Menu
▾
▴
capstone-users — Capstone mailing list for users
You can subscribe to this list here.
| 2013 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(11) |
Dec
(11) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2014 |
Jan
(12) |
Feb
(3) |
Mar
(7) |
Apr
(4) |
May
(31) |
Jun
(2) |
Jul
(4) |
Aug
(2) |
Sep
(16) |
Oct
(13) |
Nov
(2) |
Dec
(25) |
| 2015 |
Jan
(28) |
Feb
(9) |
Mar
(7) |
Apr
(1) |
May
(3) |
Jun
(1) |
Jul
(3) |
Aug
(12) |
Sep
|
Oct
(11) |
Nov
(4) |
Dec
|
| 2016 |
Jan
(4) |
Feb
|
Mar
(8) |
Apr
|
May
(2) |
Jun
(2) |
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
(1) |
Dec
|
| 2017 |
Jan
|
Feb
(1) |
Mar
(3) |
Apr
(2) |
May
(4) |
Jun
(6) |
Jul
(9) |
Aug
(2) |
Sep
(1) |
Oct
|
Nov
|
Dec
|
| 2018 |
Jan
|
Feb
|
Mar
(7) |
Apr
|
May
|
Jun
|
Jul
(2) |
Aug
(3) |
Sep
|
Oct
(2) |
Nov
(7) |
Dec
(2) |
| 2019 |
Jan
(1) |
Feb
(1) |
Mar
(5) |
Apr
(1) |
May
(1) |
Jun
(4) |
Jul
(6) |
Aug
(2) |
Sep
|
Oct
|
Nov
|
Dec
(4) |
| 2020 |
Jan
|
Feb
|
Mar
|
Apr
|
May
(1) |
Jun
(2) |
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(1) |
Dec
|
| 2022 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
(2) |
Jul
(1) |
Aug
(3) |
Sep
|
Oct
|
Nov
|
Dec
|
| 2023 |
Jan
(1) |
Feb
|
Mar
(1) |
Apr
|
May
(1) |
Jun
|
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
(1) |
Dec
|
| 2024 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(1) |
Nov
|
Dec
|
|
From: Vijay K. B. <vij...@gm...> - 2018-10-15 15:07:47
|
Hi! I'm trying to include capstone in our project which uses waf ( from https://waf.io/ ) for the building process. I'm able to build it but it doesn't look quite right as I'm getting an error from cs_open() which seems to be because of something missing in the build. Any help from the capstone community will be really appreciated. P.S: I will provide all the required details that you might need, including the script which I'm writing to build it. Thank you -- vijay |
|
From: 양현서 <jou...@gm...> - 2018-10-07 04:16:44
|
This is a disassembler app to reverse engineer shared libraries found in apks. Github link(readme): https://github.com/KYHSGeekCode/Android-Disassembler/blob/master/README.md Anyone can contribute here! Note: I send this email according to : https://www.capstone-engine.org/showcase.html |
|
From: Nguyen A. Q. <aq...@gm...> - 2018-08-04 07:57:15
|
One simple example is EVM, you can see its code in arch/evm/. Adding a simple arch is similar to that. On Sat, Aug 4, 2018, 15:55 Nguyen Anh Quynh <aq...@gm...> wrote: > Hi, > > There is one open pull req to add Riscv to Capstone. You can look at that, > and see how to add a new arch. > > Cheers. > > > > On Sat, Aug 4, 2018, 13:40 Erik Buck <eri...@sb...> wrote: > >> I apologize if I haven’t found list archives or documentation about >> adding support for additional architectures. >> >> I spend a lot of time working with ancient obsolete computers. I’d like >> to add support for disassembling MIL-STD-1750A 16-bit processor machine >> code. I work with many others like old processors HP1000, CDC CYBER, and >> IBM 360 as well. >> >> I think I can figure out how to add an architecture by studying the >> existing examples, but any documentation or a suggested process could save >> me a lot of time. What resources are available? Is there a step by step >> process? Is there a first step? >> >> How can I make the “Hello World!” for Capstone: For example, what would >> it take to make a disassembler for a simple “fake” machine language with >> only 15 opcodes like LC-3? >> https://www.cs.utexas.edu/~fussell/courses/cs310h/lectures/Lecture_10-310h.pdf >> >> >> >> >> >> ------------------------------------------------------------------------------ >> Check out the vibrant tech community on one of the world's most >> engaging tech sites, Slashdot.org! http://sdm.link/slashdot >> _______________________________________________ >> Capstone-users mailing list >> Cap...@li... >> https://lists.sourceforge.net/lists/listinfo/capstone-users >> > |
