capstone-users Mailing List for capstone (Page 8)

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

When I try to disassemble Test.exe, I get the following:

0x1000: pop		r10
0x1002: npop		
0x1003  add		byte ptr [rbx], a1
0x1005: add		byte ptr [rbx], a1

That's all I get. Here's my C code:

-----

#define _CRT_SECURE_NO_WARNINGS

#include <stdio.h>
#include <stdlib.h>

#include "../inttypes.h"

#include <capstone.h>

#define CODE "\x55\x48\x8b\x05\xb8\x13\x00\x00"

int main(void)
{
	csh handle;
	cs_insn *insn;
	size_t count;

	if (cs_open(CS_ARCH_X86, CS_MODE_64, &handle) != CS_ERR_OK)
	{
		return -1;
	}

	FILE * file;
	unsigned char * buffer;
	unsigned long fileLen;

	file = fopen("C:/test/test.exe", "rb");

	fseek(file, 0, SEEK_END);
	fileLen = ftell(file);
	fseek(file, 0, SEEK_SET);

	buffer = (unsigned char *)malloc(fileLen + 1);
	fread(buffer, fileLen, 1, file);
	fclose(file);

	count = cs_disasm(handle, buffer, sizeof(buffer) - 1, 0x1000, 0, &insn);

	if (count > 0)
	{
		size_t j;
		for (j = 0; j < count; j++)
		{
			printf("0x%"PRIx64":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic, insn[j].op_str);
		}

		cs_free(insn, count);
	}
	else
	{
		printf("ERROR: Failed to dissassemble given code!\n");
	}

	cs_close(&handle);

	return 0;
}

Thanks.
-----Original Message-----
From: Nguyen Anh Quynh [mailto:aq...@gm...] 
Sent: Friday, January 23, 2015 9:44 AM
To: Capstone disassembly framework (www.capstone-engine.org)
Subject: Re: [Capstone-users] Capstone / NetBeans 8.0.2 Help

On Fri, Jan 23, 2015 at 8:50 PM, GROETZ, MICHAEL A CTR USAF AFMC AFRL/RYWA <mic...@us...> wrote:

	I never could get the Java version to work - even with v1.6. I moved on to implementing the program in C. I did get your C example to work with no problems and the output was as expected. Quick question about Test.exe. Is that program from me to buffer and disassemble? If so, I only get about 3 or 4 lines of disassembly. That doesn't seem quite right to me. Or is Test.exe for another purpose.

Test.exe is compiled from tests/test.c.

can you paste all the output of Test.exe here?

thanks.

	Thanks, Mike
	-----Original Message-----
	From: Nguyen Anh Quynh [mailto:aq...@gm...]

	Sent: Thursday, January 22, 2015 6:08 PM
	To: Capstone disassembly framework (www.capstone-engine.org)
	Subject: Re: [Capstone-users] Capstone / NetBeans 8.0.2 Help

	On Fri, Jan 23, 2015 at 1:28 AM, GROETZ, MICHAEL A CTR USAF AFMC AFRL/RYWA <mic...@us...> wrote:

	        I installed Java 1.6 and tried with that. No luck. I'm going to see if I can get the C version to work instead of the Java on Windows.

	to test, you can simply run Test.exe available in http://capstone-engine.org/download/3.0/capstone-3.0-win64.zip

	let me know what you find with your Java code.

	thanks,
	Q

	-----Original Message-----
	From: Nguyen Anh Quynh [mailto:aq...@gm...]

	Sent: Thursday, January 22, 2015 9:58 AM
	To: Capstone disassembly framework (www.capstone-engine.org)
	Subject: Re: [Capstone-users] Capstone / NetBeans 8.0.2 Help

	On Thu, Jan 22, 2015 at 10:32 PM, GROETZ, MICHAEL A CTR USAF AFMC AFRL/RYWA <mic...@us...> wrote:

	        I'm using Java 1.8.0_25 and Capstone 3.0. I don't have access to a system to put Ubuntu on. I'm using Win 7 64 bit with NetBeans IDE 8.0.2.

	        I can try a older version of Java.

	on Windows you need to put the core library (from http://capstone-engine.org/download/3.0/capstone-3.0-win64.zip) in the same directory with TestX86.java

	in the same directory, put http://capstone-engine.org/download/3.0/capstone.jar.

	can you compile & run TestX86.java with your current Java 1.8.0?

	thanks.

