Crate capstone_sys
source · [−]Expand description
Low-level, unsafe Rust bindings for the Capstone disassembly library.
We recommend against using this crate directly. Instead, consider using capstone-rs, which provides a high-level, safe, “Rusty” interface.
Supported disassembly architectures
arm: ARMarm64: ARM64 (also known as AArch64)mips: MIPSppc: PowerPCsparc: SPARCsysz: System zx86: x86 family (includes 16, 32, and 64 bit modes)xcore: XCore
For each architecture, at least the following types are defined (replace ARCH with
architecture names shown above):
enum ARCH_insn: instruction idsenum ARCH_insn_group: architecture-specific group idsenum ARCH_op_type: instruction operand types idsenum ARCH_reg1: register idsstruct ARCH_op_mem: operand referring to memorystruct cs_ARCH_op: instruction operandstruct cs_ARCH: instruction
Note: documentation for functions/types was taken directly from Capstone C headers.
1: Defined as a “constified” enum modules because discriminant values are not unique. Rust requires discriminant values to be unique.
Modules
Structs
Information specific to architecture
Instruction’s operand referring to memory This is associated with ARM64_OP_MEM operand type above
Instruction’s operand referring to memory This is associated with ARM_OP_MEM operand type above
Instruction’s operand referring to memory This is associated with BPF_OP_MEM operand type above
Common instruction operand access types - to be consistent across all architectures. It is possible to combine access types, for example: CS_AC_READ | CS_AC_WRITE
Instruction structure
Instruction structure
Instruction operand
Instruction operand
Instruction structure
Instruction operand
NOTE: All information in cs_detail is only available when CS_OPT_DETAIL = CS_OPT_ON Initialized as memset(., 0, offsetof(cs_detail, ARCH)+sizeof(cs_ARCH)) by ARCH_getInstruction in arch/ARCH/ARCHDisassembler.c if cs_detail changes, in particular if a field is added after the union, then update arch/ARCH/ARCHDisassembler.c accordingly
Instruction structure
Detail information of disassembled instruction
The M68K instruction and it’s operands
Instruction operand
Register pair in one operand.
The M680X instruction and it’s operands
Instruction operand
Instruction structure
Instruction operand
Mode type
The MOS65XX address mode and it’s operands
Instruction operand
User-defined dynamic memory related functions: malloc/calloc/realloc/free/vsnprintf() By default, Capstone uses system’s malloc(), calloc(), realloc(), free() & vsnprintf().
Customize mnemonic for instructions with alternative name. To reset existing customized instruction to its default mnemonic, call cs_option(CS_OPT_MNEMONIC) again with the same @id and NULL value for @mnemonic.
User-customized setup for SKIPDATA option
Instruction structure
Instruction operand
Instruction structure
Instruction operand
Instruction operand
Instruction structure
Instruction structure
Instruction operand
Instruction structure
Instruction operand
Instruction’s operand referring to memory This is associated with M68K_OP_MEM operand type above
Operation size of the current instruction (NOT the actually size of instruction)
Instruction’s operand referring to extended addressing
Instruction’s operand referring to indexed addressing
Instruction’s memory operand referring to relative addressing (Bcc/LBcc)
Instruction’s operand referring to memory This is associated with MIPS_OP_MEM operand type above
Instruction’s operand referring to memory This is associated with PPC_OP_MEM operand type above
Instruction’s operand referring to memory This is associated with SPARC_OP_MEM operand type above
Instruction’s operand referring to memory This is associated with SYSZ_OP_MEM operand type above
Instruction’s operand referring to memory This is associated with X86_OP_MEM operand type above
Instruction’s operand referring to memory This is associated with XCORE_OP_MEM operand type above
Enums
AT operations
Memory barrier operands
ARM64 condition code
DC operations
ARM64 extender type
IC operations
ARM64 instruction
Operand type for instruction’s operands
Prefetch operations (PRFM)
System PState Field (MSR instruction)
ARM64 shift type
System registers
TLBI operations
Vector arrangement specifier (for FloatingPoint/Advanced SIMD insn)
ARM condition code
Operand type for SETEND instruction
ARM instruction
The memory barrier constants map directly to the 4-bit encoding of the option field for Memory Barrier operations.
Operand type for instruction’s operands
Operand type for SETEND instruction
ARM shift type
Data type for elements of vector instructions.
Operand type for instruction’s operands
BPF registers
Architecture type
Common instruction operand types - to be consistent across all architectures.
Runtime option for the disassembled engine
EVM instruction
M68K Addressing Modes
Operation size of the CPU instructions
Operation size of the FPU instructions (Notice that FPU instruction can also use CPU sizes if needed)
Group of M68K instructions
M68K instruction
Operand type for instruction’s operands
Operand type for instruction’s operands
Type of size that is being used for the current instruction
Group of M680X instructions
M680X instruction IDs
Operand type for instruction’s operands
MIPS instruction
Operand type for instruction’s operands
MOS65XX Addressing Modes
Operand type for instruction’s operands
MOS65XX registers and special registers
PPC branch codes for some branch instructions
PPC branch hint for some branch instructions
PPC instruction
Operand type for instruction’s operands
Enums corresponding to Sparc condition codes, both icc’s and fcc’s.
Branch hint
SPARC instruction
Operand type for instruction’s operands
Enums corresponding to SystemZ condition codes
SystemZ instruction
Operand type for instruction’s operands
AVX broadcast type
AVX Code Condition type
AVX static rounding mode type
X86 instructions
Operand type for instruction’s operands
Instruction prefixes - to be used in cs_x86.prefix[]
SSE Code Condition type
XOP Code Condition type
XCore instruction
Operand type for instruction’s operands
Constants
< Uninitialized/invalid access type.
< Operand read from memory or register.
< Operand write to memory or register.
< 16-bit mode (X86)
< 32-bit mode (X86)
< 64-bit mode (X86, PPC)
< 32-bit ARM
< big-endian mode
< Book-E mode (PPC)
< Classic BPF mode (default)
< Extended BPF mode
< little-endian mode (default mode)
< M68K 68000 mode
< M68K 68010 mode
< M68K 68020 mode
< M68K 68030 mode
< M68K 68040 mode
< M68K 68060 mode
< M680X Hitachi 6301,6303 mode
< M680X Hitachi 6309 mode
< M680X Motorola 6800,6802 mode
< M680X Motorola 6801,6803 mode
< M680X Motorola/Freescale 6805 mode
< M680X Motorola/Freescale/NXP 68HC08 mode
< M680X Motorola 6809 mode
< M680X Motorola/Freescale/NXP 68HC11 mode
< M680X Motorola/Freescale/NXP CPU12 < used on M68HC12/HCS12
< M680X Freescale/NXP HCS08 mode
< ARM’s Cortex-M series
< MicroMips mode (MIPS)
< Mips II ISA
< Mips III ISA
< Mips32 ISA (Mips)
< Mips32r6 ISA
< Mips64 ISA (Mips)
< MOS65XXX WDC 65c02
< MOS65XXX MOS 6502
< MOS65XXX WDC 65816, 8-bit m/x
< MOS65XXX WDC 65816, 16-bit m, 8-bit x
< MOS65XXX WDC 65816, 8-bit m, 16-bit x
< MOS65XXX WDC W65c02
< Quad Processing eXtensions mode (PPC)
< RISCV RV32G
< RISCV RV64G
< RISCV compressed instructure mode
< Signal Processing Engine mode (PPC)
< ARM’s Thumb mode, including Thumb-2
< ARMv8 A32 encodings for ARM
< SparcV9 mode (Sparc)
Statics
Functions
Close CS handle: MUST do to release the handle when it is not used anymore. NOTE: this must be only called when there is no longer usage of Capstone, not even access to cs_insn array. The reason is the this API releases some cached memory, thus access to any Capstone API after cs_close() might crash your application.
Disassemble binary code, given the code buffer, size, address and number of instructions to be decoded. This API dynamically allocate memory to contain disassembled instruction. Resulting instructions will be put into @*insn
Fast API to disassemble binary code, given the code buffer, size, address and number of instructions to be decoded. This API puts the resulting instruction into a given cache in @insn. See tests/test_iter.c for sample code demonstrating this API.
Report the last error number when some API function fail. Like glibc’s errno, cs_errno might not retain its old value once accessed.
Return friendly name of a group id (that an instruction can belong to) Find the group id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, …)
Check if a disassembled instruction belong to a particular group. Find the group id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, …) Internally, this simply verifies if @group_id matches any member of insn->groups array.
Return friendly name of an instruction in a string. Find the instruction id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, …)
Count the number of operands of a given type. Find the operand type in header file of corresponding architecture (arm.h for ARM, x86.h for X86, …)
Retrieve the position of operand of given type in
Return friendly name of register in a string. Find the instruction id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, …)
Check if a disassembled instruction IMPLICITLY used a particular register. Find the register id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, …) Internally, this simply verifies if @reg_id matches any member of insn->regs_read array.
Check if a disassembled instruction IMPLICITLY modified a particular register. Find the register id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, …) Internally, this simply verifies if @reg_id matches any member of insn->regs_write array.
Retrieve all the registers accessed by an instruction, either explicitly or implicitly.
Return a string describing given error code.
This API can be used to either ask for archs supported by this library, or check to see if the library was compile with ‘diet’ option (or called in ‘diet’ mode).
Return combined API version & major and minor version numbers.
Type Definitions
Type of array to keep the list of registers
User-defined callback function for SKIPDATA option. See tests/test_skipdata.c for sample code demonstrating this API.
Unions
Architecture-specific instruction info