|
From: Nguyen A. Q. <aq...@gm...> - 2018-08-04 07:55:37
|
Hi, There is one open pull req to add Riscv to Capstone. You can look at that, and see how to add a new arch. Cheers. On Sat, Aug 4, 2018, 13:40 Erik Buck <eri...@sb...> wrote: > I apologize if I haven’t found list archives or documentation about adding > support for additional architectures. > > I spend a lot of time working with ancient obsolete computers. I’d like to > add support for disassembling MIL-STD-1750A 16-bit processor machine code. > I work with many others like old processors HP1000, CDC CYBER, and IBM 360 > as well. > > I think I can figure out how to add an architecture by studying the > existing examples, but any documentation or a suggested process could save > me a lot of time. What resources are available? Is there a step by step > process? Is there a first step? > > How can I make the “Hello World!” for Capstone: For example, what would it > take to make a disassembler for a simple “fake” machine language with only > 15 opcodes like LC-3? > https://www.cs.utexas.edu/~fussell/courses/cs310h/lectures/Lecture_10-310h.pdf > > > > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Capstone-users mailing list > Cap...@li... > https://lists.sourceforge.net/lists/listinfo/capstone-users > |
|
From: Erik B. <eri...@sb...> - 2018-08-04 05:39:59
|
I apologize if I haven’t found list archives or documentation about adding support for additional architectures. I spend a lot of time working with ancient obsolete computers. I’d like to add support for disassembling MIL-STD-1750A 16-bit processor machine code. I work with many others like old processors HP1000, CDC CYBER, and IBM 360 as well. I think I can figure out how to add an architecture by studying the existing examples, but any documentation or a suggested process could save me a lot of time. What resources are available? Is there a step by step process? Is there a first step? How can I make the “Hello World!” for Capstone: For example, what would it take to make a disassembler for a simple “fake” machine language with only 15 opcodes like LC-3? https://www.cs.utexas.edu/~fussell/courses/cs310h/lectures/Lecture_10-310h.pdf |
|
From: Nguyen A. Q. <aq...@gm...> - 2018-07-19 13:52:17
|
To follow up, Capstone v3.0.5 is now ready on Pypi, thanks to @rhelmot!
So now Windows, Mac OS & Linux users can update your Python package with:
$ pip install --update capstone
At the same time, Capstone was also updated to v3.0.5 on Homebrew, so Mac
OS users can now upgrade with:
$ brew upgrade capstone
Thanks,
Quynh
http://www.keystone-engine.org
http://www.capstone-engine.org
http://www.unicorn-engine.org
On Thu, Jul 19, 2018 at 1:57 AM Nguyen Anh Quynh <aq...@gm...> wrote:
> Greetings,
>
> We are very happy to announce version 3.0.5 of Capstone disassembler
> framework!
>
> In no particular order, we would like to thank CrowdStrike, CMC Infosec &
> Jurriaan Bremer for sponsoring this release!
>
> This stable version fixes some security issues in the core, as well as
> many improvements, so existing users are strongly recommended to upgrade.
