Crate bad64

bad64

bad64 is a set of Rust bindings to the Binja Arm64 Disassembler.

For more information about the disassembler, please see the upstream repo.

There are two main entry points:

1. decode for decoding a single instruction.

use bad64::{decode, Operation};
// nop - "\x1f\x20\x03\xd5"
let decoded = decode(0xd503201f, 0x1000).unwrap();
assert_eq!(decoded.operands(), 0);
assert_eq!(decoded.operation(), Operation::NOP);
assert_eq!(decoded.mnem(), "nop");

2. disassemble for disassembling a byte sequence.

use bad64::{disassemble, Operation, Operand, Reg, Imm};

// 1000: str   x0, [sp, #-16]! ; "\xe0\x0f\x1f\xf8"
// 1004: ldr   x0, [sp], #16   ; "\xe0\x07\x41\xf8"
let mut decoded_iter = disassemble(b"\xe0\x0f\x1f\xf8\xe0\x07\x41\xf8", 0x1000);

let (push_addr, maybe_push_decode) = decoded_iter.next().unwrap();
let push = maybe_push_decode.expect(&format!("Could not decode instruction at {:x}", push_addr));

assert_eq!(push_addr, 0x1000);
assert_eq!(push.operands(), 2);
assert_eq!(push.operation(), Operation::STR);
assert_eq!(push.operand(0), Some(Operand::Reg { reg: Reg::X0, shift: None }));
assert_eq!(push.operand(1), Some(Operand::MemPreIdx { reg: Reg::SP, offset: 16 }));
assert_eq!(push.operand(2), None);

let (pop_addr, maybe_pop_decode) = decoded_iter.next().unwrap();
let pop = maybe_pop_decode.expect(&format!("Could not decode instruction at {:x}", pop_addr));

assert_eq!(pop_addr, 0x1004);
assert_eq!(pop.operands(), 2);
assert_eq!(pop.operation(), Operation::LDR);
assert_eq!(pop.operand(0), Some(Operand::Reg { reg: Reg::X0, shift: None }));
assert_eq!(pop.operand(1), Some(Operand::MemPostIdxImm { reg: Reg::SP, imm: Imm { neg: false, val: 16 }}));
assert_eq!(pop.operand(2), None);

assert_eq!(decoded_iter.next(), None);

Structs

Imm	An instruction immediate
Instruction	A decoded instruction

Enums

DecodeError	Decoding errors types
Operand	An instruction operand
Operation	An instruction operation
Reg	Register
Shift	Register or immediate shift in an operand
SysReg	A system register

Functions

decode	Decode a single instruction
disassemble	Disassemble byte slice