149 lines
3.2 KiB
Python
149 lines
3.2 KiB
Python
from capstone import Cs
|
|
from capstone import (
|
|
CS_ARCH_ARM,
|
|
CS_ARCH_ARM64,
|
|
CS_ARCH_MIPS,
|
|
CS_ARCH_PPC,
|
|
CS_ARCH_SPARC,
|
|
CS_ARCH_SYSZ,
|
|
CS_ARCH_X86,
|
|
CS_ARCH_XCORE,
|
|
)
|
|
from capstone import (
|
|
CS_MODE_16,
|
|
CS_MODE_32,
|
|
CS_MODE_64,
|
|
CS_MODE_ARM,
|
|
CS_MODE_BIG_ENDIAN,
|
|
CS_MODE_LITTLE_ENDIAN,
|
|
CS_MODE_MCLASS,
|
|
CS_MODE_MICRO,
|
|
CS_MODE_MIPS3,
|
|
CS_MODE_MIPS32,
|
|
CS_MODE_MIPS32R6,
|
|
CS_MODE_MIPS64,
|
|
CS_MODE_THUMB,
|
|
CS_MODE_V8,
|
|
CS_MODE_V9,
|
|
)
|
|
import logging
|
|
|
|
|
|
class _CapstoneBase:
|
|
def __init__(self):
|
|
self.arch = self.__class__.__name__
|
|
pass
|
|
|
|
def __repr__(self) -> str:
|
|
return self.objdump
|
|
|
|
def __len__(self) -> int:
|
|
if not self.disassembly:
|
|
logging.debug(
|
|
f"payload_missing: use {self.__class__}.load(payload=bytes) prior"
|
|
)
|
|
return 0
|
|
|
|
return len(self.disassembly)
|
|
|
|
def load(self, payload: bytes, offset: int = 0):
|
|
disassembly = list()
|
|
|
|
for opcode in self.capstone.disasm(payload, offset):
|
|
disassembly.append(opcode)
|
|
|
|
if disassembly:
|
|
self.disassembly = disassembly
|
|
else:
|
|
logging.debug("disassembly_empty")
|
|
self.disassembly = list()
|
|
|
|
@property
|
|
def objdump(self) -> str:
|
|
if not self.disassembly:
|
|
logging.debug(
|
|
f"payload_missing: use {self.__class__}.load(payload=bytes) prior"
|
|
)
|
|
return ""
|
|
|
|
opcodes = str()
|
|
|
|
for opcode in self.disassembly:
|
|
opcodes += f"{opcode.address:#02x}:\t{opcode.mnemonic}\t{opcode.op_str}\n"
|
|
|
|
return opcodes
|
|
|
|
@property
|
|
def disasm(self) -> list:
|
|
if not self.disassembly:
|
|
logging.debug(
|
|
f"payload_missing: use {self.__class__}.load(payload=bytes) prior"
|
|
)
|
|
return []
|
|
|
|
opcodes = list()
|
|
|
|
for opcode in self.disassembly:
|
|
opcodes.append(
|
|
[
|
|
opcode.address,
|
|
opcode.mnemonic,
|
|
opcode.op_str,
|
|
opcode.size,
|
|
]
|
|
)
|
|
|
|
return opcodes
|
|
|
|
|
|
class X86_intel(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_X86, CS_MODE_16)
|
|
|
|
|
|
class X86(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_X86, CS_MODE_32)
|
|
|
|
|
|
class X86_64(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_X86, CS_MODE_64)
|
|
|
|
|
|
class ARM(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_ARM, CS_MODE_ARM)
|
|
|
|
|
|
class Thumb(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_ARM, CS_MODE_THUMB)
|
|
|
|
|
|
class ARM_64(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_ARM64, CS_MODE_ARM)
|
|
|
|
|
|
class MIPS_32_eb(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_MIPS, CS_MODE_MIPS32 + CS_MODE_BIG_ENDIAN)
|
|
|
|
|
|
class MIPS_64_el(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_MIPS, CS_MODE_MIPS64 + CS_MODE_LITTLE_ENDIAN)
|
|
|
|
|
|
class PPC_64(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_PPC, CS_MODE_BIG_ENDIAN)
|
|
|
|
|
|
class Sparc(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_SPARC, CS_MODE_BIG_ENDIAN)
|
|
|
|
|
|
class SparcV9(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_SPARC, CS_MODE_BIG_ENDIAN + CS_MODE_V9)
|
|
|
|
|
|
class SystemZ(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_SYSZ, 0)
|
|
|
|
|
|
class XCore(_CapstoneBase):
|
|
capstone = Cs(CS_ARCH_XCORE, 0)
|