>
> More details are available at
> http://capstone-engine.org/Version-3.0.5.html
>
> (For those who do not know, Capstone is an open source multi-arch,
> multi-platform disassembly engine with homepage at
> http://capstone-engine.org)
>
> Thanks,
> Quynh
>
> http://www.keystone-engine.org
> http://www.capstone-engine.org
> http://www.unicorn-engine.org
>
>
>
|
|
From: Nguyen A. Q. <aq...@gm...> - 2018-07-18 17:57:46
|
Greetings, We are very happy to announce version 3.0.5 of Capstone disassembler framework! In no particular order, we would like to thank CrowdStrike, CMC Infosec & Jurriaan Bremer for sponsoring this release! This stable version fixes some security issues in the core, as well as many improvements, so existing users are strongly recommended to upgrade. More details are available at http://capstone-engine.org/Version-3.0.5.html (For those who do not know, Capstone is an open source multi-arch, multi-platform disassembly engine with homepage at http://capstone-engine.org) Thanks, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org |
|
From: Nguyen A. Q. <aq...@gm...> - 2018-03-31 09:52:27
|
hi, just want to update everybody with some good news: we have just added Ethererum (EVM) to the list of architectures supported by Capstone disassembler & Keystone assembler. find the latest code in Capstone's next branch, and Keystone's master branch. at the moment Python binding of Capstone's next branch already supported EVM. Keystone is better with more the bindings maintained in the code already supported EVM: Python, Go, NodeJS, Ruby. we may add more Cryptocurrency architectures next to Capstone & Keystone. have a nice weekend, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org |
|
From: Ben H. <ben...@ul...> - 2018-03-19 14:54:10
|
Thanks for the offer. I would like to send a pull request but will have to wait until I have time to work on this again. Ben From: Nguyen Anh Quynh [mailto:aq...@gm...] Sent: 16 March 2018 14:08 To: Capstone disassembly framework (www.capstone-engine.org) Subject: Re: [Capstone-users] llvm tablegen files wow, this is fantastic! do you want to send a pull req to add this into Capstone? if you do, please note that we only add new architectures into the "next" branch, so please base on "next" for the pull req. (there are some minor changes between "master" & "next", for example these 2 features are only available in "next": http://www.capstone-engine.org/op_access.html http://www.capstone-engine.org/mnemonic.html Thanks, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org On Fri, Mar 16, 2018 at 9:16 PM Ben Horgan <ben...@ul...<mailto:ben...@ul...>> wrote: Thanks Quynh, I’ve add RISC-V support to my fork of the capstone repository at https://github.com/benhorgan/capstone. Currently this just supports RV32I with the M extension. I have not updated the bindings or the msvc solution. There is a RISC-V test in the format of the other tests. I have checked the output against gnu objdump and it matches. (jalr uses the format currently used by the spec rather than objdump) The llvm based files were taken from: https://github.com/lowRISC/riscv-llvm-integration at Latest commit 74e4050 on 3 Oct 2017. This is based on llvm 5.0 and has not been taken upstream so there will probably be more churn here. Groups used: GRP_JMP: jal, jalr, bne, bltu, blt, bgeu, bge, beq GRP_INT: ecall, ebreak GRP_LOAD_IMM: auipc, lui A GRP_LOAD_IMM instruction followed immediately by a jalr instruction can be consided to make jump direct. Thanks, Ben From: Nguyen Anh Quynh [mailto:aq...@gm...<mailto:aq...@gm...>] Sent: 05 March 2018 13:14 To: Capstone disassembly framework (www.capstone-engine.org<http://www.capstone-engine.org>) Subject: Re: [Capstone-users] llvm tablegen files i used some adhoc scripts, but still modified that manually. you should look into existing tables to see how to do that yourself. Thanks, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org On Fri, Mar 2, 2018 at 2:29 AM, Ben Horgan <ben...@ul...<mailto:ben...@ul...