diff options
| author |   Angelos Mouzakitis <a.mouzakitis@virtualopensystems.com> | 2023-10-10 14:33:42 +0000 |
|---|---|---|
| committer | Angelos Mouzakitis <a.mouzakitis@virtualopensystems.com> | 2023-10-10 14:33:42 +0000 |
| commit | af1a266670d040d2f4083ff309d732d648afba2a (patch) | |
| tree | 2fc46203448ddcc6f81546d379abfaeb323575e9 /capstone/bindings/vb6 | |
| parent | e02cda008591317b1625707ff8e115a4841aa889 (diff) | |
Change-Id: Iaf8d18082d3991dec7c0ebbea540f092188eb4ec
Diffstat (limited to 'capstone/bindings/vb6')
| -rw-r--r-- | capstone/bindings/vb6/CDisassembler.cls | 153 | ||||
| -rw-r--r-- | capstone/bindings/vb6/CInstDetails.cls | 119 | ||||
| -rw-r--r-- | capstone/bindings/vb6/CInstruction.cls | 133 | ||||
| -rw-r--r-- | capstone/bindings/vb6/CX86Inst.cls | 197 | ||||
| -rw-r--r-- | capstone/bindings/vb6/CX86OpMem.cls | 28 | ||||
| -rw-r--r-- | capstone/bindings/vb6/CX86Operand.cls | 202 | ||||
| -rw-r--r-- | capstone/bindings/vb6/Form1.frm | 275 | ||||
| -rw-r--r-- | capstone/bindings/vb6/Form1.frx | 1 | ||||
| -rw-r--r-- | capstone/bindings/vb6/Module1.bas | 635 | ||||
| -rw-r--r-- | capstone/bindings/vb6/Project1.vbp | 46 | ||||
| -rw-r--r-- | capstone/bindings/vb6/Project1.vbw | 10 | ||||
| -rw-r--r-- | capstone/bindings/vb6/README.txt | 30 | ||||
| -rw-r--r-- | capstone/bindings/vb6/mMisc.bas | 385 | ||||
| -rw-r--r-- | capstone/bindings/vb6/mx86.bas | 1868 | ||||
| -rw-r--r-- | capstone/bindings/vb6/screenshot.png | bin | 0 -> 23811 bytes | |||
| -rw-r--r-- | capstone/bindings/vb6/vbCapstone.cpp | 119 | ||||
| -rw-r--r-- | capstone/bindings/vb6/vbCapstone.sln | 20 | ||||
| -rw-r--r-- | capstone/bindings/vb6/vbCapstone.vcproj | 182 |
18 files changed, 4403 insertions, 0 deletions
diff --git a/capstone/bindings/vb6/CDisassembler.cls b/capstone/bindings/vb6/CDisassembler.cls new file mode 100644 index 000000000..c390d58cb --- /dev/null +++ b/capstone/bindings/vb6/CDisassembler.cls @@ -0,0 +1,153 @@ +VERSION 1.0 CLASS
+BEGIN
+ MultiUse = -1 'True
+ Persistable = 0 'NotPersistable
+ DataBindingBehavior = 0 'vbNone
+ DataSourceBehavior = 0 'vbNone
+ MTSTransactionMode = 0 'NotAnMTSObject
+END
+Attribute VB_Name = "CDisassembler"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = True
+Attribute VB_PredeclaredId = False
+Attribute VB_Exposed = False
+Option Explicit
+
+'Capstone Disassembly Engine bindings for VB6
+'Contributed by FireEye FLARE Team
+'Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
+'License: Apache
+'Copyright: FireEye 2017
+
+
+'NOTE: the VB code was built and tested against Capstone v3.0 rc4
+' if the capstone C structures change, the VB code will have to
+' be adjusted to match!
+'
+' instructions details are currently only implemented for x86
+
+Public arch As cs_arch
+Public mode As cs_mode
+Public hCapstone As Long
+Public hLib As Long
+
+Public version As String
+Public vMajor As Long
+Public vMinor As Long
+
+Public errMsg As String
+Public lastErr As cs_err
+
+Private Function CheckPath(pth As String) As Long
+
+ Dim hCap As Long, capPth As String, shimPth As String
+
+ shimPth = pth & "\vbCapstone.dll"
+ capPth = pth & "\capstone.dll"
+
+ If Not FileExists(shimPth) Then Exit Function
+
+ hCap = LoadLibrary(capPth)
+ If hCap = 0 Then hCap = LoadLibrary("capstone.dll")
+ If hCap = 0 Then errMsg = "Could not find capstone.dll"
+
+ CheckPath = LoadLibrary(shimPth)
+ 'If CheckPath = 0 Then MsgBox Err.LastDllError
+
+End Function
+
+Public Function init(arch As cs_arch, mode As cs_mode, Optional enableDetails As Boolean = False) As Boolean
+
+ errMsg = Empty
+ hLib = GetModuleHandle("vbCapstone.dll")
+
+ If hLib = 0 Then hLib = CheckPath(App.path & "\bin\")
+ If hLib = 0 Then hLib = CheckPath(App.path & "\")
+ If hLib = 0 Then hLib = CheckPath(App.path & "\..\")
+ If hLib = 0 Then hLib = LoadLibrary("vbCapstone.dll")
+
+ If hLib = 0 Then
+ errMsg = errMsg & " Could not load vbCapstone.dll"
+ Exit Function
+ End If
+
+ Me.arch = arch
+ Me.mode = mode
+
+ cs_version vMajor, vMinor
+ version = vMajor & "." & vMinor
+
+ If cs_support(arch) = 0 Then
+ errMsg = "specified architecture not supported"
+ Exit Function
+ End If
+
+ Dim handle As Long 'in vb class a public var is actually a property get/set can not use as byref to api..
+ lastErr = cs_open(arch, mode, handle)
+ If lastErr <> CS_ERR_OK Then
+ errMsg = err2str(lastErr)
+ Exit Function
+ End If
+
+ hCapstone = handle
+ If enableDetails Then 'vb bindings currently only support details for x86
+ If arch = CS_ARCH_X86 Then
+ cs_option handle, CS_OPT_DETAIL, CS_OPT_ON
+ End If
+ End If
+
+ init = True
+
+End Function
+
+'base is a variant and currently accepts the following input types:
+' x64 number held as currency type (ex. makeCur(&haabbccdd, &h11223344) )
+' int/long value (ex. &h1000 or 12345)
+' numeric string or 0x/&h prefixed hex string (ex. "12345", "0x1200", "&haabbccdd")
+Function disasm(ByVal base, code() As Byte, Optional count As Long = 0) As Collection
+
+ Dim c As Long
+ Dim instAry As Long
+ Dim ret As New Collection
+ Dim ci As CInstruction
+ Dim i As Long
+ Dim address As Currency
+
+ On Error Resume Next
+
+ Set disasm = ret
+
+ If TypeName(base) = "Currency" Then
+ address = base
+ Else
+ If TypeName(base) = "String" Then base = Replace(Trim(base), "0x", "&h")
+ address = lng2Cur(CLng(base))
+ If Err.Number <> 0 Then
+ errMsg = "Could not convert base address to long"
+ Exit Function
+ End If
+ End If
+
+ c = cs_disasm(Me.hCapstone, code(0), UBound(code) + 1, address, count, instAry)
+ If c = 0 Then Exit Function
+
+ For i = 0 To c - 1
+ Set ci = New CInstruction
+ ci.LoadInstruction instAry, i, Me
+ ret.Add ci
+ Next
+
+ cs_free instAry, c
+
+End Function
+
+
+Private Sub Class_Terminate()
+ Dim msg As String
+ If DEBUG_DUMP Then
+ msg = "CDissembler.Terminate " & Hex(hCapstone)
+ If hCapstone <> 0 Then lastErr = cs_close(hCapstone)
+ Debug.Print msg & " : " & lastErr
+ End If
+End Sub
+
diff --git a/capstone/bindings/vb6/CInstDetails.cls b/capstone/bindings/vb6/CInstDetails.cls new file mode 100644 index 000000000..9495f7fc1 --- /dev/null +++ b/capstone/bindings/vb6/CInstDetails.cls @@ -0,0 +1,119 @@ +VERSION 1.0 CLASS
+BEGIN
+ MultiUse = -1 'True
+ Persistable = 0 'NotPersistable
+ DataBindingBehavior = 0 'vbNone
+ DataSourceBehavior = 0 'vbNone
+ MTSTransactionMode = 0 'NotAnMTSObject
+END
+Attribute VB_Name = "CInstDetails"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = True
+Attribute VB_PredeclaredId = False
+Attribute VB_Exposed = False
+Option Explicit
+'Capstone Disassembly Engine bindings for VB6
+'Contributed by FireEye FLARE Team
+'Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
+'License: Apache
+'Copyright: FireEye 2017
+
+'Public Type cs_detail
+' regs_read(0 To 15) As Byte ' list of implicit registers read by this insn UNSIGNED
+' regs_read_count As Byte ' number of implicit registers read by this insn UNSIGNED
+' regs_write(0 To 19) As Byte ' list of implicit registers modified by this insn UNSIGNED
+' regs_write_count As Byte ' number of implicit registers modified by this insn UNSIGNED
+' groups(0 To 7) As Byte ' list of group this instruction belong to UNSIGNED
+' groups_count As Byte ' number of groups this insn belongs to UNSIGNED
+'
+' // Architecture-specific instruction info
+' union {
+' cs_x86 x86; // X86 architecture, including 16-bit, 32-bit & 64-bit mode
+' cs_arm64 arm64; // ARM64 architecture (aka AArch64)
+' cs_arm arm; // ARM architecture (including Thumb/Thumb2)
+' cs_mips mips; // MIPS architecture
+' cs_ppc ppc; // PowerPC architecture
+' cs_sparc sparc; // Sparc architecture
+' cs_sysz sysz; // SystemZ architecture
+' cs_xcore xcore; // XCore architecture
+' };
+'} cs_detail;
+
+Public regRead As New Collection
+Public regWritten As New Collection
+Public groups As New Collection
+Public parent As CDisassembler
+
+'this will be set to a class of the specific instruction info type by architecture..
+Public info As Object
+
+Private m_raw() As Byte
+
+Function toString() As String
+
+ On Error Resume Next
+
+ Dim ret() As String
+ Dim v, tmp
+
+ push ret, "Instruction details: "
+ push ret, String(40, "-")
+
+ If DEBUG_DUMP Then
+ push ret, "Raw: "
+ push ret, HexDump(m_raw)
+ End If
+
+ push ret, "Registers Read: " & regRead.count & IIf(regRead.count > 0, " Values: " & col2Str(regRead), Empty)
+ push ret, "Registers Written: " & regWritten.count & IIf(regWritten.count > 0, " Values: " & col2Str(regWritten), Empty)
+ push ret, "Groups: " & groups.count & IIf(groups.count > 0, " Values: " & col2Str(groups), Empty)
+
+ 'it is expected that each CXXInst class implements a toString() method..if not we catch the error anyway..
+ If Not info Is Nothing Then
+ push ret, info.toString()
+ End If
+
+ toString = Join(ret, vbCrLf)
+
+End Function
+
+Friend Sub LoadDetails(lpDetails As Long, parent As CDisassembler)
+
+ Dim cd As cs_detail
+ Dim i As Long
+ Dim x86 As CX86Inst
+
+ Set Me.parent = parent
+
+ 'vbdef only contains up to the groups_count field..
+ CopyMemory ByVal VarPtr(cd), ByVal lpDetails, LenB(cd)
+
+ If DEBUG_DUMP Then
+ ReDim m_raw(LenB(cd))
+ CopyMemory ByVal VarPtr(m_raw(0)), ByVal lpDetails, LenB(cd)
+ End If
+
+ For i = 1 To cd.regs_read_count
+ regRead.Add cd.regs_read(i - 1)
+ Next
+
+ For i = 1 To cd.regs_write_count
+ regWritten.Add cd.regs_write(i - 1)
+ Next
+
+ For i = 1 To cd.groups_count
+ groups.Add cd.groups(i - 1)
+ Next
+
+ Const align = 5
+
+ 'each arch needs its own CxxInstr class implemented here...
