read;
|
|
|
|
|
public byte regs_read_count;
|
|
|
|
|
public byte[] regs_write;
|
|
|
|
|
public byte regs_write_count;
|
|
|
|
|
public byte[] groups;
|
|
|
|
|
public byte groups_count;
|
|
|
|
|
public _cs_detail.ByReference cs_detail;
|
|
|
|
|
|
|
|
|
|
public _cs_insn(Pointer p) {
|
|
|
|
|
public _cs_insn() {
|
|
|
|
|
bytes = new byte[16];
|
|
|
|
|
mnemonic = new byte[32];
|
|
|
|
|
operands = new byte[96];
|
|
|
|
|
regs_read = new byte[12];
|
|
|
|
|
regs_write = new byte[20];
|
|
|
|
|
groups = new byte[8];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public _cs_insn(Pointer p) {
|
|
|
|
|
this();
|
|
|
|
|
useMemory(p);
|
|
|
|
|
read();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@Override
|
|
|
|
|
public List getFieldOrder() {
|
|
|
|
|
return Arrays.asList("id", "address", "size", "bytes", "mnemonic", "operands",
|
|
|
|
|
"regs_read", "regs_read_count",
|
|
|
|
|
"regs_write", "regs_write_count",
|
|
|
|
|
"groups", "groups_count");
|
|
|
|
|
return Arrays.asList("id", "address", "size", "bytes", "mnemonic", "operands", "cs_detail");
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
protected static class _cs_detail extends Structure {
|
|
|
|
|
public static class ByReference extends _cs_detail implements Structure.ByReference {};
|
|
|
|
|
|
|
|
|
|
public byte[] regs_read = new byte[12];
|
|
|
|
|
public byte regs_read_count;
|
|
|
|
|
public byte[] regs_write = new byte[20];
|
|
|
|
|
public byte regs_write_count;
|
|
|
|
|
public byte[] groups = new byte[8];
|
|
|
|
|
public byte groups_count;
|
|
|
|
|
|
|
|
|
|
public UnionArch arch;
|
|
|
|
|
|
|
|
|
|
@Override
|
|
|
|
|
public List getFieldOrder() {
|
|
|
|
|
return Arrays.asList("regs_read", "regs_read_count", "regs_write", "regs_write_count", "groups", "groups_count", "arch");
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public static class CsInsn {
|
|
|
|
|
public OpInfo operands;
|
|
|
|
|
private Pointer ptr_origin;
|
|
|
|
|
private NativeLong csh;
|
|
|
|
|
private CS cs;
|
|
|
|
|
private static int _size = -1;
|
|
|
|
|
private _cs_insn raw;
|
|
|
|
|
private int arch;
|
|
|
|
|
|
|
|
|
|
public int id;
|
|
|
|
|
public long address;
|
|
|
|
@ -84,54 +90,79 @@ public class Capstone {
|
|
|
|
|
public byte[] regsRead;
|
|
|
|
|
public byte[] regsWrite;
|
|
|
|
|
public byte[] groups;
|
|
|
|
|
public OpInfo operands;
|
|
|
|
|
|
|
|
|
|
public CsInsn (_cs_insn struct, Pointer _ptr_origin, NativeLong _csh, CS _cs, OpInfo _op_info) {
|
|
|
|
|
id = struct.id;
|
|
|
|
|
address = struct.address;
|
|
|
|
|
size = struct.size;
|
|
|
|
|
mnemonic = new String(struct.mnemonic).replace("\u0000","");
|
|
|
|
|
opStr = new String(struct.operands).replace("\u0000","");
|
|
|
|
|
public CsInsn (_cs_insn insn, int _arch, NativeLong _csh, CS _cs) {
|
|
|
|
|
id = insn.id;
|
|
|
|
|
address = insn.address;
|
|
|
|
|
size = insn.size;
|
|
|
|
|
mnemonic = new String(insn.mnemonic).replace("\u0000","");
|
|
|
|
|
opStr = new String(insn.operands).replace("\u0000","");
|
|
|
|
|
|
|
|
|
|
regsRead = new byte[struct.regs_read_count];
|
|
|
|
|
for (int i=0; i<regsRead.length; i++)
|
|
|
|
|
regsRead[i] = struct.regs_read[i];
|
|
|
|
|
regsWrite = new byte[struct.regs_write_count];
|
|
|
|
|
for (int i=0; i<regsWrite.length; i++)
|
|
|
|
|
regsWrite[i] = struct.regs_write[i];
|
|
|
|
|
groups = new byte[struct.groups_count];
|
|
|
|
|
for (int i=0; i<groups.length; i++)
|
|
|
|
|
groups[i] = struct.groups[i];
|
|
|
|
|
operands = _op_info;
|
