#disassemble

capstone

High level bindings to capstone disassembly engine (https://capstone-engine.org/)

17 releases (11 breaking)

0.11.0 May 2, 2022
0.10.0 Aug 9, 2021
0.9.0 Jul 14, 2021
0.7.0 Apr 12, 2020
0.0.3 Apr 5, 2015

#1 in #disassemble

Download history 5236/week @ 2022-08-10 4998/week @ 2022-08-17 5987/week @ 2022-08-24 5390/week @ 2022-08-31 5703/week @ 2022-09-07 5569/week @ 2022-09-14 7024/week @ 2022-09-21 5397/week @ 2022-09-28 7643/week @ 2022-10-05 7564/week @ 2022-10-12 8275/week @ 2022-10-19 5826/week @ 2022-10-26 7164/week @ 2022-11-02 7032/week @ 2022-11-09 7460/week @ 2022-11-16 4548/week @ 2022-11-23

27,246 downloads per month
Used in 32 crates (20 directly)

MIT license

6MB
159K SLoC

C 52K SLoC // 0.1% comments Rust 33K SLoC // 0.0% comments Python 22K SLoC // 0.1% comments C# 19K SLoC // 0.1% comments Java 15K SLoC // 0.0% comments OCaml 14K SLoC // 0.0% comments VB6 3K SLoC // 0.2% comments Shell 803 SLoC // 0.1% comments PowerShell 516 SLoC // 0.3% comments C++ 484 SLoC // 0.1% comments Visual Studio Project 310 SLoC Batch 290 SLoC // 0.0% comments RPM Specfile 121 SLoC // 0.0% comments Visual Studio Solution 68 SLoC Prolog 28 SLoC

capstone-rs

See README.md at the root of the repo


lib.rs:

Bindings to the capstone library disassembly framework.

This crate is a wrapper around the Capstone disassembly library, a "lightweight multi-platform, multi-architecture disassembly framework."

The Capstone struct is the main interface to the library.

extern crate capstone;

use capstone::prelude::*;

const X86_CODE: &'static [u8] = b"\x55\x48\x8b\x05\xb8\x13\x00\x00\xe9\x14\x9e\x08\x00\x45\x31\xe4";

/// Print register names
fn reg_names(cs: &Capstone, regs: &[RegId]) -> String {
    let names: Vec<String> = regs.iter().map(|&x| cs.reg_name(x).unwrap()).collect();
    names.join(", ")
}

/// Print instruction group names
fn group_names(cs: &Capstone, regs: &[InsnGroupId]) -> String {
    let names: Vec<String> = regs.iter().map(|&x| cs.group_name(x).unwrap()).collect();
    names.join(", ")
}

fn main() {
    let cs = Capstone::new()
        .x86()
        .mode(arch::x86::ArchMode::Mode64)
        .syntax(arch::x86::ArchSyntax::Att)
        .detail(true)
        .build()
        .expect("Failed to create Capstone object");

    let insns = cs.disasm_all(X86_CODE, 0x1000)
        .expect("Failed to disassemble");
    println!("Found {} instructions", insns.len());
    for i in insns.as_ref() {
        println!();
        println!("{}", i);

        let detail: InsnDetail = cs.insn_detail(&i).expect("Failed to get insn detail");
        let arch_detail: ArchDetail = detail.arch_detail();
        let ops = arch_detail.operands();

        let output: &[(&str, String)] = &[
            ("insn id:", format!("{:?}", i.id().0)),
            ("bytes:", format!("{:?}", i.bytes())),
            ("read regs:", reg_names(&cs, detail.regs_read())),
            ("write regs:", reg_names(&cs, detail.regs_write())),
            ("insn groups:", group_names(&cs, detail.groups())),
        ];

        for &(ref name, ref message) in output.iter() {
            println!("{:4}{:12} {}", "", name, message);
        }

        println!("{:4}operands: {}", "", ops.len());
        for op in ops {
            println!("{:8}{:?}", "", op);
        }
    }
}

Produces:

Found 4 instructions

0x1000: pushq %rbp
    insn id:     580
    bytes:       [85]
    read regs:   rsp
    write regs:  rsp
    insn groups: mode64
    operands: 1
        X86Operand(X86Operand { size: 8, avx_bcast: X86_AVX_BCAST_INVALID, avx_zero_opmask: false, op_type: Reg(RegId(36)) })

0x1001: movq 0x13b8(%rip), %rax
    insn id:     442
    bytes:       [72, 139, 5, 184, 19, 0, 0]
    read regs:
    write regs:
    insn groups:
    operands: 2
        X86Operand(X86Operand { size: 8, avx_bcast: X86_AVX_BCAST_INVALID, avx_zero_opmask: false, op_type: Mem(X86OpMem(x86_op_mem { segment: 0, base: 41, index: 0, scale: 1, disp: 5048 })) })
        X86Operand(X86Operand { size: 8, avx_bcast: X86_AVX_BCAST_INVALID, avx_zero_opmask: false, op_type: Reg(RegId(35)) })

0x1008: jmp 0x8ae21
    insn id:     266
    bytes:       [233, 20, 158, 8, 0]
    read regs:
    write regs:
    insn groups: jump
    operands: 1
        X86Operand(X86Operand { size: 8, avx_bcast: X86_AVX_BCAST_INVALID, avx_zero_opmask: false, op_type: Imm(568865) })

0x100d: xorl %r12d, %r12d
    insn id:     327
    bytes:       [69, 49, 228]
    read regs:
    write regs:  rflags
    insn groups:
    operands: 2
        X86Operand(X86Operand { size: 4, avx_bcast: X86_AVX_BCAST_INVALID, avx_zero_opmask: false, op_type: Reg(RegId(222)) })
        X86Operand(X86Operand { size: 4, avx_bcast: X86_AVX_BCAST_INVALID, avx_zero_opmask: false, op_type: Reg(RegId(222)) })

Dependencies