+ If parent.arch = CS_ARCH_X86 Then
+ Set x86 = New CX86Inst
+ x86.LoadDetails lpDetails + LenB(cd) + align, parent
+ Set info = x86
+ End If
+
+
+
+End Sub
diff --git a/capstone/bindings/vb6/CInstruction.cls b/capstone/bindings/vb6/CInstruction.cls new file mode 100644 index 000000000..6c9bcc4ff --- /dev/null +++ b/capstone/bindings/vb6/CInstruction.cls @@ -0,0 +1,133 @@ +VERSION 1.0 CLASS
+BEGIN
+ MultiUse = -1 'True
+ Persistable = 0 'NotPersistable
+ DataBindingBehavior = 0 'vbNone
+ DataSourceBehavior = 0 'vbNone
+ MTSTransactionMode = 0 'NotAnMTSObject
+END
+Attribute VB_Name = "CInstruction"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = True
+Attribute VB_PredeclaredId = False
+Attribute VB_Exposed = False
+Option Explicit
+
+'Capstone Disassembly Engine bindings for VB6
+'Contributed by FireEye FLARE Team
+'Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
+'License: Apache
+'Copyright: FireEye 2017
+
+
+'Public Type cs_insn
+' ' Instruction ID (basically a numeric ID for the instruction mnemonic)
+' ' Find the instruction id in the '[ARCH]_insn' enum in the header file
+' ' of corresponding architecture, such as 'arm_insn' in arm.h for ARM,
+' ' 'x86_insn' in x86.h for X86, etc...
+' ' available even when CS_OPT_DETAIL = CS_OPT_OFF
+' ' NOTE: in Skipdata mode, "data" instruction has 0 for this id field. UNSIGNED
+' id As Long '
+' align As Long 'not sure why it needs this..but it does..
+' address As Currency ' Address (EIP) of this instruction available even when CS_OPT_DETAIL = CS_OPT_OFF UNSIGNED
+' size As Integer ' Size of this instruction available even when CS_OPT_DETAIL = CS_OPT_OFF UNSIGNED
+' bytes(0 To 23) As Byte ' Machine bytes of this instruction, with number of bytes indicated by @size above available even when CS_OPT_DETAIL = CS_OPT_OFF
+' mnemonic(0 To 31) As Byte ' Ascii text of instruction mnemonic available even when CS_OPT_DETAIL = CS_OPT_OFF
+' op_str(0 To 159) As Byte ' Ascii text of instruction operands available even when CS_OPT_DETAIL = CS_OPT_OFF
+'
+' ' Pointer to cs_detail.
+' ' NOTE: detail pointer is only valid when both requirements below are met:
+' ' (1) CS_OP_DETAIL = CS_OPT_ON
+' ' (2) Engine is not in Skipdata mode (CS_OP_SKIPDATA option set to CS_OPT_ON)
+' ' NOTE 2: when in Skipdata mode, or when detail mode is OFF, even if this pointer
+' ' is not NULL, its content is still irrelevant.
+' lpDetail As Long ' points to a cs_detail structure NOTE: only available when CS_OPT_DETAIL = CS_OPT_ON
+'
+'End Type
+
+Public ID As Long
+Public address As Currency
+Public size As Long
+Private m_bytes() As Byte
+Public instruction As String
+Public operand As String
+Public lpDetails As Long
+Public parent As CDisassembler
+
+Public details As CInstDetails 'may be null
+
+Property Get bytes() As Byte()
+ bytes = Me.bytes()
+End Property
+
+Property Get byteDump(Optional padding = 15) As String
+ Dim b As String, i As Long
+ For i = 0 To UBound(m_bytes)
+ b = b & hhex(m_bytes(i)) & " "
+ Next
+ byteDump = rpad(b, padding)
+End Property
+
+Property Get text() As String
+
+ text = cur2str(address) & " " & byteDump & " " & instruction & " " & operand
+
+End Property
+
+Function toString() As String
+
+ Dim r() As String
+
+ push r, "CInstruction: "
+ push r, String(40, "-")
+ push r, "Id: " & Hex(ID)
+ push r, "address: " & cur2str(address)
+ push r, "size: " & Hex(size)
+ push r, "bytes: " & byteDump()
+ push r, "instruction: " & instruction
+ push r, "operand: " & operand
+ push r, "lpDetails: " & Hex(lpDetails)
+
+ If Not details Is Nothing Then
+ push r, details.toString()
+ End If
+
+ toString = Join(r, vbCrLf)
+
+End Function
+
+Friend Sub LoadInstruction(instAry As Long, index As Long, parent As CDisassembler)
+
+ Dim inst As cs_insn
+ Dim i As Long
+
+ getInstruction instAry, index, VarPtr(inst), LenB(inst)
+
+ ID = inst.ID
+ address = inst.address
+ size = inst.size
+ lpDetails = inst.lpDetail
+ Set Me.parent = parent
+
+ m_bytes() = inst.bytes
+ ReDim Preserve m_bytes(size - 1)
+
+ For i = 0 To UBound(inst.mnemonic)
+ If inst.mnemonic(i) = 0 Then Exit For
+ instruction = instruction & Chr(inst.mnemonic(i))
+ Next
+
+ For i = 0 To UBound(inst.op_str)
+ If inst.op_str(i) = 0 Then Exit For
+ operand = operand & Chr(inst.op_str(i))
+ Next
+
+ If lpDetails = 0 Then Exit Sub
+ Set details = New CInstDetails
+ details.LoadDetails lpDetails, parent
+
+End Sub
+
+
+
+
diff --git a/capstone/bindings/vb6/CX86Inst.cls b/capstone/bindings/vb6/CX86Inst.cls new file mode 100644 index 000000000..daf7dd5b8 --- /dev/null +++ b/capstone/bindings/vb6/CX86Inst.cls @@ -0,0 +1,197 @@ +VERSION 1.0 CLASS
+BEGIN
+ MultiUse = -1 'True
+ Persistable = 0 'NotPersistable
+ DataBindingBehavior = 0 'vbNone
+ DataSourceBehavior = 0 'vbNone
+ MTSTransactionMode = 0 'NotAnMTSObject
+END
+Attribute VB_Name = "CX86Inst"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = True
+Attribute VB_PredeclaredId = False
+Attribute VB_Exposed = False
+Option Explicit
+
+'Capstone Disassembly Engine bindings for VB6
+'Contributed by FireEye FLARE Team
+'Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
+'License: Apache
+'Copyright: FireEye 2017
+
+
+'// Instruction structure sizeof() = 432 bytes
+'typedef struct cs_x86 {
+' // Instruction prefix, which can be up to 4 bytes.
+' // A prefix byte gets value 0 when irrelevant.
+' // prefix[0] indicates REP/REPNE/LOCK prefix (See X86_PREFIX_REP/REPNE/LOCK above)
+' // prefix[1] indicates segment override (irrelevant for x86_64):
+' // See X86_PREFIX_CS/SS/DS/ES/FS/GS above.
+' // prefix[2] indicates operand-size override (X86_PREFIX_OPSIZE)
+' // prefix[3] indicates address-size override (X86_PREFIX_ADDRSIZE)
+' uint8_t prefix[4];
+'
+' // Instruction opcode, wich can be from 1 to 4 bytes in size.
+' // This contains VEX opcode as well.
+' // An trailing opcode byte gets value 0 when irrelevant.
+' uint8_t opcode[4];
+'
+' // REX prefix: only a non-zero value is relavant for x86_64
+' uint8_t rex;
+'
+' // Address size, which can be overrided with above prefix[5].
+' uint8_t addr_size;
+'
+' // ModR/M byte
+' uint8_t modrm;
+'
+' // SIB value, or 0 when irrelevant.
+' uint8_t sib;
+'
+' // Displacement value, or 0 when irrelevant.
+' int32_t disp;
+'
+' /* SIB state */
+' // SIB index register, or X86_REG_INVALID when irrelevant.
+' x86_reg sib_index;
+' // SIB scale. only applicable if sib_index is relavant.
+' int8_t sib_scale;
+' // SIB base register, or X86_REG_INVALID when irrelevant.
+' x86_reg sib_base;
+'
+' // SSE Code Condition
+' x86_sse_cc sse_cc;
+'
+' // AVX Code Condition
+' x86_avx_cc avx_cc;
+'
+' // AVX Suppress all Exception
+' bool avx_sae;
+'
+' // AVX static rounding mode
+' x86_avx_rm avx_rm;
+'
+' // Number of operands of this instruction,
+' // or 0 when instruction has no operand.
+' uint8_t op_count;
+'
+' cs_x86_op operands[8]; // operands for this instruction.
+'} cs_x86;
+
+Private m_prefix() As Byte
+Private m_opcode() As Byte
+Public rex As Byte
+Public addr_size As Byte
+Public modrm As Byte
+Public sib As Byte
+Public disp As Long
+Public sib_index As x86_reg
+Public sib_scale As Byte
+Public sib_base As x86_reg
+Public sse_cc As x86_sse_cc
+Public avx_cc As x86_avx_cc
+Public avx_sae As Boolean
+Public avx_rm As x86_avx_rm
+Public operands As New Collection
+
+Public parent As CDisassembler
+Private hEngine As Long
+Private m_raw() As Byte
+
+Property Get prefix() As Byte()
+ prefix = m_prefix
+End Property
+
+Property Get opcode() As Byte()
+ opcode = m_opcode
+End Property
+
+Function toString() As String
+
+ Dim r() As String
+ Dim o As CX86Operand
+
+ push r, "X86 Instruction Details:"
+ push r, String(40, "-")
+
+ If DEBUG_DUMP Then
+ push r, "Raw: "
+ push r, HexDump(m_raw)
+ End If
+
+ push r, "Prefix: " & b2Str(m_prefix)
+ push r, "OpCode: " & b2Str(m_opcode)
+ push r, "Rex: " & rex
+ push r, "addr_size: " & addr_size
+ push r, "modrm: " & Hex(modrm)
+ push r, "disp: " & Hex(disp)
+
+ If parent.mode <> CS_MODE_16 Then
+ push r, "sib: " & Hex(sib)
+ push r, "sib_index: " & regName(hEngine, sib_index)
+ push r, "sib_scale: " & Hex(sib_scale)
+ push r, "sib_base: " & regName(hEngine, sib_base)
+ End If
+
+ If sse_cc <> 0 Then push r, "sse_cc: " & x86_sse_cc2str(sse_cc)
+ If avx_cc <> 0 Then push r, "avx_cc: " & x86_avx_cc2str(avx_cc)
+ If avx_sae <> 0 Then push r, "avx_sae: " & avx_sae
+ If avx_rm <> 0 Then push r, "avx_rm: " & x86_avx_rm2str(avx_rm)
+
+ push r, "Operands: " & operands.count
+
+ For Each o In operands
+ push r, String(40, "-")
+ push r, o.toString
+ Next
+
+ toString = Join(r, vbCrLf)
+
+End Function
+
+Friend Sub LoadDetails(lpStruct As Long, parent As CDisassembler)
+
+ Dim cs As cs_x86
+ Dim o As CX86Operand
+ Dim ptr As Long
+ Dim i As Long
+
+ Const sizeOfx86Operand = 48
+
+ Set Me.parent = parent
+ hEngine = parent.hCapstone
+
+ CopyMemory ByVal VarPtr(cs), ByVal lpStruct, LenB(cs)
+
+ If DEBUG_DUMP Then
+ ReDim m_raw(LenB(cs))
+ CopyMemory ByVal VarPtr(m_raw(0)), ByVal lpStruct, LenB(cs)
+ End If
+
+ Me.rex = cs.rex
+ Me.addr_size = cs.addr_size
+ Me.modrm = cs.modrm
+ Me.sib = cs.sib
+ Me.disp = cs.disp
+ Me.sib_index = cs.sib_index
+ Me.sib_scale = cs.sib_scale
+ Me.sib_base = cs.sib_base
+ Me.sse_cc = cs.sse_cc
+ Me.avx_cc = cs.avx_cc
+ Me.avx_sae = cs.avx_sae
+ Me.avx_rm = cs.avx_rm
+ m_prefix = cs.prefix
+ m_opcode = cs.opcode
+
+ ptr = lpStruct + LenB(cs) 'we dont include the operands in our vb struct..
