Struct capstone3::Capstone

pub struct Capstone { /* fields omitted */ }

An instance of the capstone disassembler

Methods

impl Capstone

fn new(arch: Arch) -> Result<Capstone>

Create a new instance of the decompiler. Defaults to 64-bit little-endian mode.

use capstone::{self, Capstone};
let cs = Capstone::new(capstone::Arch::X86);
assert!(cs.is_ok());

fn detail(&self) -> Result<()>

Set the disassembly engine to use detail mode

fn mode(&mut self, modes: &[Mode]) -> Result<()>

Sets the engine's disassembly mode. Be careful, various combinations of modes aren't supported See the capstone-sys documentation for more information.

fn att(&self)

Set the X86 assembly to AT&T style (has no effect on other platforms)

fn intel(&self)

Set the X86 assembly to Intel style (default)

fn disassemble(&self, buffer: &[u8], addr: u64) -> Result<Instructions>

Disassemble a &[u8] buffer full of instructions

Disassembles all instructions in code. If you want to disassemble less, then pass a smaller slice :]

fn reg_name(&self, reg_id: u64) -> Option<String>

Convert a reg_id to a String naming the register

fn insn_name(&self, insn_id: u64) -> Option<String>

Convert an instruction_id to a String naming the instruction

Trait Implementations

impl Drop for Capstone

fn drop(&mut self)

A method called when the value goes out of scope.