>> wrote: Hi, I’m looking at how the tablegen files are used in capstone and was wondering if there were any scripts for converting to the c output used by capstone or if this is done by hand. The files are generated using command lines of the form: ./bin/llvm-tblgen.exe -gen-subtarget -I=../include -I=../lib/Target/Mips ../lib/Target/Mips/Mips.td >MipsGenSubTargetInfoBRH.inc This is towards doing something similar for RISC-V in capstone using the https://github.com/lowRISC/riscv-llvm-integration repo. Thanks, Ben ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Capstone-users mailing list Cap...@li...<mailto:Cap...@li...> https://lists.sourceforge.net/lists/listinfo/capstone-users ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot_______________________________________________ Capstone-users mailing list Cap...@li...<mailto:Cap...@li...> https://lists.sourceforge.net/lists/listinfo/capstone-users The information in this email is confidential and is intended solely for the recipient. Access, copying or re-use of information in it by anyone else is unauthorized. If you are not the intended recipient, please inform the sender by reply or contact UltraSoC on +44 (0)1223 422133, and then delete the email. |
|
From: Nguyen A. Q. <aq...@gm...> - 2018-03-17 09:20:34
|
Hi, https://honeynet.org/gsoc2018/ideas#keycapunicorn Managed to get our Reversing Trilogy in Google Summer of Code this year - under Honeynet Project! Looking for students to apply to work on Capstone, Unicorn & Keystone this summer. Please help to spread this news. Cheers, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org |
|
From: Nguyen A. Q. <aq...@gm...> - 2018-03-16 14:08:15
|
wow, this is fantastic! do you want to send a pull req to add this into Capstone? if you do, please note that we only add new architectures into the "next" branch, so please base on "next" for the pull req. (there are some minor changes between "master" & "next", for example these 2 features are only available in "next": http://www.capstone-engine.org/op_access.html http://www.capstone-engine.org/mnemonic.html Thanks, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org On Fri, Mar 16, 2018 at 9:16 PM Ben Horgan <ben...@ul...> wrote: > Thanks Quynh, I’ve add RISC-V support to my fork of the capstone > repository at https://github.com/benhorgan/capstone. Currently this just > supports RV32I with the M extension. I have not updated the bindings or the > msvc solution. There is a RISC-V test in the format of the other tests. I > have checked the output against gnu objdump and it matches. (jalr uses the > format currently used by the spec rather than objdump) > > > > The llvm based files were taken from: > https://github.com/lowRISC/riscv-llvm-integration at Latest commit > 74e4050 on 3 Oct 2017. This is based on llvm 5.0 and has not been taken > upstream so there will probably be more churn here. > > > > Groups used: > > > > GRP_JMP: jal, jalr, bne, bltu, blt, bgeu, bge, beq > > > > GRP_INT: ecall, ebreak > > > > GRP_LOAD_IMM: auipc, lui > > > > A GRP_LOAD_IMM instruction followed immediately by a jalr instruction can > be consided to make jump direct. > > > > Thanks, > > > > Ben > > > > *From:* Nguyen Anh Quynh [mailto:aq...@gm...] > *Sent:* 05 March 2018 13:14 > *To:* Capstone disassembly framework (www.capstone-engine.org) > *Subject:* Re: [Capstone-users] llvm tablegen files > > > > i used some adhoc scripts, but still modified that manually. > > > > you should look into existing tables to see how to do that yourself. > > > > > > > Thanks, > Quynh > > http://www.keystone-engine.org > http://www.capstone-engine.org > > http://www.unicorn-engine.org > > > > > > On Fri, Mar 2, 2018 at 2:29 AM, Ben Horgan <ben...@ul...> > wrote: > > Hi, > > > > I’m looking at how the tablegen files are used in capstone and was > wondering if there were any scripts for converting to the c output used by > capstone or if this is done by hand. The files are generated using command > lines of the form: > > ./bin/llvm-tblgen.exe -gen-subtarget -I=../include -I=../lib/Target/Mips > ../lib/Target/Mips/Mips.td >MipsGenSubTargetInfoBRH.inc > > > > This is towards doing something similar for RISC-V in capstone using the > https://github.com/lowRISC/riscv-llvm-integration repo. > > > > Thanks, > > > > Ben > > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Capstone-users mailing list > Cap...@li... > https://lists.sourceforge.net/lists/listinfo/capstone-users > > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Capstone-users mailing list > Cap...@li... > https://lists.sourceforge.net/lists/listinfo/capstone-users > |
|
From: Ben H. <ben...@ul...> - 2018-03-16 13:16:42
|
Thanks Quynh, I’ve add RISC-V support to my fork of the capstone repository at https://github.com/benhorgan/capstone. Currently this just supports RV32I with the M extension. I have not updated the bindings or the msvc solution. There is a RISC-V test in the format of the other tests. I have checked the output against gnu objdump and it matches. (jalr uses the format currently used by the spec rather than objdump) The llvm based files were taken from: https://github.com/lowRISC/riscv-llvm-integration at Latest commit 74e4050 on 3 Oct 2017. This is based on llvm 5.0 and has not been taken upstream so there will probably be more churn here. Groups used: GRP_JMP: jal, jalr, bne, bltu, blt, bgeu, bge, beq GRP_INT: ecall, ebreak GRP_LOAD_IMM: auipc, lui A GRP_LOAD_IMM instruction followed immediately by a jalr instruction can be consided to make jump direct. Thanks, Ben From: Nguyen Anh Quynh [mailto:aq...@gm...] Sent: 05 March 2018 13:14 To: Capstone disassembly framework (www.capstone-engine.org) Subject: Re: [Capstone-users] llvm tablegen files i used some adhoc scripts, but still modified that manually. you should look into existing tables to see how to do that yourself. Thanks, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org On Fri, Mar 2, 2018 at 2:29 AM, Ben Horgan <ben...@ul...<mailto:ben...@ul...>> wrote: Hi, I’m looking at how the tablegen files are used in capstone and was wondering if there were any scripts for converting to the c output used by capstone or if this is done by hand. The files are generated using command lines of the form: ./bin/llvm-tblgen.exe -gen-subtarget -I=../include -I=../lib/Target/Mips ../lib/Target/Mips/Mips.td >MipsGenSubTargetInfoBRH.inc This is towards doing something similar for RISC-V in capstone using the https://github.com/lowRISC/riscv-llvm-integration repo. Thanks, Ben ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Capstone-users mailing list Cap...@li...<mailto:Cap...@li...> https://lists.sourceforge.net/lists/listinfo/capstone-users |
|
From: Nguyen A. Q. <aq...@gm...> - 2018-03-05 13:13:59
|
i used some adhoc scripts, but still modified that manually. you should look into existing tables to see how to do that yourself. Thanks, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org On Fri, Mar 2, 2018 at 2:29 AM, Ben Horgan <ben...@ul...> wrote: > Hi, > > > > I’m looking at how the tablegen files are used in capstone and was > wondering if there were any scripts for converting to the c output used by > capstone or if this is done by hand. The files are generated using command > lines of the form: > > ./bin/llvm-tblgen.exe -gen-subtarget -I=../include -I=../lib/Target/Mips > ../lib/Target/Mips/Mips.td >MipsGenSubTargetInfoBRH.inc > > > > This is towards doing something similar for RISC-V in capstone using the > https://github.com/lowRISC/riscv-llvm-integration repo. > > > > Thanks, > > > > Ben > > ------------------------------------------------------------ > ------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Capstone-users mailing list > Cap...@li... > https://lists.sourceforge.net/lists/listinfo/capstone-users > > |
|
From: Ben H. <ben...@ul...> - 2018-03-01 18:29:59
|
Hi, I'm looking at how the tablegen files are used in capstone and was wondering if there were any scripts for converting to the c output used by capstone or if this is done by hand. The files are generated using command lines of the form: ./bin/llvm-tblgen.exe -gen-subtarget -I=../include -I=../lib/Target/Mips ../lib/Target/Mips/Mips.td >MipsGenSubTargetInfoBRH.inc This is towards doing something similar for RISC-V in capstone using the https://github.com/lowRISC/riscv-llvm-integration repo. Thanks, Ben |