+ For i = 1 To cs.op_count
+ Set o = New CX86Operand
+ o.LoadDetails ptr, hEngine
+ operands.Add o
+ ptr = ptr + sizeOfx86Operand
+ Next
+
+
+
+End Sub
+
diff --git a/capstone/bindings/vb6/CX86OpMem.cls b/capstone/bindings/vb6/CX86OpMem.cls new file mode 100644 index 000000000..d867c1a68 --- /dev/null +++ b/capstone/bindings/vb6/CX86OpMem.cls @@ -0,0 +1,28 @@ +VERSION 1.0 CLASS
+BEGIN
+ MultiUse = -1 'True
+ Persistable = 0 'NotPersistable
+ DataBindingBehavior = 0 'vbNone
+ DataSourceBehavior = 0 'vbNone
+ MTSTransactionMode = 0 'NotAnMTSObject
+END
+Attribute VB_Name = "CX86OpMem"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = True
+Attribute VB_PredeclaredId = False
+Attribute VB_Exposed = False
+Option Explicit
+
+'Capstone Disassembly Engine bindings for VB6
+'Contributed by FireEye FLARE Team
+'Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
+'License: Apache
+'Copyright: FireEye 2017
+
+
+Public segment As Long ' segment register (or X86_REG_INVALID if irrelevant) UNSIGNED
+Public base As Long ' base register (or X86_REG_INVALID if irrelevant) UNSIGNED
+Public index As Long ' index register (or X86_REG_INVALID if irrelevant) UNSIGNED
+Public scale_ As Long ' scale for index register
+Public disp As Currency ' displacement value
+
diff --git a/capstone/bindings/vb6/CX86Operand.cls b/capstone/bindings/vb6/CX86Operand.cls new file mode 100644 index 000000000..ed3c5432c --- /dev/null +++ b/capstone/bindings/vb6/CX86Operand.cls @@ -0,0 +1,202 @@ +VERSION 1.0 CLASS
+BEGIN
+ MultiUse = -1 'True
+ Persistable = 0 'NotPersistable
+ DataBindingBehavior = 0 'vbNone
+ DataSourceBehavior = 0 'vbNone
+ MTSTransactionMode = 0 'NotAnMTSObject
+END
+Attribute VB_Name = "CX86Operand"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = True
+Attribute VB_PredeclaredId = False
+Attribute VB_Exposed = False
+Option Explicit
+
+'Capstone Disassembly Engine bindings for VB6
+'Contributed by FireEye FLARE Team
+'Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
+'License: Apache
+'Copyright: FireEye 2017
+
+
+'// Instruction operand sizeof() reports 48 bytes
+'typedef struct cs_x86_op {
+' x86_op_type type; // operand type
+'
+' union {
+' x86_reg reg; // register value for REG operand
+' int64_t imm; // immediate value for IMM operand
+' double fp; // floating point value for FP operand
+' x86_op_mem mem; // base/index/scale/disp value for MEM operand (24bytes max)
+' };
+'
+' // size of this operand (in bytes).
+' uint8_t size;
+'
+' // AVX broadcast type, or 0 if irrelevant
+' x86_avx_bcast avx_bcast;
+'
+' // AVX zero opmask {z}
+' bool avx_zero_opmask;
+'} cs_x86_op;
+
+'Instruction's operand referring to memory
+'This is associated with X86_OP_MEM operand type above
+'Public Type x86_op_mem
+' segment As Long ' segment register (or X86_REG_INVALID if irrelevant) UNSIGNED
+' base As Long ' base register (or X86_REG_INVALID if irrelevant) UNSIGNED
+' index As Long ' index register (or X86_REG_INVALID if irrelevant) UNSIGNED
+' scale As Long ' scale for index register
+' disp As Currency ' displacement value
+'End Type
+
+'this shows the alignment padding used by compiler..
+' cs_x86_op op;
+' op.type = (x86_op_type)1;
+' op.reg = (x86_reg)2;
+' op.avx_bcast = (x86_avx_bcast)3;
+' op.avx_zero_opmask = 4;
+' op.size = 0xaa;
+' printf("&cs_x86_op = %x", &op);
+' _asm int 3
+'
+'
+'0x0012FF34 01 00 00 00 cc cc cc cc 02 00 00 00 cc cc cc cc ....����....����
+'0x0012FF44 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ����������������
+'0x0012FF54 aa cc cc cc 03 00 00 00 01 cc cc cc cc cc cc cc ����.....�������
+
+Public optype As x86_op_type
+Public size As Byte
+Public avx_bcast As x86_avx_bcast
+Public avx_zero_opmask As Boolean
+
+'only one of the following will be set based on type
+Public reg As x86_reg
+Public fp As Currency
+Public imm As Currency
+Public mem As CX86OpMem
+
+Private hEngine As Long
+Private m_raw() As Byte
+
+Function toString() As String
+
+ Dim ret() As String
+
+ push ret, "X86 Operand:"
+ push ret, String(45, "-")
+
+ If DEBUG_DUMP Then
+ push ret, "Raw: "
+ push ret, HexDump(m_raw)
+ End If
+
+ push ret, "Type: " & opStr()
+ push ret, "Size: " & size
+ If avx_bcast <> 0 Then push ret, "BCast: " & bcastStr()
+ If avx_zero_opmask Then push ret, "AvxOpMask: " & avx_zero_opmask
+
+ If optype = X86_OP_FP Then
+ push ret, "FP: " & cur2str(fp)
+ ElseIf optype = X86_OP_IMM Then
+ push ret, "IMM: " & cur2str(imm)
+ ElseIf optype = x86_op_mem Then
+ If mem.base <> 0 Then push ret, "Base: " & regName(hEngine, mem.base)
+ If mem.index <> 0 Then push ret, "Index: " & regName(hEngine, mem.index)
+ If mem.scale_ <> 1 Then push ret, "Scale: " & Hex(mem.scale_)
+ If mem.segment <> 0 Then push ret, "Seg: " & regName(hEngine, mem.segment)
+ If mem.disp <> 0 Then push ret, "Disp: " & cur2str(mem.disp)
+ ElseIf optype = X86_OP_REG Then
+ push ret, "Reg: " & regName(hEngine, reg)
+ End If
+
+ toString = Join(ret, vbCrLf)
+
+End Function
+
+Function opStr() As String
+
+ If optype = X86_OP_FP Then opStr = "X86_OP_FP"
+ If optype = x86_op_mem Then opStr = "x86_op_mem"
+ If optype = X86_OP_IMM Then opStr = "X86_OP_IMM"
+ If optype = X86_OP_REG Then opStr = "X86_OP_REG"
+ If optype = X86_OP_INVALID Then opStr = "X86_OP_INVALID"
+
+ If Len(opStr) = 0 Then
+ opStr = "Error: " & Hex(optype)
+ ElseIf DEBUG_DUMP Then
+ opStr = opStr & " (" & Hex(optype) & ")"
+ End If
+
+End Function
+
+Function bcastStr() As String
+ Dim r As String
+
+ If avx_bcast = X86_AVX_BCAST_INVALID Then r = "X86_AVX_BCAST_INVALID"
+ If avx_bcast = X86_AVX_BCAST_2 Then r = "X86_AVX_BCAST_2"
+ If avx_bcast = X86_AVX_BCAST_4 Then r = "X86_AVX_BCAST_4"
+ If avx_bcast = X86_AVX_BCAST_8 Then r = "X86_AVX_BCAST_8"
+ If avx_bcast = X86_AVX_BCAST_16 Then r = "X86_AVX_BCAST_16"
+
+ If Len(r) = 0 Then
+ r = "Unknown: " & Hex(avx_bcast)
+ ElseIf DEBUG_DUMP Then
+ r = r & " (" & Hex(avx_bcast) & ")"
+ End If
+
+ bcastStr = r
+End Function
+
+
+Friend Sub LoadDetails(lpStruct As Long, hCapstone As Long)
+
+ Dim opMem As x86_op_mem
+ Dim ptr As Long
+
+ Const align4 = 4
+ Const align3 = 3
+
+ hEngine = hCapstone
+
+ If DEBUG_DUMP Then
+ ReDim m_raw(48)
+ CopyMemory ByVal VarPtr(m_raw(0)), ByVal lpStruct, 48
+ End If
+
+ optype = readLng(lpStruct)
+ ptr = lpStruct + 4 + align4
+
+ If optype = X86_OP_FP Then
+ fp = readCur(ptr)
+ ElseIf optype = X86_OP_IMM Then
+ imm = readCur(ptr)
+ ElseIf optype = x86_op_mem Then
+ CopyMemory ByVal VarPtr(opMem), ByVal ptr, LenB(opMem)
+ Set mem = New CX86OpMem
+ mem.base = opMem.base
+ mem.disp = opMem.disp
+ mem.index = opMem.index
+ mem.scale_ = opMem.scale
+ mem.segment = opMem.segment
+ ElseIf optype = X86_OP_REG Then
+ reg = readLng(ptr)
+ End If
+
+ ptr = ptr + LenB(opMem)
+
+ size = readByte(ptr)
+ ptr = ptr + 1 + align3
+
+ avx_bcast = readLng(ptr)
+ ptr = ptr + 4
+
+ avx_zero_opmask = (readByte(ptr) = 1)
+
+End Sub
+
+Private Sub Class_Terminate()
+ 'looks like everything is freeing up ok
+ 'Debug.Print "Cx86Operand.Terminate"
+End Sub
diff --git a/capstone/bindings/vb6/Form1.frm b/capstone/bindings/vb6/Form1.frm new file mode 100644 index 000000000..df71dbeb8 --- /dev/null +++ b/capstone/bindings/vb6/Form1.frm @@ -0,0 +1,275 @@ +VERSION 5.00
+Object = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}#2.0#0"; "mscomctl.ocx"
+Begin VB.Form Form1
+ Caption = "VB6 Bindings for Capstone Disassembly Engine - Contributed by FireEye FLARE Team"
+ ClientHeight = 7290
+ ClientLeft = 60
+ ClientTop = 345
+ ClientWidth = 10275
+ LinkTopic = "Form1"
+ ScaleHeight = 7290
+ ScaleWidth = 10275
+ StartUpPosition = 2 'CenterScreen
+ Begin VB.CommandButton Command2
+ Caption = "Save"
+ Height = 375
+ Left = 8760
+ TabIndex = 8
+ Top = 120
+ Width = 1455
+ End
+ Begin VB.CommandButton Command1
+ Caption = " Arm 64"
+ Height = 375
+ Index = 4
+ Left = 6840
+ TabIndex = 7
+ Top = 120
+ Width = 1455
+ End
+ Begin VB.CommandButton Command1
+ Caption = "Arm"
+ Height = 375
+ Index = 3
+ Left = 5160
+ TabIndex = 6
+ Top = 120
+ Width = 1455
+ End
+ Begin VB.CommandButton Command1
+ Caption = "x86 64bit"
+ Height = 375
+ Index = 2
+ Left = 3480
+ TabIndex = 5
+ Top = 120
+ Width = 1455
+ End
+ Begin VB.CommandButton Command1
+ Caption = "x86 16bit"
+ Height = 375
+ Index = 0
+ Left = 120
+ TabIndex = 4
+ Top = 120
+ Width = 1455
+ End
+ Begin VB.CommandButton Command1
+ Caption = "x86 32bit"
+ Height = 375
+ Index = 1
+ Left = 1800
+ TabIndex = 3
+ Top = 120
+ Width = 1455
+ End
+ Begin MSComctlLib.ListView lv
+ Height = 2415
+ Left = 120
+ TabIndex = 2
+ Top = 1440
+ Width = 10095
+ _ExtentX = 17806
+ _ExtentY = 4260
+ View = 3
+ LabelEdit = 1
+ LabelWrap = -1 'True
+ HideSelection = 0 'False
+ FullRowSelect = -1 'True
+ _Version = 393217
+ ForeColor = -2147483640
+ BackColor = -2147483643
+ BorderStyle = 1
+ Appearance = 1
+ BeginProperty Font {0BE35203-8F91-11CE-9DE3-00AA004BB851}
+ Name = "Courier"
+ Size = 9.75
+ Charset = 0
+ Weight = 400
+ Underline = 0 'False
+ Italic = 0 'False
+ Strikethrough = 0 'False
+ EndProperty
+ NumItems = 1
+ BeginProperty ColumnHeader(1) {BDD1F052-858B-11D1-B16A-00C0F0283628}
+ Object.Width = 2540
+ EndProperty
+ End
+ Begin VB.ListBox List1
+ BeginProperty Font
+ Name = "Courier"
+ Size = 9.75
+ Charset = 0
+ Weight = 400
+ Underline = 0 'False
+ Italic = 0 'False
+ Strikethrough = 0 'False
+ EndProperty
+ Height = 840
+ Left = 120
+ TabIndex = 1
+ Top = 600
+ Width = 10095
+ End
+ Begin VB.TextBox Text1
+ BeginProperty Font
+ Name = "Courier"
+ Size = 9.75
+ Charset = 0
+ Weight = 400
+ Underline = 0 'False
+ Italic = 0 'False
+ Strikethrough = 0 'False
+ EndProperty
