Skip to content

Instantly share code, notes, and snippets.

@jduck
Last active February 2, 2017 15:28
Show Gist options
  • Star 6 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save jduck/7946961 to your computer and use it in GitHub Desktop.
Save jduck/7946961 to your computer and use it in GitHub Desktop.
Sample utility to disassemble a raw ARM bytecode file using Capstone.
#!/usr/bin/env python
#
# Simple utility to disassemble a raw bytecode file using Capstone.
#
# -jduck
#
import argparse
import capstone
import struct
def arm_mode(string):
if string == "arm":
return capstone.CS_MODE_ARM
elif string == "thumb":
return capstone.CS_MODE_THUMB
msg = "%r is not a valid ARM execution mode" % string
raise argparse.ArgumentTypeError(msg)
return None
def hexbytes(insn):
b = buffer(insn.bytes)
if len(insn.bytes) == 4:
return "0x%08x" % (struct.unpack_from('I', b))
elif len(insn.bytes) == 2:
return "0x%04x" % (struct.unpack_from('H', b))
raise 'Unknown instruction lenght?!'
if __name__ == "__main__":
p = argparse.ArgumentParser(description='ARM disassembler tool')
#p.add_argument('-a', '--arch', default='x86', type=arch
p.add_argument('-m', '--mode', default='arm', type=arm_mode, help='ARM execution mode')
p.add_argument('-f', '--file', default=None, help='File to read opcodes from')
args = p.parse_args()
code = None
with open(args.file, 'rb') as f:
code = f.read()
md = capstone.Cs(capstone.CS_ARCH_ARM, args.mode)
for insn in md.disasm(code, 0x0):
print "0x%08x: %-10s %s %s" % (insn.address, hexbytes(insn), insn.mnemonic, insn.op_str)
@jiak94
Copy link

jiak94 commented Mar 1, 2016

What's the input file format? The executable file?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment