keystone-engine 0.1.0

Rust bindings for the Keystone Engine assembler library.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

using System;
using NUnit.Framework;
using Shouldly;

namespace Keystone.Tests
{
    [TestFixture]
    public class ExecutionTests
    {
        [OneTimeSetUp]
        public static void InitializeKeystone()
        {
            // Ensures the lib could be loaded
            Engine.IsArchitectureSupported(Architecture.X86).ShouldBeTrue();
        }

        [Test]
        public void ShouldEmitValidX86Data()
        {
            using (Engine engine = new Engine(Architecture.X86, Mode.X32) { ThrowOnError = true })
            {
                engine.Assemble("nop", 0).Buffer.ShouldBe(new byte[] { 0x90 });
                engine.Assemble("add eax, eax", 0).Buffer.ShouldBe(new byte[] { 0x01, 0xC0 });
            }
        }

        [Test]
        public void ShouldEmitValidARMData()
        {
            using (Engine engine = new Engine(Architecture.ARM, Mode.ARM) { ThrowOnError = true })
            {
                engine.Assemble("mul r1, r0, r0", 0).Buffer.ShouldBe(new byte[] { 0x90, 0x00, 0x01, 0xE0 });
            }
        }

        [Test]
        public void ShouldThrowOnError()
        {
            using (Engine engine = new Engine(Architecture.ARM, Mode.ARM) { ThrowOnError = false })
            {
                engine.Assemble("push eax, 0x42", 0).ShouldBeNull();
                engine.Assemble("doesntexist", 0).ShouldBeNull();
            }

            using (Engine engine = new Engine(Architecture.ARM, Mode.ARM) { ThrowOnError = true })
            {
                Should.Throw<KeystoneException>(() => engine.Assemble("push eax, 0x42", 0));
                Should.Throw<KeystoneException>(() => engine.Assemble("doestexist", 0));
            }
        }

        [Test, Ignore("Feature requires Keystone built after October 7th 2016.")]
        public void ShouldHaveValidExample()
        {
            using (Engine keystone = new Engine(Architecture.X86, Mode.X32) { ThrowOnError = true })
            {
                ulong address = 0;

                keystone.ResolveSymbol += (string s, ref ulong w) =>
                {
                    if (s == "_j1")
                    {
                        w = 0x1234abcd;
                        return true;
                    }

                    return false;
                };

                EncodedData enc = keystone.Assemble("xor eax, eax; jmp _j1", address);

                enc.Buffer.ShouldBe(new byte[] { 0x00 });
                enc.Address.ShouldBe(address);
                enc.StatementCount.ShouldBe(3);
            }
        }
    }
}