+ Height = 3375
+ Left = 120
+ MultiLine = -1 'True
+ ScrollBars = 3 'Both
+ TabIndex = 0
+ Text = "Form1.frx":0000
+ Top = 3840
+ Width = 10095
+ End
+End
+Attribute VB_Name = "Form1"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = False
+Attribute VB_PredeclaredId = True
+Attribute VB_Exposed = False
+Option Explicit
+
+'Capstone Disassembly Engine bindings for VB6
+'Contributed by FireEye FLARE Team
+'Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
+'License: Apache
+'Copyright: FireEye 2017
+
+Dim cap As CDisassembler
+Dim lastSample As Long
+
+Private Sub Command1_Click(index As Integer)
+
+ Dim code() As Byte, arch As cs_arch, mode As cs_mode
+ lastSample = index
+
+ Const x86_code32 As String = "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x05\x23\x01\x00\x00\x36\x8b\x84\x91\x23\x01\x00\x00\x41\x8d\x84\x39\x89\x67\x00\x00\x8d\x87\x89\x67\x00\x00\xb4\xc6"
+ Const X86_CODE16 As String = "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x05\x23\x01\x00\x00\x36\x8b\x84\x91\x23\x01\x00\x00\x41\x8d\x84\x39\x89\x67\x00\x00\x8d\x87\x89\x67\x00\x00\xb4\xc6"
+ Const X86_CODE64 As String = "\x55\x48\x8b\x05\xb8\x13\x00\x00"
+ Const ARM_CODE As String = "\xED\xFF\xFF\xEB\x04\xe0\x2d\xe5\x00\x00\x00\x00\xe0\x83\x22\xe5\xf1\x02\x03\x0e\x00\x00\xa0\xe3\x02\x30\xc1\xe7\x00\x00\x53\xe3\x00\x02\x01\xf1\x05\x40\xd0\xe8\xf4\x80\x00\x00"
+ Const ARM64_CODE As String = "\x09\x00\x38\xd5\xbf\x40\x00\xd5\x0c\x05\x13\xd5\x20\x50\x02\x0e\x20\xe4\x3d\x0f\x00\x18\xa0\x5f\xa2\x00\xae\x9e\x9f\x37\x03\xd5\xbf\x33\x03\xd5\xdf\x3f\x03\xd5\x21\x7c\x02\x9b\x21\x7c\x00\x53\x00\x40\x21\x4b\xe1\x0b\x40\xb9\x20\x04\x81\xda\x20\x08\x02\x8b\x10\x5b\xe8\x3c"
+
+ Select Case index
+ Case 0:
+ arch = CS_ARCH_X86
+ mode = CS_MODE_16
+ code = toBytes(X86_CODE16)
+ Case 1:
+ arch = CS_ARCH_X86
+ mode = CS_MODE_32
+ code = toBytes(x86_code32)
+ Case 2:
+ arch = CS_ARCH_X86
+ mode = CS_MODE_64
+ code = toBytes(X86_CODE64)
+
+ Case 3:
+ arch = CS_ARCH_ARM
+ mode = CS_MODE_ARM
+ code = toBytes(ARM_CODE)
+
+ Case 4:
+ arch = CS_ARCH_ARM64
+ mode = CS_MODE_ARM
+ code = toBytes(ARM64_CODE)
+ End Select
+
+
+ test code, arch, mode
+
+End Sub
+
+Private Sub test(code() As Byte, arch As cs_arch, mode As cs_mode)
+
+
+ Dim ret As Collection
+ Dim ci As CInstruction
+ Dim li As ListItem
+
+ clearForm
+ If Not cap Is Nothing Then Set cap = Nothing
+
+ Set cap = New CDisassembler
+
+ If Not cap.init(arch, mode, True) Then
+ List1.AddItem "Failed to init engine: " & cap.errMsg
+ Exit Sub
+ End If
+
+ List1.AddItem "Capstone loaded @ 0x" & Hex(cap.hLib)
+ List1.AddItem "hEngine: 0x" & Hex(cap.hCapstone)
+ List1.AddItem "Version: " & cap.version
+
+ If cap.vMajor < 3 Then
+ List1.AddItem "Sample requires Capstone v3+"
+ Exit Sub
+ End If
+
+ Set ret = cap.disasm(&H1000, code)
+
+ For Each ci In ret
+ Set li = lv.ListItems.Add(, , ci.text)
+ Set li.Tag = ci
+ Next
+
+End Sub
+
+Private Sub Command2_Click()
+
+ Dim fName() As String
+ Dim fPath As String
+ Dim t() As String
+ Dim li As ListItem
+ Dim ci As CInstruction
+
+ On Error Resume Next
+
+ If lastSample = -1 Then
+ MsgBox "Run a test first..."
+ Exit Sub
+ End If
+
+ fName = Split("16b,32b,64b,Arm,Arm64", ",")
+
+ fPath = App.path & "\vb" & fName(lastSample) & "Test.txt"
+ If FileExists(fPath) Then Kill fPath
+
+ For Each li In lv.ListItems
+ push t, li.text
+ Set ci = li.Tag
+ push t, ci.toString()
+ push t, String(60, "-")
+ Next
+
+ WriteFile fPath, Join(t, vbCrLf)
+
+ MsgBox FileLen(fPath) & " bytes saved to: " & vbCrLf & vbCrLf & fPath
+
+End Sub
+
+Private Sub lv_ItemClick(ByVal Item As MSComctlLib.ListItem)
+ Dim ci As CInstruction
+ Set ci = Item.Tag
+ Text1 = ci.toString()
+End Sub
+
+Function clearForm()
+ List1.Clear
+ lv.ListItems.Clear
+ Text1 = Empty
+End Function
+
+Private Sub Form_Load()
+ lv.ColumnHeaders(1).Width = lv.Width
+ clearForm
+ lastSample = -1
+End Sub
diff --git a/capstone/bindings/vb6/Form1.frx b/capstone/bindings/vb6/Form1.frx new file mode 100644 index 000000000..da8c0d9d6 --- /dev/null +++ b/capstone/bindings/vb6/Form1.frx @@ -0,0 +1 @@ +Text1
\ No newline at end of file diff --git a/capstone/bindings/vb6/Module1.bas b/capstone/bindings/vb6/Module1.bas new file mode 100644 index 000000000..fcb566348 --- /dev/null +++ b/capstone/bindings/vb6/Module1.bas @@ -0,0 +1,635 @@ +Attribute VB_Name = "mCapStone"
+Option Explicit
+
+'Capstone Disassembly Engine bindings for VB6
+'Contributed by FireEye FLARE Team
+'Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
+'License: Apache
+'Copyright: FireEye 2017
+
+'todo: cs_disasm_iter / skipdata
+
+'this is for my vb code and how much info it spits out in tostring methods..
+Global Const DEBUG_DUMP = 0
+
+'Architecture type
+Public Enum cs_arch
+ CS_ARCH_ARM = 0 ' ARM architecture (including Thumb, Thumb-2)
+ CS_ARCH_ARM64 ' ARM-64, also called AArch64
+ CS_ARCH_MIPS ' Mips architecture
+ CS_ARCH_X86 ' X86 architecture (including x86 & x86-64)
+ CS_ARCH_PPC ' PowerPC architecture
+ CS_ARCH_SPARC ' Sparc architecture
+ CS_ARCH_SYSZ ' SystemZ architecture
+ CS_ARCH_XCORE ' XCore architecture
+ CS_ARCH_MAX
+ CS_ARCH_ALL = &HFFFF ' All architectures - for cs_support()
+End Enum
+
+Public Enum cs_mode
+ CS_MODE_LITTLE_ENDIAN = 0 ' little-endian mode (default mode)
+ CS_MODE_ARM = 0 ' 32-bit ARM
+ CS_MODE_16 = 2 ' 16-bit mode (X86)
+ CS_MODE_32 = 4 ' 32-bit mode (X86)
+ CS_MODE_64 = 8 ' 64-bit mode (X86, PPC)
+ CS_MODE_THUMB = 16 ' ARM's Thumb mode, including Thumb-2
+ CS_MODE_MCLASS = 32 ' ARM's Cortex-M series
+ CS_MODE_V8 = 64 ' ARMv8 A32 encodings for ARM
+ CS_MODE_MICRO = 16 ' MicroMips mode (MIPS)
+ CS_MODE_MIPS3 = 32 ' Mips III ISA
+ CS_MODE_MIPS32R6 = 64 ' Mips32r6 ISA
+ CS_MODE_MIPSGP64 = 128 ' General Purpose Registers are 64-bit wide (MIPS)
+ CS_MODE_V9 = 16 ' SparcV9 mode (Sparc)
+ CS_MODE_BIG_ENDIAN = &H80000000 ' big-endian mode
+ CS_MODE_MIPS32 = CS_MODE_32 ' Mips32 ISA (Mips)
+ CS_MODE_MIPS64 = CS_MODE_64 ' Mips64 ISA (Mips)
+End Enum
+
+'Runtime option for the disassembled engine
+Public Enum cs_opt_type
+ CS_OPT_SYNTAX = 1 ' Assembly output syntax
+ CS_OPT_DETAIL ' Break down instruction structure into details
+ CS_OPT_MODE ' Change engine's mode at run-time
+ CS_OPT_MEM ' User-defined dynamic memory related functions
+ CS_OPT_SKIPDATA ' Skip data when disassembling. Then engine is in SKIPDATA mode.
+ CS_OPT_SKIPDATA_SETUP ' Setup user-defined function for SKIPDATA option
+End Enum
+
+
+'Runtime option value (associated with option type above)
+Public Enum cs_opt_value
+ CS_OPT_OFF = 0 ' Turn OFF an option - default option of CS_OPT_DETAIL, CS_OPT_SKIPDATA.
+ CS_OPT_ON = 3 ' Turn ON an option (CS_OPT_DETAIL, CS_OPT_SKIPDATA).
+ CS_OPT_SYNTAX_DEFAULT = 0 ' Default asm syntax (CS_OPT_SYNTAX).
+ CS_OPT_SYNTAX_INTEL ' X86 Intel asm syntax - default on X86 (CS_OPT_SYNTAX).
+ CS_OPT_SYNTAX_ATT ' X86 ATT asm syntax (CS_OPT_SYNTAX).
+ CS_OPT_SYNTAX_NOREGNAME ' Prints register name with only number (CS_OPT_SYNTAX)
+End Enum
+
+'Common instruction operand types - to be consistent across all architectures.
+Public Enum cs_op_type
+ CS_OP_INVALID = 0 ' uninitialized/invalid operand.
+ CS_OP_REG ' Register operand.
+ CS_OP_IMM ' Immediate operand.
+ CS_OP_MEM ' Memory operand.
+ CS_OP_FP ' Floating-Point operand.
+End Enum
+
+'Common instruction groups - to be consistent across all architectures.
+Public Enum cs_group_type
+ CS_GRP_INVALID = 0 ' uninitialized/invalid group.
+ CS_GRP_JUMP ' all jump instructions (conditional+direct+indirect jumps)
+ CS_GRP_CALL ' all call instructions
+ CS_GRP_RET ' all return instructions
+ CS_GRP_INT ' all interrupt instructions (int+syscall)
+ CS_GRP_IRET ' all interrupt return instructions
+End Enum
+
+
+'NOTE: All information in cs_detail is only available when CS_OPT_DETAIL = CS_OPT_ON
+Public Type cs_detail
+ regs_read(0 To 15) As Byte ' list of implicit registers read by this insn UNSIGNED
+ regs_read_count As Byte ' number of implicit registers read by this insn UNSIGNED
+ regs_write(0 To 19) As Byte ' list of implicit registers modified by this insn UNSIGNED
+ regs_write_count As Byte ' number of implicit registers modified by this insn UNSIGNED
+ groups(0 To 7) As Byte ' list of group this instruction belong to UNSIGNED
+ groups_count As Byte ' number of groups this insn belongs to UNSIGNED
+End Type
+
+'typedef struct cs_detail {
+' uint8_t regs_read[16]; // list of implicit registers read by this insn
+' uint8_t regs_read_count; // number of implicit registers read by this insn
+'
+' uint8_t regs_write[20]; // list of implicit registers modified by this insn
+' uint8_t regs_write_count; // number of implicit registers modified by this insn
+'
+' uint8_t groups[8]; // list of group this instruction belong to
+' uint8_t groups_count; // number of groups this insn belongs to
+'
+' // Architecture-specific instruction info
+' union {
+' cs_x86 x86; // X86 architecture, including 16-bit, 32-bit & 64-bit mode
+' cs_arm64 arm64; // ARM64 architecture (aka AArch64)
+' cs_arm arm; // ARM architecture (including Thumb/Thumb2)
+' cs_mips mips; // MIPS architecture
+' cs_ppc ppc; // PowerPC architecture
+' cs_sparc sparc; // Sparc architecture
+' cs_sysz sysz; // SystemZ architecture
+' cs_xcore xcore; // XCore architecture
+' };
+'} cs_detail;
+
+'Detail information of disassembled instruction
+Public Type cs_insn
+ ' Instruction ID (basically a numeric ID for the instruction mnemonic)
+ ' Find the instruction id in the '[ARCH]_insn' enum in the header file
+ ' of corresponding architecture, such as 'arm_insn' in arm.h for ARM,
+ ' 'x86_insn' in x86.h for X86, etc...
