1 // Capstone Java binding
2 // By Nguyen Anh Quynh & Dang Hoang Vu,  2013
3 
4 import capstone.Capstone;
5 import static capstone.Capstone.CS_AC_READ;
6 import static capstone.Capstone.CS_AC_WRITE;
7 import capstone.Capstone.CsRegsAccess;
8 import capstone.X86;
9 
10 import static capstone.X86_const.*;
11 
12 public class TestX86 {
13 
hexString2Byte(String s)14   static byte[] hexString2Byte(String s) {
15     // from http://stackoverflow.com/questions/140131/convert-a-string-representation-of-a-hex-dump-to-a-byte-array-using-java
16     int len = s.length();
17     byte[] data = new byte[len / 2];
18     for (int i = 0; i < len; i += 2) {
19       data[i / 2] = (byte) ((Character.digit(s.charAt(i), 16) << 4)
20           + Character.digit(s.charAt(i+1), 16));
21     }
22     return data;
23   }
24 
25   static final String X86_CODE64 = "55488b05b8130000";
26   static final String X86_CODE16 = "8d4c320801d881c6341200000523010000368b849123010000418d8439896700008d8789670000b4c6";
27   static final String X86_CODE32 = "8d4c320801d881c6341200000523010000368b849123010000418d8439896700008d8789670000b4c6";
28 
29   public static Capstone cs;
30 
hex(int i)31   private static String hex(int i) {
32     return Integer.toString(i, 16);
33   }
34 
hex(long i)35   private static String hex(long i) {
36     return Long.toString(i, 16);
37   }
38 
array2hex(byte[] arr)39   private static String array2hex(byte[] arr) {
40     String ret = "";
41     for (int i=0 ;i<arr.length; i++)
42       ret += String.format("0x%02x ", arr[i]);
43     return ret;
44   }
45 
print_ins_detail(Capstone.CsInsn ins)46   public static void print_ins_detail(Capstone.CsInsn ins) {
47     System.out.printf("0x%x:\t%s\t%s\n", ins.address, ins.mnemonic, ins.opStr);
48 
49     X86.OpInfo operands = (X86.OpInfo) ins.operands;
50 
51     System.out.printf("\tPrefix: %s\n", array2hex(operands.prefix));
52 
53     System.out.printf("\tOpcode: %s\n", array2hex(operands.opcode));
54 
55     // print REX prefix (non-zero value is relevant for x86_64)
56     System.out.printf("\trex: 0x%x\n", operands.rex);
57 
58     // print address size
59     System.out.printf("\taddr_size: %d\n", operands.addrSize);
60 
61     // print modRM byte
62     System.out.printf("\tmodrm: 0x%x\n", operands.modrm);
63 
64     // print modRM offset
65     if (operands.encoding.modrmOffset != 0) {
66       System.out.printf("\tmodrm offset: 0x%x\n", operands.encoding.modrmOffset);
67     }
68 
69     // print displacement value
70     System.out.printf("\tdisp: 0x%x\n", operands.disp);
71 
72     // print displacement offset
73     if (operands.encoding.dispOffset != 0) {
74       System.out.printf("\tdisp offset: 0x%x\n", operands.encoding.dispOffset);
75     }
76 
77     //print displacement size
78     if (operands.encoding.dispSize != 0) {
79       System.out.printf("\tdisp size: 0x%x\n", operands.encoding.dispSize);
80     }
81 
82     // SIB is not available in 16-bit mode
83     if ( (cs.mode & Capstone.CS_MODE_16) == 0) {
84       // print SIB byte
85       System.out.printf("\tsib: 0x%x\n", operands.sib);
86       if (operands.sib != 0)
87         System.out.printf("\t\tsib_base: %s\n\t\tsib_index: %s\n\t\tsib_scale: %d\n",
88           ins.regName(operands.sibBase), ins.regName(operands.sibIndex), operands.sibScale);
89     }
90 
91     if (operands.xopCC != 0)
92         System.out.printf("\txop_cc: %u\n", operands.xopCC);
93 
94     if (operands.sseCC != 0)
95         System.out.printf("\tsse_cc: %u\n", operands.sseCC);
96 
97     if (operands.avxCC != 0)
98         System.out.printf("\tavx_cc: %u\n", operands.avxCC);
99 
100     if (operands.avxSae)
101         System.out.printf("\tavx_sae: TRUE\n");
102 
103     if (operands.avxRm != 0)
104         System.out.printf("\tavx_rm: %u\n", operands.avxRm);
105 
106     int count = ins.opCount(X86_OP_IMM);
107     if (count > 0) {
108       System.out.printf("\timm_count: %d\n", count);
109       System.out.printf("\timm offset: 0x%x\n", operands.encoding.immOffset);
110       System.out.printf("\timm size: 0x%x\n", operands.encoding.immSize);
111       for (int i=0; i<count; i++) {
112         int index = ins.opIndex(X86_OP_IMM, i + 1);
113         System.out.printf("\t\timms[%d]: 0x%x\n", i+1, (operands.op[index].value.imm));
114       }
115     }
116 
117     if (operands.op.length != 0) {
118       System.out.printf("\top_count: %d\n", operands.op.length);
119       for (int c=0; c<operands.op.length; c++) {
120         X86.Operand i = (X86.Operand) operands.op[c];
121         String imm = hex(i.value.imm);
122         if (i.type == X86_OP_REG)