|
|
|
|
|
|
|
|
|
ptr_origin = _ptr_origin;
|
|
|
|
|
arch = _arch;
|
|
|
|
|
raw = insn;
|
|
|
|
|
csh = _csh;
|
|
|
|
|
cs = _cs;
|
|
|
|
|
|
|
|
|
|
// cache the size so we do not need to recompute the offset everytime
|
|
|
|
|
if (_size == -1)
|
|
|
|
|
_size = struct.size() + Arm.UnionOpInfo.getSize();
|
|
|
|
|
// Arm is the max, so we optimized it here, a more generic way is as follows:
|
|
|
|
|
// = max( Arm.UnionOpInfo.getSize(), Arm64.UnionOpInfo.getSize(), Mips.UnionOpInfo.getSize(), X86.UnionOpInfo.getSize() );
|
|
|
|
|
if (insn.cs_detail != null) {
|
|
|
|
|
regsRead = new byte[insn.cs_detail.regs_read_count];
|
|
|
|
|
for (int i=0; i<regsRead.length; i++)
|
|
|
|
|
regsRead[i] = insn.cs_detail.regs_read[i];
|
|
|
|
|
regsWrite = new byte[insn.cs_detail.regs_write_count];
|
|
|
|
|
for (int i=0; i<regsWrite.length; i++)
|
|
|
|
|
regsWrite[i] = insn.cs_detail.regs_write[i];
|
|
|
|
|
groups = new byte[insn.cs_detail.groups_count];
|
|
|
|
|
for (int i=0; i<groups.length; i++)
|
|
|
|
|
groups[i] = insn.cs_detail.groups[i];
|
|
|
|
|
|
|
|
|
|
operands = getOptInfo(insn.cs_detail);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
protected int size() {
|
|
|
|
|
return _size;
|
|
|
|
|
private OpInfo getOptInfo(_cs_detail detail) {
|
|
|
|
|
OpInfo op_info = null;
|
|
|
|
|
|
|
|
|
|
switch (this.arch) {
|
|
|
|
|
case CS_ARCH_ARM:
|
|
|
|
|
detail.arch.setType(Arm.UnionOpInfo.class);
|
|
|
|
|
detail.arch.read();
|
|
|
|
|
op_info = new Arm.OpInfo((Arm.UnionOpInfo) detail.arch.arm);
|
|
|
|
|
break;
|
|
|
|
|
case CS_ARCH_ARM64:
|
|
|
|
|
detail.arch.setType(Arm64.UnionOpInfo.class);
|
|
|
|
|
detail.arch.read();
|
|
|
|
|
op_info = new Arm64.OpInfo((Arm64.UnionOpInfo) detail.arch.arm64);
|
|
|
|
|
break;
|
|
|
|
|
case CS_ARCH_MIPS:
|
|
|
|
|
detail.arch.setType(Mips.UnionOpInfo.class);
|
|
|
|
|
detail.arch.read();
|
|
|
|
|
op_info = new Mips.OpInfo((Mips.UnionOpInfo) detail.arch.mips);
|
|
|
|
|
break;
|
|
|
|
|
case CS_ARCH_X86:
|
|
|
|
|
detail.arch.setType(X86.UnionOpInfo.class);
|
|
|
|
|
detail.arch.read();
|
|
|
|
|
op_info = new X86.OpInfo((X86.UnionOpInfo) detail.arch.x86);
|
|
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return op_info;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public int opCount(int type) {
|
|
|
|
|
return cs.cs_op_count(csh, ptr_origin, type);
|
|
|
|
|
return cs.cs_op_count(csh, raw.getPointer(), type);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public int opIndex(int type, int index) {
|
|
|
|
|
return cs.cs_op_index(csh, ptr_origin, type, index);
|
|
|
|
|
return cs.cs_op_index(csh, raw.getPointer(), type, index);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public boolean regRead(int reg_id) {
|
|
|
|
|
return cs.cs_reg_read(csh, ptr_origin, reg_id) != 0;
|
|
|
|
|
return cs.cs_reg_read(csh, raw.getPointer(), reg_id) != 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public boolean regWrite(int reg_id) {
|
|
|
|
|
return cs.cs_reg_write(csh, ptr_origin, reg_id) != 0;
|
|
|
|
|
return cs.cs_reg_write(csh, raw.getPointer(), reg_id) != 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public int errno() {
|
|
|
|
@ -147,47 +178,16 @@ public class Capstone {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public boolean group(int gid) {
|
|
|
|
|
return cs.cs_insn_group(csh, ptr_origin, gid) != 0;
|
|
|
|
|
return cs.cs_insn_group(csh, raw.getPointer(), gid) != 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private CsInsn fromPointer(Pointer pointer)
|
|
|
|
|
{
|
|
|
|
|
_cs_insn insn = new _cs_insn(pointer);
|
|
|
|
|
OpInfo op_info = null;
|
|
|
|
|
UnionOpInfo _op_info = null;
|
|
|
|
|
private CsInsn[] fromArrayRaw(_cs_insn[] arr_raw) {
|
|
|
|
|
CsInsn[] arr = new CsInsn[arr_raw.length];
|
|
|
|
|
|
|
|
|
|
switch (this.arch) {
|
|
|
|
|
case CS_ARCH_ARM:
|
|
|
|
|
_op_info = new Arm.UnionOpInfo(pointer.share(insn.size()));
|
|
|
|
|
op_info = new Arm.OpInfo((Arm.UnionOpInfo) _op_info);
|
|
|
|
|
break;
|
|
|
|
|
case CS_ARCH_ARM64:
|
|
|
|
|
_op_info = new Arm64.UnionOpInfo(pointer.share(insn.size()));
|
|
|
|
|
op_info = new Arm64.OpInfo((Arm64.UnionOpInfo) _op_info);
|
|
|
|
|
break;
|
|
|
|
|
case CS_ARCH_MIPS:
|
|
|
|
|
_op_info = new Mips.UnionOpInfo(pointer.share(insn.size()));
|
|
|
|
|
op_info = new Mips.OpInfo((Mips.UnionOpInfo) _op_info);
|
|
|
|
|
break;
|
|
|
|
|
case CS_ARCH_X86:
|
|
|
|
|
_op_info = new X86.UnionOpInfo(pointer.share(insn.size()));
|
|
|
|
|
op_info = new X86.OpInfo((X86.UnionOpInfo) _op_info);
|
|
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
}
|
|
|
|
|
return new CsInsn(insn, pointer, ns.csh, cs, op_info);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private CsInsn[] fromArrayPointer(Pointer pointer, int numberResults)
|
|
|
|
|
{
|
|
|
|
|
CsInsn[] arr = new CsInsn[numberResults];
|
|
|
|
|
int offset = 0;
|
|
|
|
|
|
|
|
|
|
for (int i = 0; i < numberResults; i++) {
|
|
|
|
|
arr[i] = fromPointer(pointer.share(offset));
|
|
|
|
|
offset += arr[i].size();
|
|
|
|
|
for (int i = 0; i < arr_raw.length; i++) {
|
|
|
|
|
arr[i] = new CsInsn(arr_raw[i], this.arch, ns.csh, cs);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return arr;
|
|
|
|
@ -195,7 +195,7 @@ public class Capstone {
|
|
|
|
|
|
|
|
|
|
private interface CS extends Library {
|
|
|
|
|
public int cs_open(int arch, int mode, NativeLongByReference handle);
|
|
|
|
|
public NativeLong cs_disasm_dyn(NativeLong handle, byte[] code, NativeLong code_len,
|
|
|
|
|
public NativeLong cs_disasm_ex(NativeLong handle, byte[] code, NativeLong code_len,
|
|
|
|
|
long addr, NativeLong count, PointerByReference insn);
|
|
|
|
|
public void cs_free(Pointer p);
|
|
|
|
|
public int cs_close(NativeLong handle);
|
|
|
|
@ -258,9 +258,12 @@ public class Capstone {
|
|
|
|
|
|
|
|
|
|
protected NativeStruct ns; // for memory retention
|
|
|
|
|
private CS cs;
|
|
|
|
|
public int arch;
|
|
|
|
|
public int mode;
|
|
|
|
|
private int syntax;
|
|
|
|
|
private int detail;
|
|
|
|
|
|
|
|
|
|
public Capstone(int arch, int mode)
|
|
|
|
|
{
|
|
|
|
|
public Capstone(int arch, int mode) {
|
|
|
|
|
this.arch = arch;
|
|
|
|
|
this.mode = mode;
|
|
|
|
|
ns = new NativeStruct();
|
|
|
|
@ -311,9 +314,12 @@ public class Capstone {
|
|
|
|
|
public CsInsn[] disasm(byte[] code, long address, long count) {
|
|
|
|
|
PointerByReference insnRef = new PointerByReference();
|
|
|
|
|
|
|
|
|
|
NativeLong c = cs.cs_disasm_dyn(ns.csh, code, new NativeLong(code.length), address, new NativeLong(count), insnRef);
|
|
|
|
|
NativeLong c = cs.cs_disasm_ex(ns.csh, code, new NativeLong(code.length), address, new NativeLong(count), insnRef);
|
|
|
|
|
|
|
|
|
|
CsInsn[] allInsn = fromArrayPointer(insnRef.getValue(), c.intValue());
|
|
|
|
|
Pointer p = insnRef.getValue();
|
|
|
|
|
_cs_insn byref = new _cs_insn(p);
|
|
|
|
|
|
|
|
|
|
CsInsn[] allInsn = fromArrayRaw((_cs_insn[]) byref.toArray(c.intValue()));
|
|
|
|
|
return allInsn;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|