+ ' available even when CS_OPT_DETAIL = CS_OPT_OFF
+ ' NOTE: in Skipdata mode, "data" instruction has 0 for this id field. UNSIGNED
+ ID As Long '
+ align As Long 'not sure why it needs this..but it does..
+ address As Currency ' Address (EIP) of this instruction available even when CS_OPT_DETAIL = CS_OPT_OFF UNSIGNED
+ size As Integer ' Size of this instruction available even when CS_OPT_DETAIL = CS_OPT_OFF UNSIGNED
+ bytes(0 To 23) As Byte ' Machine bytes of this instruction, with number of bytes indicated by @size above available even when CS_OPT_DETAIL = CS_OPT_OFF
+ mnemonic(0 To 31) As Byte ' Ascii text of instruction mnemonic available even when CS_OPT_DETAIL = CS_OPT_OFF
+ op_str(0 To 159) As Byte ' Ascii text of instruction operands available even when CS_OPT_DETAIL = CS_OPT_OFF
+
+ ' Pointer to cs_detail.
+ ' NOTE: detail pointer is only valid when both requirements below are met:
+ ' (1) CS_OP_DETAIL = CS_OPT_ON
+ ' (2) Engine is not in Skipdata mode (CS_OP_SKIPDATA option set to CS_OPT_ON)
+ ' NOTE 2: when in Skipdata mode, or when detail mode is OFF, even if this pointer
+ ' is not NULL, its content is still irrelevant.
+ lpDetail As Long ' points to a cs_detail structure NOTE: only available when CS_OPT_DETAIL = CS_OPT_ON
+
+End Type
+
+'All type of errors encountered by Capstone API.
+'These are values returned by cs_errno()
+Public Enum cs_err
+ CS_ERR_OK = 0 ' No error: everything was fine
+ CS_ERR_MEM ' Out-Of-Memory error: cs_open(), cs_disasm(), cs_disasm_iter()
+ CS_ERR_ARCH ' Unsupported architecture: cs_open()
+ CS_ERR_HANDLE ' Invalid handle: cs_op_count(), cs_op_index()
+ CS_ERR_CSH ' Invalid csh argument: cs_close(), cs_errno(), cs_option()
+ CS_ERR_MODE ' Invalid/unsupported mode: cs_open()
+ CS_ERR_OPTION ' Invalid/unsupported option: cs_option()
+ CS_ERR_DETAIL ' Information is unavailable because detail option is OFF
+ CS_ERR_MEMSETUP ' Dynamic memory management uninitialized (see CS_OPT_MEM)
+ CS_ERR_VERSION ' Unsupported version (bindings)
+ CS_ERR_DIET ' Access irrelevant data in "diet" engine
+ CS_ERR_SKIPDATA ' Access irrelevant data for "data" instruction in SKIPDATA mode
+ CS_ERR_X86_ATT ' X86 AT&T syntax is unsupported (opt-out at compile time)
+ CS_ERR_X86_INTEL ' X86 Intel syntax is unsupported (opt-out at compile time)
+End Enum
+
+
+'/*
+' Return combined API version & major and minor version numbers.
+'
+' @major: major number of API version
+' @minor: minor number of API version
+'
+' @return hexical number as (major << 8 | minor), which encodes both
+' major & minor versions.
+' NOTE: This returned value can be compared with version number made
+' with macro CS_MAKE_VERSION
+'
+' For example, second API version would return 1 in @major, and 1 in @minor
+' The return value would be 0x0101
+'
+' NOTE: if you only care about returned value, but not major and minor values,
+' set both @major & @minor arguments to NULL.
+'*/
+'CAPSTONE_EXPORT
+'unsigned int cs_version(int *major, int *minor);
+Public Declare Function cs_version Lib "vbCapstone.dll" Alias "bs_version" (ByRef major As Long, ByRef minor As Long) As Long
+
+
+
+'
+'/*
+' This API can be used to either ask for archs supported by this library,
+' or check to see if the library was compile with 'diet' option (or called
+' in 'diet' mode).
+'
+' To check if a particular arch is supported by this library, set @query to
+' arch mode (CS_ARCH_* value).
+' To verify if this library supports all the archs, use CS_ARCH_ALL.
+'
+' To check if this library is in 'diet' mode, set @query to CS_SUPPORT_DIET.
+'
+' @return True if this library supports the given arch, or in 'diet' mode.
+'*/
+'CAPSTONE_EXPORT
+'bool cs_support(int query);
+Public Declare Function cs_support Lib "vbCapstone.dll" Alias "bs_support" (ByVal query As Long) As Long
+
+
+
+'/*
+' Initialize CS handle: this must be done before any usage of CS.
+'
+' @arch: architecture type (CS_ARCH_*)
+' @mode: hardware mode. This is combined of CS_MODE_*
+' @handle: pointer to handle, which will be updated at return time
+'
+' @return CS_ERR_OK on success, or other value on failure (refer to cs_err enum
+' for detailed error).
+'*/
+'CAPSTONE_EXPORT
+'cs_err cs_open(cs_arch arch, cs_mode mode, csh *handle);
+Public Declare Function cs_open Lib "vbCapstone.dll" Alias "bs_open" (ByVal arch As cs_arch, ByVal mode As cs_mode, ByRef hEngine As Long) As cs_err
+
+
+'/*
+' Close CS handle: MUST do to release the handle when it is not used anymore.
+' NOTE: this must be only called when there is no longer usage of Capstone,
+' not even access to cs_insn array. The reason is the this API releases some
+' cached memory, thus access to any Capstone API after cs_close() might crash
+' your application.
+'
+' In fact,this API invalidate @handle by ZERO out its value (i.e *handle = 0).
+'
+' @handle: pointer to a handle returned by cs_open()
+'
+' @return CS_ERR_OK on success, or other value on failure (refer to cs_err enum
+' for detailed error).
+'*/
+'CAPSTONE_EXPORT
+'cs_err cs_close(csh *handle);
+Public Declare Function cs_close Lib "vbCapstone.dll" Alias "bs_close" (ByRef hEngine As Long) As cs_err
+
+
+
+'/*
+' Set option for disassembling engine at runtime
+'
+' @handle: handle returned by cs_open()
+' @type: type of option to be set
+' @value: option value corresponding with @type
+'
+' @return: CS_ERR_OK on success, or other value on failure.
+' Refer to cs_err enum for detailed error.
+'
+' NOTE: in the case of CS_OPT_MEM, handle's value can be anything,
+' so that cs_option(handle, CS_OPT_MEM, value) can (i.e must) be called
+' even before cs_open()
+'*/
+'CAPSTONE_EXPORT
+'cs_err cs_option(csh handle, cs_opt_type type, size_t value);
+Public Declare Function cs_option Lib "vbCapstone.dll" Alias "bs_option" (ByVal hEngine As Long, ByVal typ As cs_opt_type, ByVal size As Long) As cs_err
+
+
+
+'/*
+' Report the last error number when some API function fail.
+' Like glibc's errno, cs_errno might not retain its old value once accessed.
+'
+' @handle: handle returned by cs_open()
+'
+' @return: error code of cs_err enum type (CS_ERR_*, see above)
+'*/
+'CAPSTONE_EXPORT
+'cs_err cs_errno(csh handle);
+Public Declare Function cs_errno Lib "vbCapstone.dll" Alias "bs_errno" (ByVal hEngine As Long) As cs_err
+
+'
+'/*
+' Return a string describing given error code.
+'
+' @code: error code (see CS_ERR_* above)
+'
+' @return: returns a pointer to a string that describes the error code
+' passed in the argument @code
+'*/
+'CAPSTONE_EXPORT
+'const char *cs_strerror(cs_err code);
+Public Declare Function cs_strerror Lib "vbCapstone.dll" Alias "bs_strerror" (ByVal errCode As cs_err) As Long
+
+
+'/*
+' Disassemble binary code, given the code buffer, size, address and number
+' of instructions to be decoded.
+' This API dynamically allocate memory to contain disassembled instruction.
+' Resulting instructions will be put into @*insn
+'
+' NOTE 1: this API will automatically determine memory needed to contain
+' output disassembled instructions in @insn.
+'
+' NOTE 2: caller must free the allocated memory itself to avoid memory leaking.
+'
+' NOTE 3: for system with scarce memory to be dynamically allocated such as
+' OS kernel or firmware, the API cs_disasm_iter() might be a better choice than
+' cs_disasm(). The reason is that with cs_disasm(), based on limited available
+' memory, we have to calculate in advance how many instructions to be disassembled,
+' which complicates things. This is especially troublesome for the case @count=0,
+' when cs_disasm() runs uncontrollably (until either end of input buffer, or
+' when it encounters an invalid instruction).
+'
+' @handle: handle returned by cs_open()
+' @code: buffer containing raw binary code to be disassembled.
+' @code_size: size of the above code buffer.
+' @address: address of the first instruction in given raw code buffer.
+' @insn: array of instructions filled in by this API.
+' NOTE: @insn will be allocated by this function, and should be freed
+' with cs_free() API.
+' @count: number of instructions to be disassembled, or 0 to get all of them
+'
+' @return: the number of successfully disassembled instructions,
+' or 0 if this function failed to disassemble the given code
+'
+' On failure, call cs_errno() for error code.
+'*/
+'CAPSTONE_EXPORT
+'size_t cs_disasm(
+' csh handle,
+' const uint8_t *code,
+' size_t code_size,
+' uint64_t address,
+' size_t count,
+' cs_insn **insn
+');
+Public Declare Function cs_disasm Lib "vbCapstone.dll" Alias "bs_disasm" ( _
+ ByVal hEngine As Long, _
+ ByRef code As Byte, _
+ ByVal size As Long, _
+ ByVal address As Currency, _
+ ByVal count As Long, _
+ ByRef instAryPtr As Long _
+) As Long
+
+'this proto also lets use byte() to get a dump easily..
+Public Declare Sub getInstruction Lib "vbCapstone.dll" (ByVal hInstrAry As Long, ByVal index As Long, ByVal insPtr As Long, ByVal size As Long)
+
+
+'/*
+' Deprecated function - to be retired in the next version!
+' Use cs_disasm() instead of cs_disasm_ex()
+'*/
+'CAPSTONE_EXPORT
+'CAPSTONE_DEPRECATED
+'size_t cs_disasm_ex(csh handle,
+' const uint8_t *code, size_t code_size,
+' uint64_t address,
+' size_t count,
+' cs_insn **insn);
+
+
+
+'/*
+' Free memory allocated by cs_malloc() or cs_disasm() (argument @insn)
+'
+' @insn: pointer returned by @insn argument in cs_disasm() or cs_malloc()
+' @count: number of cs_insn structures returned by cs_disasm(), or 1
+' to free memory allocated by cs_malloc().
+'*/
+'CAPSTONE_EXPORT
+'void cs_free(cs_insn *insn, size_t count);
+Public Declare Sub cs_free Lib "vbCapstone.dll" Alias "bs_free" (ByVal instr As Long, ByVal count As Long)
+
+
+'
+'/*
+' Allocate memory for 1 instruction to be used by cs_disasm_iter().
+'
+' @handle: handle returned by cs_open()
+'
+' NOTE: when no longer in use, you can reclaim the memory allocated for
+' this instruction with cs_free(insn, 1)
+'*/
+'CAPSTONE_EXPORT
+'cs_insn *cs_malloc(csh handle);
+Public Declare Function cs_malloc Lib "vbCapstone.dll" Alias "bs_malloc" (ByVal handle As Long) As Long
+
+
+
+'/*
+' Fast API to disassemble binary code, given the code buffer, size, address
+' and number of instructions to be decoded.
+' This API puts the resulting instruction into a given cache in @insn.
+' See tests/test_iter.c for sample code demonstrating this API.
+'
+' NOTE 1: this API will update @code, @size & @address to point to the next
+' instruction in the input buffer. Therefore, it is convenient to use
+' cs_disasm_iter() inside a loop to quickly iterate all the instructions.
+' While decoding one instruction at a time can also be achieved with
+' cs_disasm(count=1), some benchmarks shown that cs_disasm_iter() can be 30%
+' faster on random input.
+'
+' NOTE 2: the cache in @insn can be created with cs_malloc() API.
+'
+' NOTE 3: for system with scarce memory to be dynamically allocated such as
+' OS kernel or firmware, this API is recommended over cs_disasm(), which
+' allocates memory based on the number of instructions to be disassembled.
+' The reason is that with cs_disasm(), based on limited available memory,
+' we have to calculate in advance how many instructions to be disassembled,
+' which complicates things. This is especially troublesome for the case
+' @count=0, when cs_disasm() runs uncontrollably (until either end of input
+' buffer, or when it encounters an invalid instruction).
+'
+' @handle: handle returned by cs_open()
+' @code: buffer containing raw binary code to be disassembled
+' @code_size: size of above code
+' @address: address of the first insn in given raw code buffer
+' @insn: pointer to instruction to be filled in by this API.
+'
+' @return: true if this API successfully decode 1 instruction,
+' or false otherwise.
+'
+' On failure, call cs_errno() for error code.
+'*/
+'CAPSTONE_EXPORT
+'bool cs_disasm_iter(csh handle, const uint8_t **code, size_t *size, uint64_t *address, cs_insn *insn);
+
+
+
+'/*
+' Return friendly name of register in a string.
+' Find the instruction id from header file of corresponding architecture (arm.h for ARM,
+' x86.h for X86, ...)
+'
+' WARN: when in 'diet' mode, this API is irrelevant because engine does not
+' store register name.
+'
+' @handle: handle returned by cs_open()
+' @reg_id: register id
+'
+' @return: string name of the register, or NULL if @reg_id is invalid.
+'*/
+'CAPSTONE_EXPORT
+'const char *cs_reg_name(csh handle, unsigned int reg_id);
+Public Declare Function cs_reg_name Lib "vbCapstone.dll" Alias "bs_reg_name" (ByVal handle As Long, ByVal regID As Long) As Long
+
+
+
+
+'/*
+' Return friendly name of an instruction in a string.
+' Find the instruction id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+'
+' WARN: when in 'diet' mode, this API is irrelevant because the engine does not
+' store instruction name.
+'
+' @handle: handle returned by cs_open()
+' @insn_id: instruction id
+'
+' @return: string name of the instruction, or NULL if @insn_id is invalid.
+'*/
+'CAPSTONE_EXPORT
+'const char *cs_insn_name(csh handle, unsigned int insn_id);
+Public Declare Function cs_insn_name Lib "vbCapstone.dll" Alias "bs_insn_name" (ByVal handle As Long, ByVal insn_id As Long) As Long
+
+
+
+
+'/*
+' Return friendly name of a group id (that an instruction can belong to)
+' Find the group id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+'
+' WARN: when in 'diet' mode, this API is irrelevant because the engine does not
+' store group name.
+'
+' @handle: handle returned by cs_open()
+' @group_id: group id
+'
+' @return: string name of the group, or NULL if @group_id is invalid.
+'*/
+'CAPSTONE_EXPORT
+'const char *cs_group_name(csh handle, unsigned int group_id);
+Public Declare Function cs_group_name Lib "vbCapstone.dll" Alias "bs_group_name" (ByVal handle As Long, ByVal group_id As Long) As Long
+
+
+
+'/*
+' Check if a disassembled instruction belong to a particular group.
+' Find the group id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+' Internally, this simply verifies if @group_id matches any member of insn->groups array.
+'
+' NOTE: this API is only valid when detail option is ON (which is OFF by default).
+'
+' WARN: when in 'diet' mode, this API is irrelevant because the engine does not
+' update @groups array.
+'
+' @handle: handle returned by cs_open()
+' @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
+' @group_id: group that you want to check if this instruction belong to.
+'
+' @return: true if this instruction indeed belongs to the given group, or false otherwise.
+'*/
+'CAPSTONE_EXPORT
+'bool cs_insn_group(csh handle, const cs_insn *insn, unsigned int group_id);
+Public Declare Function cs_insn_group Lib "vbCapstone.dll" Alias "bs_insn_group" (ByVal handle As Long, ByVal instruction As Long, ByVal group_id As Long) As Long
+
+
+
+'/*
+' Check if a disassembled instruction IMPLICITLY used a particular register.
+' Find the register id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+' Internally, this simply verifies if @reg_id matches any member of insn->regs_read array.
+'
+' NOTE: this API is only valid when detail option is ON (which is OFF by default)
+'
+' WARN: when in 'diet' mode, this API is irrelevant because the engine does not
+' update @regs_read array.
+'
+' @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
+' @reg_id: register that you want to check if this instruction used it.
+'
+' @return: true if this instruction indeed implicitly used the given register, or false otherwise.
+'*/
+'CAPSTONE_EXPORT
+'bool cs_reg_read(csh handle, const cs_insn *insn, unsigned int reg_id);
+Public Declare Function cs_reg_read Lib "vbCapstone.dll" Alias "bs_reg_read" (ByVal handle As Long, ByVal instruction As Long, ByVal reg_id As Long) As Long
+
+
+
+'/*
+' Check if a disassembled instruction IMPLICITLY modified a particular register.
+' Find the register id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+' Internally, this simply verifies if @reg_id matches any member of insn->regs_write array.
+'
+' NOTE: this API is only valid when detail option is ON (which is OFF by default)
+'
+' WARN: when in 'diet' mode, this API is irrelevant because the engine does not
+' update @regs_write array.
+'
+' @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
+' @reg_id: register that you want to check if this instruction modified it.
+'
+' @return: true if this instruction indeed implicitly modified the given register, or false otherwise.
+'*/
+'CAPSTONE_EXPORT
+'bool cs_reg_write(csh handle, const cs_insn *insn, unsigned int reg_id);
+Public Declare Function cs_reg_write Lib "vbCapstone.dll" Alias "bs_reg_write" (ByVal handle As Long, ByVal instruction As Long, ByVal reg_id As Long) As Long
+
+
+
+'/*
+' Count the number of operands of a given type.
+' Find the operand type in header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+'
+' NOTE: this API is only valid when detail option is ON (which is OFF by default)
+'
+' @handle: handle returned by cs_open()
+' @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
+' @op_type: Operand type to be found.
+'
+' @return: number of operands of given type @op_type in instruction @insn,
+' or -1 on failure.
+'*/
+'CAPSTONE_EXPORT
+'int cs_op_count(csh handle, const cs_insn *insn, unsigned int op_type);
+Public Declare Function cs_op_count Lib "vbCapstone.dll" Alias "bs_op_count" (ByVal handle As Long, ByVal instruction As Long, ByVal op_type As Long) As Long
+
+
+
+'/*
+' Retrieve the position of operand of given type in <arch>.operands[] array.
+' Later, the operand can be accessed using the returned position.
+' Find the operand type in header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
+'
+' NOTE: this API is only valid when detail option is ON (which is OFF by default)
+'
+' @handle: handle returned by cs_open()
+' @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
+' @op_type: Operand type to be found.
+' @position: position of the operand to be found. This must be in the range
+' [1, cs_op_count(handle, insn, op_type)]
+'
+' @return: index of operand of given type @op_type in <arch>.operands[] array
+' in instruction @insn, or -1 on failure.
+'*/
+'CAPSTONE_EXPORT
+'int cs_op_index(csh handle, const cs_insn *insn, unsigned int op_type, unsigned int position);
+Public Declare Function cs_op_index Lib "vbCapstone.dll" Alias "bs_op_index" (ByVal handle As Long, ByVal instruction As Long, ByVal op_type As Long, ByVal position As Long) As Long
+
+
+
+Private Declare Function lstrcpy Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As String) As Long
+Private Declare Function lstrlen Lib "kernel32" Alias "lstrlenA" (ByVal lpString As Long) As Long
+
+Function cstr2vb(lpStr As Long) As String
+
+ Dim length As Long
+ Dim buf() As Byte
+
+ If lpStr = 0 Then Exit Function
+
+ length = lstrlen(lpStr)
+ If length < 1 Then Exit Function
+
+ ReDim buf(1 To length)
+ CopyMemory buf(1), ByVal lpStr, length
+
+ cstr2vb = StrConv(buf, vbUnicode, &H409)
+
+End Function
+
+Function err2str(e As cs_err) As String
+ Dim lpStr As Long
+ lpStr = cs_strerror(e)
+ err2str = cstr2vb(lpStr)
+End Function
+
+Function regName(hEngine As Long, regID As Long) As String
+ Dim lpStr As Long
+ lpStr = cs_reg_name(hEngine, regID)
+ regName = cstr2vb(lpStr)
+ If Len(regName) = 0 Or DEBUG_DUMP Then regName = regName & " (" & Hex(regID) & ")"
+End Function
+
+Function insnName(hEngine As Long, insnID As Long) As String
+ Dim lpStr As Long
+ lpStr = cs_insn_name(hEngine, insnID)
+ insnName = cstr2vb(lpStr)
+ If Len(insnName) = 0 Or DEBUG_DUMP Then insnName = insnName & " (" & Hex(insnID) & ")"
+End Function
+
+Function groupName(hEngine As Long, groupID As Long) As String
+ Dim lpStr As Long
+ lpStr = cs_group_name(hEngine, groupID)
+ groupName = cstr2vb(lpStr)
+ If Len(groupName) = 0 Or DEBUG_DUMP Then groupName = groupName & " (" & Hex(groupID) & ")"
+End Function
diff --git a/capstone/bindings/vb6/Project1.vbp b/capstone/bindings/vb6/Project1.vbp new file mode 100644 index 000000000..249657a6e --- /dev/null +++ b/capstone/bindings/vb6/Project1.vbp @@ -0,0 +1,46 @@ +Type=Exe
+Reference=*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\WINDOWS\system32\stdole2.tlb#OLE Automation
+Form=Form1.frm
+Module=mCapStone; Module1.bas
+Module=mx86; mx86.bas
+Module=mMisc; mMisc.bas
+Class=CInstruction; CInstruction.cls
+Class=CInstDetails; CInstDetails.cls
+Class=CDisassembler; CDisassembler.cls
+Object={831FDD16-0C5C-11D2-A9FC-0000F8754DA1}#2.0#0; mscomctl.ocx
+Class=CX86Inst; CX86Inst.cls
+Class=CX86Operand; CX86Operand.cls
+Class=CX86OpMem; CX86OpMem.cls
+Startup="Form1"
+ExeName32="Project1.exe"
+Command32=""
+Name="Project1"
+HelpContextID="0"
+CompatibleMode="0"
+MajorVer=1
+MinorVer=0
+RevisionVer=0
+AutoIncrementVer=0
+ServerSupportFiles=0
+VersionCompanyName="sandsprite"
+CompilationType=0
+OptimizationType=0
+FavorPentiumPro(tm)=0
+CodeViewDebugInfo=0
+NoAliasing=0
+BoundsCheck=0
+OverflowCheck=0
+FlPointCheck=0
+FDIVCheck=0
+UnroundedFP=0
+StartMode=0
+Unattended=0
+Retained=0
+ThreadPerObject=0
+MaxNumberOfThreads=1
+
+[MS Transaction Server]
+AutoRefresh=1
+
+[fastBuild]
+fullPath=%ap%\bin\demo.exe
diff --git a/capstone/bindings/vb6/Project1.vbw b/capstone/bindings/vb6/Project1.vbw new file mode 100644 index 000000000..0db503ff4 --- /dev/null +++ b/capstone/bindings/vb6/Project1.vbw @@ -0,0 +1,10 @@ +Form1 = 110, 110, 1233, 906, , 88, 88, 1116, 749, C
+mCapStone = 22, 22, 1050, 683,
+mx86 = 88, 88, 1040, 757,
+mMisc = 66, 66, 1094, 727,
+CInstruction = 0, 0, 0, 0, C
+CInstDetails = 132, 132, 1084, 801, C
+CDisassembler = 44, 44, 1229, 809,
+CX86Inst = 154, 154, 1106, 823, C
+CX86Operand = 176, 176, 1128, 845, C
+CX86OpMem = 198, 198, 1150, 867, C
diff --git a/capstone/bindings/vb6/README.txt b/capstone/bindings/vb6/README.txt new file mode 100644 index 000000000..aca836afc --- /dev/null +++ b/capstone/bindings/vb6/README.txt @@ -0,0 +1,30 @@ +
+Capstone Disassembly Engine bindings for VB6
+Contributed by FireEye FLARE Team
+Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
+License: Apache
+Copyright: FireEye 2017
+
+This is a sample for using the capstone disassembly engine with VB6.
+
+All of the capstone API are implemented, so this lib supports basic
+disassembly of all of the processor architectures that capstone implements.
+
+In the vb code, full instruction details are currently only supported for
+the x86 processor family.
+
+This sample was built against Capstone 3.0 rc4. Note that if the capstone
+structures change in the future this code will have to be adjusted to match.
+
+The vbCapstone.dll is written in C. Project files are provided for VS2008.
+It is a small shim to give VB6 access to a stdcall API to access capstone.
+You could also modify capstone itself so its exports were stdcall.
+
+The C project has an additional include directory set to ./../../include/
+for <capstone.h>. This is for the /capstone/bindings/vb6/ directory structure
+
+
+
+
+
+
diff --git a/capstone/bindings/vb6/mMisc.bas b/capstone/bindings/vb6/mMisc.bas new file mode 100644 index 000000000..2ccb1308e --- /dev/null +++ b/capstone/bindings/vb6/mMisc.bas @@ -0,0 +1,385 @@ +Attribute VB_Name = "mMisc"
+Option Explicit
+
+'These are old library functions
+
+Private Type Bit64Currency
+ value As Currency
+End Type
+
+Private Type Bit64Integer
+ LowValue As Long
+ HighValue As Long
+End Type
+
+Global Const LANG_US = &H409
+
+Public Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Long
+Public Declare Function FreeLibrary Lib "kernel32" (ByVal hLibModule As Long) As Long
+Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal length As Long)
+Public Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
+Public Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
+Public Declare Function SetDllDirectory Lib "kernel32" Alias "SetDllDirectoryA" (ByVal lpPathName As String) As Long
+
+Function makeCur(high As Long, low As Long) As Currency
+ Dim c As Bit64Currency
+ Dim dl As Bit64Integer
+ dl.LowValue = low
+ dl.HighValue = high
+ LSet c = dl
+ makeCur = c.value
+End Function
+
+Function lng2Cur(v As Long) As Currency
+ Dim c As Bit64Currency
+ Dim dl As Bit64Integer
+ dl.LowValue = v
+ dl.HighValue = 0
+ LSet c = dl
+ lng2Cur = c.value
+End Function
+
+Function cur2str(v As Currency) As String
+ Dim c As Bit64Currency
+ Dim dl As Bit64Integer
+ c.value = v
+ LSet dl = c
+ If dl.HighValue = 0 Then
+ cur2str = Right("00000000" & Hex(dl.LowValue), 8)
+ Else
+ cur2str = Right("00000000" & Hex(dl.HighValue), 8) & "`" & Right("00000000" & Hex(dl.LowValue), 8)
+ End If
+End Function
+
+Function x64StrToCur(ByVal str As String) As Currency
+
+ str = Replace(Trim(str), "0x", "")
+ str = Replace(str, " ", "")
+ str = Replace(str, "`", "")
+
+ Dim low As String, high As String
+ Dim c As Bit64Currency
+ Dim dl As Bit64Integer
+
+ low = VBA.Right(str, 8)
+ dl.LowValue = CLng("&h" & low)
+
+ If Len(str) > 8 Then
+ high = Mid(str, 1, Len(str) - 8)
+ dl.HighValue = CLng("&h" & high)
+ End If
+
+ LSet c = dl
+ x64StrToCur = c.value
+
+End Function
+
+Function cur2lng(v As Currency) As Long
+ Dim c As Bit64Currency
+ Dim dl As Bit64Integer
+ c.value = v
+ LSet dl = c
+ cur2lng = dl.LowValue
+End Function
+
+Function readLng(offset As Long) As Long
+ Dim tmp As Long
+ CopyMemory ByVal VarPtr(tmp), ByVal offset, 4
+ readLng = tmp
+End Function
+
+Function readByte(offset As Long) As Byte
+ Dim tmp As Byte
+ CopyMemory ByVal VarPtr(tmp), ByVal offset, 1
+ readByte = tmp
+End Function
+
+Function readCur(offset As Long) As Currency
+ Dim tmp As Currency
+ CopyMemory ByVal VarPtr(tmp), ByVal offset, 8
+ readCur = tmp
+End Function
+
+Function col2Str(c As Collection, Optional emptyVal = "") As String
+ Dim v, tmp As String
+
+ If c.count = 0 Then
+ col2Str = emptyVal
+ Else
+ For Each v In c
+ col2Str = col2Str & hhex(v) & ", "
+ Next
+ col2Str = Mid(col2Str, 1, Len(col2Str) - 2)
+ End If
+
+End Function
+
+Function regCol2Str(hEngine As Long, c As Collection) As String
+ Dim v, tmp As String
+
+ If c.count = 0 Then Exit Function
+
+ For Each v In c
+ regCol2Str = regCol2Str & regName(hEngine, CLng(v)) & ", "
+ Next
+ regCol2Str = Mid(regCol2Str, 1, Len(regCol2Str) - 2)
+
+End Function
+
+
+
+Function b2Str(b() As Byte) As String
+ Dim i As Long
+
+ If AryIsEmpty(b) Then
+ b2Str = "Empty"
+ Else
+ For i = 0 To UBound(b)
+ b2Str = b2Str & hhex(b(i)) & " "
+ Next
+ b2Str = Trim(b2Str)
+ End If
+
+End Function
+
+
+
+Function AryIsEmpty(ary) As Boolean
+ Dim i As Long
+
+ On Error GoTo oops
+ i = UBound(ary) '<- throws error if not initalized
+ AryIsEmpty = False
+ Exit Function
+oops: AryIsEmpty = True
+End Function
+
+Public Function toBytes(ByVal hexstr, Optional strRet As Boolean = False)
+
+'supports:
+'11 22 33 44 spaced hex chars
+'11223344 run together hex strings
+'11,22,33,44 csv hex
+'\x11,0x22 misc C source rips
+'
+'ignores common C source prefixes, operators, delimiters, and whitespace
+'
+'not supported
+'1,2,3,4 all hex chars are must have two chars even if delimited
+'
+'a version which supports more formats is here:
+' https://github.com/dzzie/libs/blob/master/dzrt/globals.cls
+
+ Dim ret As String, x As String, str As String
+ Dim r() As Byte, b As Byte, b1 As Byte
+ Dim foundDecimal As Boolean, tmp, i, a, a2
+ Dim pos As Long, marker As String
+
+ On Error GoTo nope
+
+ str = Replace(hexstr, vbCr, Empty)
+ str = Replace(str, vbLf, Empty)
+ str = Replace(str, vbTab, Empty)
+ str = Replace(str, Chr(0), Empty)
+ str = Replace(str, "{", Empty)
+ str = Replace(str, "}", Empty)
+ str = Replace(str, ";", Empty)
+ str = Replace(str, "+", Empty)
+ str = Replace(str, """""", Empty)
+ str = Replace(str, "'", Empty)
+ str = Replace(str, " ", Empty)
+ str = Replace(str, "0x", Empty)
+ str = Replace(str, "\x", Empty)
+ str = Replace(str, ",", Empty)
+
+ For i = 1 To Len(str) Step 2
+ x = Mid(str, i, 2)
+ If Not isHexChar(x, b) Then Exit Function
+ bpush r(), b
+ Next
+
+ If strRet Then
+ toBytes = StrConv(r, vbUnicode, LANG_US)
+ Else
+ toBytes = r
+ End If
+
+nope:
+End Function
+
+Private Sub bpush(bAry() As Byte, b As Byte) 'this modifies parent ary object
+ On Error GoTo init
+ Dim x As Long
+
+ x = UBound(bAry) '<-throws Error If Not initalized
+ ReDim Preserve bAry(UBound(bAry) + 1)
+ bAry(UBound(bAry)) = b
+
+ Exit Sub
+
+init:
+ ReDim bAry(0)
+ bAry(0) = b
+
+End Sub
+
+Sub push(ary, value) 'this modifies parent ary object
+ On Error GoTo init
+ Dim x
+
+ x = UBound(ary)
+ ReDim Preserve ary(x + 1)
+
+ If IsObject(value) Then
+ Set ary(x + 1) = value
+ Else
+ ary(x + 1) = value
+ End If
+
+ Exit Sub
+init:
+ ReDim ary(0)
+ If IsObject(value) Then
+ Set ary(0) = value
+ Else
+ ary(0) = value
+ End If
+End Sub
+
+
+Public Function isHexChar(hexValue As String, Optional b As Byte) As Boolean
+ On Error Resume Next
+ Dim v As Long
+
+ If Len(hexValue) = 0 Then GoTo nope
+ If Len(hexValue) > 2 Then GoTo nope 'expecting hex char code like FF or 90
+
+ v = CLng("&h" & hexValue)
+ If Err.Number <> 0 Then GoTo nope 'invalid hex code
+
+ b = CByte(v)
+ If Err.Number <> 0 Then GoTo nope 'shouldnt happen.. > 255 cant be with len() <=2 ?
+
+ isHexChar = True
+
+ Exit Function
+nope:
+ Err.Clear
+ isHexChar = False
+End Function
+
+Function hhex(b) As String
+ hhex = Right("00" & Hex(b), 2)
+End Function
+
+Function rpad(x, i, Optional c = " ")
+ rpad = Left(x & String(i, c), i)
+End Function
+
+Function HexDump(bAryOrStrData, Optional hexOnly = 0, Optional ByVal startAt As Long = 1, Optional ByVal length As Long = -1) As String
+ Dim s() As String, chars As String, tmp As String
+ On Error Resume Next
+ Dim ary() As Byte
+ Dim offset As Long
+ Const LANG_US = &H409
+ Dim i As Long, tt, h, x
+
+ offset = 0
+
+ If TypeName(bAryOrStrData) = "Byte()" Then
+ ary() = bAryOrStrData
+ Else
+ ary = StrConv(CStr(bAryOrStrData), vbFromUnicode, LANG_US)
+ End If
+
+ If startAt < 1 Then startAt = 1
+ If length < 1 Then length = -1
+
+ While startAt Mod 16 <> 0
+ startAt = startAt - 1
+ Wend
+
+ startAt = startAt + 1
+
+ chars = " "
+ For i = startAt To UBound(ary) + 1
+ tt = Hex(ary(i - 1))
+ If Len(tt) = 1 Then tt = "0" & tt
+ tmp = tmp & tt & " "
+ x = ary(i - 1)
+ 'chars = chars & IIf((x > 32 And x < 127) Or x > 191, Chr(x), ".") 'x > 191 causes \x0 problems on non us systems... asc(chr(x)) = 0
+ chars = chars & IIf((x > 32 And x < 127), Chr(x), ".")