|
From: Joan C. <j04...@gm...> - 2017-09-13 13:07:28
|
Hey, I came on this in Capstone (CS_ARCH_ARM, CS_MODE_THUMB, base address=0): 00 A0 = adr r0, #0 Shouldn't it be "adr r0, _#4_",as the code is mapped at address 0 (due to PC read value being instruction address + 4 in Thumb mode) ?* * (or alternatively add r0, pc, #0 ?) I understand that disassembler like llvm-mc only show the "raw" disassembled instruction, but isn't Capstone suppose to do the PC increment from the instruction address? Thanks! Joan |
|
From: Andreas A. <all...@gm...> - 2017-08-01 13:30:13
|
Hi, sorry, I'm new to the whole OSS workflow. I've created the issue on Github now, and am currently trying to fix this myself, but better don't rely on that. Is there any more documentation about the inner workings of capstone other than HACK.txt ? Greetings, Andreas On 01.08.2017 14:32, Nguyen Anh Quynh wrote: > for the record, can you please open a new issue on Github? > > also, you can simply use "cstool" for demonstration - without having > to write a test. > > Thanks, > Quynh > > http://www.keystone-engine.org > http://www.capstone-engine.org > http://www.unicorn-engine.org > > > > On Tue, Aug 1, 2017 at 5:11 AM, Andreas Allquantor > <all...@gm... <mailto:all...@gm...>> wrote: > > Hello, > > I just stumbled upon an instruction which is not properly > recognized by capstone (next-branch). > It is the MSR instruction. See page 803 in DDI0403D (ARMv7-M arch > ref man) for the encoding of the instruction. > > I'll attach a minimal testscript with expected and actual results. > > Greetings, > Andreas > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Capstone-users mailing list > Cap...@li... > <mailto:Cap...@li...> > https://lists.sourceforge.net/lists/listinfo/capstone-users > <https://lists.sourceforge.net/lists/listinfo/capstone-users> > > > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > > > _______________________________________________ > Capstone-users mailing list > Cap...@li... > https://lists.sourceforge.net/lists/listinfo/capstone-users |
|
From: Nguyen A. Q. <aq...@gm...> - 2017-08-01 12:32:36
|
for the record, can you please open a new issue on Github? also, you can simply use "cstool" for demonstration - without having to write a test. Thanks, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org On Tue, Aug 1, 2017 at 5:11 AM, Andreas Allquantor <all...@gm... > wrote: > Hello, > > I just stumbled upon an instruction which is not properly recognized by > capstone (next-branch). > It is the MSR instruction. See page 803 in DDI0403D (ARMv7-M arch ref man) > for the encoding of the instruction. > > I'll attach a minimal testscript with expected and actual results. > > Greetings, > Andreas > > ------------------------------------------------------------ > ------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Capstone-users mailing list > Cap...@li... > https://lists.sourceforge.net/lists/listinfo/capstone-users > > |
|
From: Andreas A. <all...@gm...> - 2017-07-31 21:08:51
|
Hello, I just stumbled upon an instruction which is not properly recognized by capstone (next-branch). It is the MSR instruction. See page 803 in DDI0403D (ARMv7-M arch ref man) for the encoding of the instruction. I'll attach a minimal testscript with expected and actual results. Greetings, Andreas |
|
From: Nguyen A. Q. <aq...@gm...> - 2017-07-31 13:31:27
|
hi, we are glad to announce v3.0.5-rc3 for Capstone disassembler! this is the final RC version before v3.0.5, which will follow very soon. see https://github.com/aquynh/capstone/releases/tag/3.0.5-rc3 for the summarize of important changes in this release. thanks, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org |
|
From: Nguyen A. Q. <aq...@gm...> - 2017-07-18 04:05:16
|
