Skip to content

Instantly share code, notes, and snippets.

@abeaumont
Created August 11, 2016 23:05
Show Gist options
  • Save abeaumont/002caeb29af646ccac8a5f30f6724327 to your computer and use it in GitHub Desktop.
Save abeaumont/002caeb29af646ccac8a5f30f6724327 to your computer and use it in GitHub Desktop.
Get memory addressing mode stats from a binary
#!/usr/bin/env python
import sys
from collections import Counter
from elftools.elf.elffile import ELFFile
from capstone import *
from capstone.x86 import *
def get_binary(file: str) -> (bytes, int):
with open(file, 'rb') as stream:
elf = ELFFile(stream)
section = elf.get_section_by_name('.text')
offset, address, size = (section.header[x] for x in ['sh_offset', 'sh_addr', 'sh_size'])
stream.seek(offset)
return (stream.read(size), address)
def addressing_stats(file):
ops = {
X86_OP_FP: 'FP register',
X86_OP_IMM: 'Immediate',
X86_OP_INVALID: 'Invalid',
X86_OP_MEM: 'Memory',
X86_OP_REG: 'Registry'
}
md = Cs(CS_ARCH_X86, CS_MODE_64)
md.detail = True
counter = Counter()
for ins in md.disasm(*get_binary(file)):
counter.update([i.type for i in ins.operands])
for k, v in counter.most_common():
print(ops[k], v)
if __name__ == '__main__':
if len(sys.argv) <= 1:
print("Usage: {} binary".format(sys.argv[0]))
sys.exit(1)
addressing_stats(sys.argv[1])
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment