Nguyen Anh Quynh aquynh
aquynh
/ gist:9391743
Created
March 6, 2014 15:08
Remove string check & stack protector functions for Capstone
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| diff --git a/Makefile b/Makefile | |
| index 3087e30..6d82dfa 100644 | |
| --- a/Makefile | |
| +++ b/Makefile | |
| @@ -15,6 +15,10 @@ RANLIB = $(CROSS)ranlib | |
| STRIP = $(CROSS)strip | |
| endif | |
| +# remove string check & stack protector functions | |
| +CFLAGS += -D_FORTIFY_SOURCE=0 |
aquynh
/ python-ptrace_capstone.patch
Last active
August 29, 2015 14:06
— forked from hugsy/python-ptrace_capstone.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- ptrace/disasm.c 2014-04-10 10:30:33.000000000 +1200 | |
| +++ ptrace/disasm2.c 2014-09-04 12:52:53.425315639 +1200 | |
| @@ -4,28 +4,21 @@ | |
| try: | |
| from ptrace.cpu_info import CPU_I386, CPU_X86_64 | |
| - try: | |
| - from distorm3 import Decode | |
| - if CPU_X86_64: | |
| - from distorm3 import Decode64Bits as DecodeBits |
aquynh
/ gist:6819d20658a847f728e2
Last active
August 29, 2015 14:06
Changes between "next" & "v3" - including all changes on instructions
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| diff -Nurp capstone-next.git/include/arm.h capstone-v3.git/include/arm.h | |
| --- capstone-next.git/include/arm.h 2014-09-24 22:57:41.000000000 +0800 | |
| +++ capstone-v3.git/include/arm.h 2014-09-24 22:57:32.000000000 +0800 | |
| @@ -50,6 +50,53 @@ typedef enum arm_cc { | |
| ARM_CC_AL // Always (unconditional) Always (unconditional) | |
| } arm_cc; | |
| +typedef enum arm_sysreg { | |
| + //> Special registers for MSR | |
| + ARM_SYSREG_INVALID = 0, |
aquynh
/ gist:cf6f1726128a5d1ce998
Created
September 24, 2014 15:12
Changes from "next" to "v3" - with changes on instruction REMOVED (to keep it short)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| diff -Nurp capstone-next.git/include/arm.h capstone-v3.git/include/arm.h | |
| --- capstone-next.git/include/arm.h 2014-09-24 22:57:41.000000000 +0800 | |
| +++ capstone-v3.git/include/arm.h 2014-09-24 22:57:32.000000000 +0800 | |
| @@ -50,6 +50,53 @@ typedef enum arm_cc { | |
| ARM_CC_AL // Always (unconditional) Always (unconditional) | |
| } arm_cc; | |
| +typedef enum arm_sysreg { | |
| + //> Special registers for MSR | |
| + ARM_SYSREG_INVALID = 0, |
aquynh
/ mips_synci.diff
Last active
August 29, 2015 14:09
— forked from pamaury/mips_synci.diff
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| diff --git a/lib/Target/Mips/Disassembler/MipsDisassembler.cpp b/lib/Target/Mips/Disassembler/MipsDisassembler.cpp | |
| index 5d594f1..dd1a29b 100644 | |
| --- a/lib/Target/Mips/Disassembler/MipsDisassembler.cpp | |
| +++ b/lib/Target/Mips/Disassembler/MipsDisassembler.cpp | |
| @@ -247,6 +247,11 @@ static DecodeStatus DecodeCacheOp(MCInst &Inst, | |
| uint64_t Address, | |
| const void *Decoder); | |
| +static DecodeStatus DecodeSyncI(MCInst &Inst, | |
| + unsigned Insn, |
aquynh
/ opaccess.py
Created
August 8, 2015 13:56
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Test op_access feature of Capstone | |
| from __future__ import print_function | |
| from capstone import * | |
| CODE = b"\x8d\x4c\x32\x08\x01\xd8" | |
| md = Cs(CS_ARCH_X86, CS_MODE_32) | |
| md.detail = True | |
| for insn in md.disasm(CODE, 0x1000): | |
| print("%s\t%s" % (insn.mnemonic, insn.op_str)) |
aquynh
/ test_masm.py
Created
August 12, 2015 07:31
This sample shows how to use MASM syntax for Capstone X86
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env python | |
| # Demo for MASM syntax of Capstone Python bindings | |
| # By Nguyen Anh Quynnh | |
| from __future__ import print_function | |
| from capstone import * | |
| X86_CODE32 = b"\xba\xcd\xab\x00\x00\x8d\x4c\x32\x08\x81\xc6\x34\x12\x00\x00" | |
| md = Cs(CS_ARCH_X86, CS_MODE_32) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| X86-16bit intel: 0xe8 0x35 0x64 = call 0x604e | |
| X86-32bit intel: 0x66 0xe8 0x35 0x64 = call 0x6054 | |
| X86-64bit intel: 0x66 0xe8 0x35 0x64 = call 0x6054 | |
| X86-16bit intel: 0xe9 0x35 0x64 = jmp 0x605e | |
| X86-16bit intel: 0x66 0xe9 0x35 0x64 0x93 0x53 = jmp 0x53946431 |
aquynh
/ gist:58f83e579f6d32695e58
Created
August 27, 2015 04:32
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| cc -I../include -L.. -lunicorn ro_mem_test.c -o ro_mem_test | |
| ro_mem_test.c:41:40: warning: passing 'char [16]' to parameter of type 'const uint8_t *' (aka 'const unsigned char *') converts between pointers to integer types with different | |
| sign [-Wpointer-sign] | |
| if (uc_mem_write(handle, 0x400000, PROGRAM, sizeof(PROGRAM))) { | |
| ^~~~~~~ | |
| ro_mem_test.c:7:17: note: expanded from macro 'PROGRAM' | |
| #define PROGRAM "\xeb\x08\x58\xc7\x00\x78\x56\x34\x12\x90\xe8\xf3\xff\xff\xff" | |
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | |
| ../include/unicorn/unicorn.h:306:66: note: passing argument to parameter 'bytes' here | |
| uc_err uc_mem_write(uch handle, uint64_t address, const uint8_t *bytes, size_t size); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Unicorn Python bindings, by Nguyen Anh Quynnh <aquynh@gmail.com> | |
| import sys | |
| _python2 = sys.version_info[0] < 3 | |
| if _python2: | |
| range = xrange | |
| from . import arm_const, arm64_const, mips_const, sparc_const, m68k_const, x86_const | |
| from unicorn_const import * | |
| import ctypes, ctypes.util, sys | |
| from platform import system |
OlderNewer