if you mean to change the CsInsn object, then you may try to recompile the assembly with Keystone (link after my signature), then decode the output binary from Keystone again (with Capstone), and get the new CsInsn object. Thanks, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org On Mon, Jul 17, 2017 at 5:41 PM, Andreas Allquantor < all...@gm...> wrote: > Hello There, > > Is there a way to overwrite single instructions (= CsInsn object) within a > given disassembly (= Cs object) with custom instructions? > > My use case is this: Throughout the code are data sections which are > wrongfully interpreted as code. (By chance they disassemble to proper > instructions so Capstone doesn't stop -> no need for skipdata.) Now I do > have means to calculate the addresses of those data sections, and would > like to turn them into .byte (or better yet 4-byte .word) > pseudo-instructions, just as skipdata does. > > I'm using the next branch with the python3 bindings. I'm disassembling > Thumb-Code. > > Greetings, > > Andreas > > > ------------------------------------------------------------ > ------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Capstone-users mailing list > Cap...@li... > https://lists.sourceforge.net/lists/listinfo/capstone-users > |
|
From: Andreas A. <all...@gm...> - 2017-07-17 09:38:50
|
Hello There, Is there a way to overwrite single instructions (= CsInsn object) within a given disassembly (= Cs object) with custom instructions? My use case is this: Throughout the code are data sections which are wrongfully interpreted as code. (By chance they disassemble to proper instructions so Capstone doesn't stop -> no need for skipdata.) Now I do have means to calculate the addresses of those data sections, and would like to turn them into .byte (or better yet 4-byte .word) pseudo-instructions, just as skipdata does. I'm using the next branch with the python3 bindings. I'm disassembling Thumb-Code. Greetings, Andreas |
|
From: Nguyen A. Q. <aq...@gm...> - 2017-07-14 11:12:29
|
sorry the plan was delayed because i have been travelling. will not delay that anymore. i will fix those bugs, and push it out this month for sure Thanks, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org On Fri, Jul 14, 2017 at 6:08 PM, Jurriaan Bremer <jur...@gm...> wrote: > Hi Q, > > Any update on this matter (or within the upcoming few weeks)? > > Jurriaan > > On 08-06-17 02:17, Nguyen Anh Quynh wrote: > > there are still some issues that i must fix. > > but i will release 3.0.5 this month. > > > > Thanks, > > Quynh > > > > http://www.keystone-engine.org > > http://www.capstone-engine.org > > http://www.unicorn-engine.org > > > > > > > > On Wed, Jun 7, 2017 at 1:25 AM, Jurriaan Bremer > > <jur...@gm... <mailto:jur...@gm...>> wrote: > > > > Hi Q, > > > > As I believe you've seen we're including Capstone (and Unicorn > Engine, > > btw) into Cuckoo Sandbox. However, I noticed an issue in 3.0.4 that > > seems to have been resolved in 3.0.5rc2 already - namely that of > > libcapstone.so being written to an incorrect directory. > > That said, do you have an ETA on the 3.0.5 release for me? :-) > > Thanks! > > > > Jurriaan > > > > ------------------------------------------------------------ > ------------------ > > Check out the vibrant tech community on one of the world's most > > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > > _______________________________________________ > > Capstone-users mailing list > > Cap...@li... > > <mailto:Cap...@li...> > > https://lists.sourceforge.net/lists/listinfo/capstone-users > > <https://lists.sourceforge.net/lists/listinfo/capstone-users> > > > > > > > > > > ------------------------------------------------------------ > ------------------ > > Check out the vibrant tech community on one of the world's most > > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > > > > > > > > _______________________________________________ > > Capstone-users mailing list > > Cap...@li... > > https://lists.sourceforge.net/lists/listinfo/capstone-users > > > > ------------------------------------------------------------ > ------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Capstone-users mailing list > Cap...@li... > https://lists.sourceforge.net/lists/listinfo/capstone-users > |
|
From: Jurriaan B. <jur...@gm...> - 2017-07-14 11:08:54
|
Hi Q, Any update on this matter (or within the upcoming few weeks)? Jurriaan On 08-06-17 02:17, Nguyen Anh Quynh wrote: > there are still some issues that i must fix. > but i will release 3.0.5 this month. > > Thanks, > Quynh > > http://www.keystone-engine.org > http://www.capstone-engine.org > http://www.unicorn-engine.org > > > > On Wed, Jun 7, 2017 at 1:25 AM, Jurriaan Bremer > <jur...@gm... <mailto:jur...@gm...>> wrote: > > Hi Q, > > As I believe you've seen we're including Capstone (and Unicorn Engine, > btw) into Cuckoo Sandbox. However, I noticed an issue in 3.0.4 that > seems to have been resolved in 3.0.5rc2 already - namely that of > libcapstone.so being written to an incorrect directory. > That said, do you have an ETA on the 3.0.5 release for me? :-) > Thanks! > > Jurriaan > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Capstone-users mailing list > Cap...@li... > <mailto:Cap...@li...> > https://lists.sourceforge.net/lists/listinfo/capstone-users > <https://lists.sourceforge.net/lists/listinfo/capstone-users> > > > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > > > > _______________________________________________ > Capstone-users mailing list > Cap...@li... > https://lists.sourceforge.net/lists/listinfo/capstone-users > |
|
From: Andreas A. <all...@gm...> - 2017-07-07 11:17:33
|
Hi, yes I was on the master branch. Switching to next solved the issue. Thank you for the help, Andreas On 06.07.2017 18:07, Nguyen Anh Quynh wrote: > > > > On Thu, Jul 6, 2017 at 7:59 PM, Andreas Allquantor > <all...@gm... <mailto:all...@gm...>> wrote: > > Hey, > > I'm new to capstone, and trying to get information about the > operands of instructions. I'm using the python binding and tried > the supplied example > (http://www.capstone-engine.org/op_access.html > <http://www.capstone-engine.org/op_access.html>) . > > The line: (regs_read, regs_write) = insn.regs_access() > > gives me: TypeError: 'NoneType' object is not callable > > Then I went through the code, trying to figure out the problem. I > noticed that the CsInsn class has neither an attribute nor a > method called regs_access. > > Does this mean that this feature is not yet implemented? > > > are you using the latest Capstone from our "next" branch on Github? > if you dont, then that explains the issue. > > > Thanks, > Quynh > > http://www.keystone-engine.org <http://www.keystone-engine.org/> > http://www.capstone-engine.org <http://www.capstone-engine.org/> > http://www.unicorn-engine.org <http://www.unicorn-engine.org/> > > > Greetings, > > Andreas > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Capstone-users mailing list > Cap...@li... > <mailto:Cap...@li...> > https://lists.sourceforge.net/lists/listinfo/capstone-users > <https://lists.sourceforge.net/lists/listinfo/capstone-users> > > > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > > > _______________________________________________ > Capstone-users mailing list > Cap...@li... > https://lists.sourceforge.net/lists/listinfo/capstone-users |
|
From: Nguyen A. Q. <aq...@gm...> - 2017-07-06 16:07:28
|
On Thu, Jul 6, 2017 at 7:59 PM, Andreas Allquantor <all...@gm... > wrote: > Hey, > > I'm new to capstone, and trying to get information about the operands of > instructions. I'm using the python binding and tried the supplied example ( > http://www.capstone-engine.org/op_access.html) . > > The line: (regs_read, regs_write) = insn.regs_access() > > gives me: TypeError: 'NoneType' object is not callable > > Then I went through the code, trying to figure out the problem. I noticed > that the CsInsn class has neither an attribute nor a method called > regs_access. > > Does this mean that this feature is not yet implemented? > > are you using the latest Capstone from our "next" branch on Github? if you dont, then that explains the issue. Thanks, Quynh http://www.keystone-engine.org http://www.capstone-engine.org http://www.unicorn-engine.org > Greetings, > > Andreas > > > ------------------------------------------------------------ > ------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Capstone-users mailing list > Cap...@li... > https://lists.sourceforge.net/lists/listinfo/capstone-users > |