	-----Original Message-----
	From: Nguyen Anh Quynh [mailto:aq...@gm...]
	Sent: Thursday, January 22, 2015 9:04 AM
	To: Capstone disassembly framework (www.capstone-engine.org)
	Subject: Re: [Capstone-users] Capstone / NetBeans 8.0.2 Help

	On Thu, Jan 22, 2015 at 9:23 PM, GROETZ, MICHAEL A CTR USAF AFMC AFRL/RYWA <mic...@us...> wrote:

	        >a quick question: do you have any problem with the TestX86.java code? what
	        >is the output of it?
	        ------------------------
	        Here's the output from TexstX86.java. I only included 32 and 64 bit (I'm running on a 64 bit machine). If you need all of the output let me know.

	this is strange, as i dont have any issue here.

	some questions:

	- which Capstone version are you using?

	- what is your Java version?

	here is what i did:

	- download the latest Capstone from Github. you can get the "next" branch code from https://github.com/aquynh/capstone/archive/next.zip

	- unzip, compile & download on Ubuntu 64bit 14.04:

	  $ ./make.sh
	  $ sudo ./make.sh install
	  $ cd bindings/java/
	  $ make clean; make
	  $ ./run.sh x86     #  <--- this actually runs TestX86.java

	here is my Java version:

	   $ java -version
	   java version "1.6.0_33"
	   OpenJDK Runtime Environment (IcedTea6 1.13.5) (6b33-1.13.5-1ubuntu0.14.04)
	   OpenJDK 64-Bit Server VM (build 23.25-b01, mixed mode)

	now, can you repeat all the steps above?

	thanks.
	Q

	------------------------------------------------------------------------------
	New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
	GigeNET is offering a free month of service with a new server in Ashburn.
	Choose from 2 high performing configs, both with 100TB of bandwidth.
	Higher redundancy.Lower latency.Increased capacity.Completely compliant.
	http://p.sf.net/sfu/gigenet
	_______________________________________________
	Capstone-users mailing list
	Cap...@li...
	https://lists.sourceforge.net/lists/listinfo/capstone-users

	------------------------------------------------------------------------------
	New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
	GigeNET is offering a free month of service with a new server in Ashburn.
	Choose from 2 high performing configs, both with 100TB of bandwidth.
	Higher redundancy.Lower latency.Increased capacity.Completely compliant.
	http://p.sf.net/sfu/gigenet
	_______________________________________________
	Capstone-users mailing list
	Cap...@li...
	https://lists.sourceforge.net/lists/listinfo/capstone-users

	------------------------------------------------------------------------------
	New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
	GigeNET is offering a free month of service with a new server in Ashburn.
	Choose from 2 high performing configs, both with 100TB of bandwidth.
	Higher redundancy.Lower latency.Increased capacity.Completely compliant.
	http://p.sf.net/sfu/gigenet
	_______________________________________________
	Capstone-users mailing list
	Cap...@li...
	https://lists.sourceforge.net/lists/listinfo/capstone-users

2013	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov (11)	Dec (11)
2014	Jan (12)	Feb (3)	Mar (7)	Apr (4)	May (31)	Jun (2)	Jul (4)	Aug (2)	Sep (16)	Oct (13)	Nov (2)	Dec (25)
2015	Jan (28)	Feb (9)	Mar (7)	Apr (1)	May (3)	Jun (1)	Jul (3)	Aug (12)	Sep	Oct (11)	Nov (4)	Dec
2016	Jan (4)	Feb	Mar (8)	Apr	May (2)	Jun (2)	Jul (1)	Aug	Sep	Oct	Nov (1)	Dec
2017	Jan	Feb (1)	Mar (3)	Apr (2)	May (4)	Jun (6)	Jul (9)	Aug (2)	Sep (1)	Oct	Nov	Dec
2018	Jan	Feb	Mar (7)	Apr	May	Jun	Jul (2)	Aug (3)	Sep	Oct (2)	Nov (7)	Dec (2)
2019	Jan (1)	Feb (1)	Mar (5)	Apr (1)	May (1)	Jun (4)	Jul (6)	Aug (2)	Sep	Oct	Nov	Dec (4)
2020	Jan	Feb	Mar	Apr	May (1)	Jun (2)	Jul	Aug	Sep	Oct	Nov (1)	Dec
2022	Jan	Feb	Mar	Apr	May	Jun (2)	Jul (1)	Aug (3)	Sep	Oct	Nov	Dec
2023	Jan (1)	Feb	Mar (1)	Apr	May (1)	Jun	Jul (1)	Aug	Sep	Oct	Nov (1)	Dec
2024	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct (1)	Nov	Dec

capstone-users Mailing List for capstone (Page 8)

Capstone disassembly engine

capstone-users — Capstone mailing list for users