123           System.out.printf("\t\toperands[%d].type: REG = %s\n", c, ins.regName(i.value.reg));
124         if (i.type == X86_OP_IMM)
125           System.out.printf("\t\toperands[%d].type: IMM = 0x%x\n", c, i.value.imm);
126         if (i.type == X86_OP_MEM) {
127           System.out.printf("\t\toperands[%d].type: MEM\n",c);
128           String segment = ins.regName(i.value.mem.segment);
129           String base = ins.regName(i.value.mem.base);
130           String index = ins.regName(i.value.mem.index);
131           if (segment != null)
132             System.out.printf("\t\t\toperands[%d].mem.segment: REG = %s\n", c, segment);
133           if (base != null)
134             System.out.printf("\t\t\toperands[%d].mem.base: REG = %s\n", c, base);
135           if (index != null)
136             System.out.printf("\t\t\toperands[%d].mem.index: REG = %s\n", c, index);
137           if (i.value.mem.scale != 1)
138             System.out.printf("\t\t\toperands[%d].mem.scale: %d\n", c, i.value.mem.scale);
139           if (i.value.mem.disp != 0)
140             System.out.printf("\t\t\toperands[%d].mem.disp: 0x%x\n", c, i.value.mem.disp);
141         }
142 
143         // AVX broadcast type
144         if (i.avx_bcast != X86_AVX_BCAST_INVALID) {
145           System.out.printf("\t\toperands[%d].avx_bcast: %d\n", c, i.avx_bcast);
146         }
147 
148         // AVX zero opmask {z}
149         if (i.avx_zero_opmask) {
150           System.out.printf("\t\toperands[%d].avx_zero_opmask: TRUE\n", c);
151         }
152 
153         System.out.printf("\t\toperands[%d].size: %d\n", c, i.size);
154         switch(i.access) {
155           case CS_AC_READ:
156             System.out.printf("\t\toperands[%d].access: READ\n", c);
157             break;
158           case CS_AC_WRITE:
159             System.out.printf("\t\toperands[%d].access: WRITE\n", c);
160             break;
161           case CS_AC_READ | CS_AC_WRITE:
162             System.out.printf("\t\toperands[%d].access: READ | WRITE\n", c);
163             break;
164         }
165       }
166 
167       // Print out all registers accessed by this instruction (either implicit or explicit)
168       CsRegsAccess regsAccess = ins.regsAccess();
169       if (regsAccess != null) {
170         short[] regsRead = regsAccess.regsRead;
171         short[] regsWrite = regsAccess.regsWrite;
172 
173         if (regsRead.length > 0) {
174           System.out.printf("\tRegisters read:");
175           for (int i = 0; i < regsRead.length; i++) {
176             System.out.printf(" %s", ins.regName(regsRead[i]));
177           }
178           System.out.print("\n");
179         }
180 
181         if (regsWrite.length > 0) {
182           System.out.printf("\tRegister modified:");
183           for (int i = 0; i < regsWrite.length; i++) {
184             System.out.printf(" %s", ins.regName(regsWrite[i]));
185           }
186           System.out.print("\n");
187         }
188       }
189     }
190   }
191 
main(String argv[])192   public static void main(String argv[]) {
193 
194     final TestBasic.platform[] all_tests = {
195       new TestBasic.platform(Capstone.CS_ARCH_X86, Capstone.CS_MODE_16, hexString2Byte(X86_CODE16), "X86 16bit (Intel syntax)"),
196       new TestBasic.platform(Capstone.CS_ARCH_X86, Capstone.CS_MODE_32, Capstone.CS_OPT_SYNTAX_ATT, hexString2Byte(X86_CODE32), "X86 32 (AT&T syntax)"),
197       new TestBasic.platform(Capstone.CS_ARCH_X86, Capstone.CS_MODE_32, hexString2Byte(X86_CODE32), "X86 32 (Intel syntax)"),
198       new TestBasic.platform(Capstone.CS_ARCH_X86, Capstone.CS_MODE_64, hexString2Byte(X86_CODE64), "X86 64 (Intel syntax)"),
199     };
200 
201     for (int i=0; i<all_tests.length; i++) {
202       TestBasic.platform test = all_tests[i];
203       System.out.println(new String(new char[16]).replace("\0", "*"));
204       System.out.println("Platform: " + test.comment);
205       System.out.println("Code: " + TestBasic.stringToHex(test.code));
206       System.out.println("Disasm:");
207 
208       cs = new Capstone(test.arch, test.mode);
209       cs.setDetail(Capstone.CS_OPT_ON);
210       if (test.syntax != 0) {
211         cs.setSyntax(test.syntax);
212       }
213       Capstone.CsInsn[] all_ins = cs.disasm(test.code, 0x1000);
214 
215       for (int j = 0; j < all_ins.length; j++) {
216         print_ins_detail(all_ins[j]);
217         System.out.println();
218       }
219 
220       System.out.printf("0x%x:\n\n", all_ins[all_ins.length-1].address + all_ins[all_ins.length-1].size);
221 
222       // Close when done
223       cs.close();
224     }
225   }
226 
227 }
228