+ If i > 1 And i Mod 16 = 0 Then
+ h = Hex(offset)
+ While Len(h) < 6: h = "0" & h: Wend
+ If hexOnly = 0 Then
+ push s, h & " " & tmp & chars
+ Else
+ push s, tmp
+ End If
+ offset = offset + 16
+ tmp = Empty
+ chars = " "
+ End If
+ If length <> -1 Then
+ length = length - 1
+ If length = 0 Then Exit For
+ End If
+ Next
+
+ 'if read length was not mod 16=0 then
+ 'we have part of line to account for
+ If tmp <> Empty Then
+ If hexOnly = 0 Then
+ h = Hex(offset)
+ While Len(h) < 6: h = "0" & h: Wend
+ h = h & " " & tmp
+ While Len(h) <= 56: h = h & " ": Wend
+ push s, h & chars
+ Else
+ push s, tmp
+ End If
+ End If
+
+ HexDump = Join(s, vbCrLf)
+
+ If hexOnly <> 0 Then
+ HexDump = Replace(HexDump, " ", "")
+ HexDump = Replace(HexDump, vbCrLf, "")
+ End If
+
+End Function
+
+
+
+Function FileExists(path As String) As Boolean
+ On Error GoTo hell
+
+ If Len(path) = 0 Then Exit Function
+ If Right(path, 1) = "\" Then Exit Function
+ If Dir(path, vbHidden Or vbNormal Or vbReadOnly Or vbSystem) <> "" Then FileExists = True
+
+ Exit Function
+hell: FileExists = False
+End Function
+
+Sub WriteFile(path, it)
+ Dim f
+ f = FreeFile
+ Open path For Output As #f
+ Print #f, it
+ Close f
+End Sub
+
+Function GetParentFolder(path) As String
+ Dim tmp() As String, ub As Long
+ On Error Resume Next
+ tmp = Split(path, "\")
+ ub = tmp(UBound(tmp))
+ If Err.Number = 0 Then
+ GetParentFolder = Replace(Join(tmp, "\"), "\" & ub, "")
+ Else
+ GetParentFolder = path
+ End If
+End Function
+
diff --git a/capstone/bindings/vb6/mx86.bas b/capstone/bindings/vb6/mx86.bas new file mode 100644 index 000000000..aa073ad65 --- /dev/null +++ b/capstone/bindings/vb6/mx86.bas @@ -0,0 +1,1868 @@ +Attribute VB_Name = "mx86"
+Option Explicit
+
+'Capstone Disassembly Engine bindings for VB6
+'Contributed by FireEye FLARE Team
+'Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
+'License: Apache
+'Copyright: FireEye 2017
+
+
+Enum x86_reg
+ X86_REG_INVALID = 0
+ X86_REG_AH
+ X86_REG_AL
+ X86_REG_AX
+ X86_REG_BH
+ X86_REG_BL
+ X86_REG_BP
+ X86_REG_BPL
+ X86_REG_BX
+ X86_REG_CH
+ X86_REG_CL
+ X86_REG_CS
+ X86_REG_CX
+ X86_REG_DH
+ X86_REG_DI
+ X86_REG_DIL
+ X86_REG_DL
+ X86_REG_DS
+ X86_REG_DX
+ X86_REG_EAX
+ X86_REG_EBP
+ X86_REG_EBX
+ X86_REG_ECX
+ X86_REG_EDI
+ X86_REG_EDX
+ X86_REG_EFLAGS
+ X86_REG_EIP
+ X86_REG_EIZ
+ X86_REG_ES
+ X86_REG_ESI
+ X86_REG_ESP
+ X86_REG_FPSW
+ X86_REG_FS
+ X86_REG_GS
+ X86_REG_IP
+ X86_REG_RAX
+ X86_REG_RBP
+ X86_REG_RBX
+ X86_REG_RCX
+ X86_REG_RDI
+ X86_REG_RDX
+ X86_REG_RIP
+ X86_REG_RIZ
+ X86_REG_RSI
+ X86_REG_RSP
+ X86_REG_SI
+ X86_REG_SIL
+ X86_REG_SP
+ X86_REG_SPL
+ X86_REG_SS
+ X86_REG_CR0
+ X86_REG_CR1
+ X86_REG_CR2
+ X86_REG_CR3
+ X86_REG_CR4
+ X86_REG_CR5
+ X86_REG_CR6
+ X86_REG_CR7
+ X86_REG_CR8
+ X86_REG_CR9
+ X86_REG_CR10
+ X86_REG_CR11
+ X86_REG_CR12
+ X86_REG_CR13
+ X86_REG_CR14
+ X86_REG_CR15
+ X86_REG_DR0
+ X86_REG_DR1
+ X86_REG_DR2
+ X86_REG_DR3
+ X86_REG_DR4
+ X86_REG_DR5
+ X86_REG_DR6
+ X86_REG_DR7
+ X86_REG_FP0
+ X86_REG_FP1
+ X86_REG_FP2
+ X86_REG_FP3
+ X86_REG_FP4
+ X86_REG_FP5
+ X86_REG_FP6
+ X86_REG_FP7
+ X86_REG_K0
+ X86_REG_K1
+ X86_REG_K2
+ X86_REG_K3
+ X86_REG_K4
+ X86_REG_K5
+ X86_REG_K6
+ X86_REG_K7
+ X86_REG_MM0
+ X86_REG_MM1
+ X86_REG_MM2
+ X86_REG_MM3
+ X86_REG_MM4
+ X86_REG_MM5
+ X86_REG_MM6
+ X86_REG_MM7
+ X86_REG_R8
+ X86_REG_R9
+ X86_REG_R10
+ X86_REG_R11
+ X86_REG_R12
+ X86_REG_R13
+ X86_REG_R14
+ X86_REG_R15
+ X86_REG_ST0
+ X86_REG_ST1
+ X86_REG_ST2
+ X86_REG_ST3
+ X86_REG_ST4
+ X86_REG_ST5
+ X86_REG_ST6
+ X86_REG_ST7
+ X86_REG_XMM0
+ X86_REG_XMM1
+ X86_REG_XMM2
+ X86_REG_XMM3
+ X86_REG_XMM4
+ X86_REG_XMM5
+ X86_REG_XMM6
+ X86_REG_XMM7
+ X86_REG_XMM8
+ X86_REG_XMM9
+ X86_REG_XMM10
+ X86_REG_XMM11
+ X86_REG_XMM12
+ X86_REG_XMM13
+ X86_REG_XMM14
+ X86_REG_XMM15
+ X86_REG_XMM16
+ X86_REG_XMM17
+ X86_REG_XMM18
+ X86_REG_XMM19
+ X86_REG_XMM20
+ X86_REG_XMM21
+ X86_REG_XMM22
+ X86_REG_XMM23
+ X86_REG_XMM24
+ X86_REG_XMM25
+ X86_REG_XMM26
+ X86_REG_XMM27
+ X86_REG_XMM28
+ X86_REG_XMM29
+ X86_REG_XMM30
+ X86_REG_XMM31
+ X86_REG_YMM0
+ X86_REG_YMM1
+ X86_REG_YMM2
+ X86_REG_YMM3
+ X86_REG_YMM4
+ X86_REG_YMM5
+ X86_REG_YMM6
+ X86_REG_YMM7
+ X86_REG_YMM8
+ X86_REG_YMM9
+ X86_REG_YMM10
+ X86_REG_YMM11
+ X86_REG_YMM12
+ X86_REG_YMM13
+ X86_REG_YMM14
+ X86_REG_YMM15
+ X86_REG_YMM16
+ X86_REG_YMM17
+ X86_REG_YMM18
+ X86_REG_YMM19
+ X86_REG_YMM20
+ X86_REG_YMM21
+ X86_REG_YMM22
+ X86_REG_YMM23
+ X86_REG_YMM24
+ X86_REG_YMM25
+ X86_REG_YMM26
+ X86_REG_YMM27
+ X86_REG_YMM28
+ X86_REG_YMM29
+ X86_REG_YMM30
+ X86_REG_YMM31
+ X86_REG_ZMM0
+ X86_REG_ZMM1
+ X86_REG_ZMM2
+ X86_REG_ZMM3
+ X86_REG_ZMM4
+ X86_REG_ZMM5
+ X86_REG_ZMM6
+ X86_REG_ZMM7
+ X86_REG_ZMM8
+ X86_REG_ZMM9
+ X86_REG_ZMM10
+ X86_REG_ZMM11
+ X86_REG_ZMM12
+ X86_REG_ZMM13
+ X86_REG_ZMM14
+ X86_REG_ZMM15
+ X86_REG_ZMM16
+ X86_REG_ZMM17
+ X86_REG_ZMM18
+ X86_REG_ZMM19
+ X86_REG_ZMM20
+ X86_REG_ZMM21
+ X86_REG_ZMM22
+ X86_REG_ZMM23
+ X86_REG_ZMM24
+ X86_REG_ZMM25
+ X86_REG_ZMM26
+ X86_REG_ZMM27
+ X86_REG_ZMM28
+ X86_REG_ZMM29
+ X86_REG_ZMM30
+ X86_REG_ZMM31
+ X86_REG_R8B
+ X86_REG_R9B
+ X86_REG_R10B
+ X86_REG_R11B
+ X86_REG_R12B
+ X86_REG_R13B
+ X86_REG_R14B
+ X86_REG_R15B
+ X86_REG_R8D
+ X86_REG_R9D
+ X86_REG_R10D
+ X86_REG_R11D
+ X86_REG_R12D
+ X86_REG_R13D
+ X86_REG_R14D
+ X86_REG_R15D
+ X86_REG_R8W
+ X86_REG_R9W
+ X86_REG_R10W
+ X86_REG_R11W
+ X86_REG_R12W
+ X86_REG_R13W
+ X86_REG_R14W
+ X86_REG_R15W
+ X86_REG_ENDING ' <-- mark the end of the list of registers
+End Enum
+
+'Operand type for instruction's operands
+Enum x86_op_type
+ X86_OP_INVALID = 0 'CS_OP_INVALID (Uninitialized).
+ X86_OP_REG 'CS_OP_REG (Register operand).
+ X86_OP_IMM 'CS_OP_IMM (Immediate operand).
+ x86_op_mem 'CS_OP_MEM (Memory operand).
+ X86_OP_FP 'CS_OP_FP (Floating-Point operand).
+End Enum
+
+'AVX broadcast type
+Public Enum x86_avx_bcast
+ X86_AVX_BCAST_INVALID = 0 ' Uninitialized.
+ X86_AVX_BCAST_2 ' AVX512 broadcast type {1to2}
+ X86_AVX_BCAST_4 ' AVX512 broadcast type {1to4}
+ X86_AVX_BCAST_8 ' AVX512 broadcast type {1to8}
+ X86_AVX_BCAST_16 ' AVX512 broadcast type {1to16}
+End Enum
+
+
+'SSE Code Condition type
+Public Enum x86_sse_cc
+ X86_SSE_CC_INVALID = 0 ' Uninitialized.
+ X86_SSE_CC_EQ
+ X86_SSE_CC_LT
+ X86_SSE_CC_LE
+ X86_SSE_CC_UNORD
+ X86_SSE_CC_NEQ
+ X86_SSE_CC_NLT
+ X86_SSE_CC_NLE
+ X86_SSE_CC_ORD
+ X86_SSE_CC_EQ_UQ
+ X86_SSE_CC_NGE
+ X86_SSE_CC_NGT
+ X86_SSE_CC_FALSE
+ X86_SSE_CC_NEQ_OQ
+ X86_SSE_CC_GE
+ X86_SSE_CC_GT
+ X86_SSE_CC_TRUE
+End Enum
+
+'AVX Code Condition type
+Public Enum x86_avx_cc
+ X86_AVX_CC_INVALID = 0 ' Uninitialized.
+ X86_AVX_CC_EQ
+ X86_AVX_CC_LT
+ X86_AVX_CC_LE
+ X86_AVX_CC_UNORD
+ X86_AVX_CC_NEQ
+ X86_AVX_CC_NLT
+ X86_AVX_CC_NLE
+ X86_AVX_CC_ORD
+ X86_AVX_CC_EQ_UQ
+ X86_AVX_CC_NGE
+ X86_AVX_CC_NGT
+ X86_AVX_CC_FALSE
+ X86_AVX_CC_NEQ_OQ
+ X86_AVX_CC_GE
+ X86_AVX_CC_GT
+ X86_AVX_CC_TRUE
+ X86_AVX_CC_EQ_OS
+ X86_AVX_CC_LT_OQ
+ X86_AVX_CC_LE_OQ
+ X86_AVX_CC_UNORD_S
+ X86_AVX_CC_NEQ_US
+ X86_AVX_CC_NLT_UQ
+ X86_AVX_CC_NLE_UQ
+ X86_AVX_CC_ORD_S
+ X86_AVX_CC_EQ_US
+ X86_AVX_CC_NGE_UQ
+ X86_AVX_CC_NGT_UQ
+ X86_AVX_CC_FALSE_OS
+ X86_AVX_CC_NEQ_OS
+ X86_AVX_CC_GE_OQ
+ X86_AVX_CC_GT_OQ
+ X86_AVX_CC_TRUE_US
+End Enum
+
+'AVX static rounding mode type
+Public Enum x86_avx_rm
+ X86_AVX_RM_INVALID = 0 ' Uninitialized.
+ X86_AVX_RM_RN ' Round to nearest
+ X86_AVX_RM_RD ' Round down
+ X86_AVX_RM_RU ' Round up
+ X86_AVX_RM_RZ ' Round toward zero
+End Enum
+
+'Instruction prefixes - to be used in cs_x86.prefix[]
+Public Enum x86_prefix
+ X86_PREFIX_LOCK = &HF0 ' lock (cs_x86.prefix[0]
+ X86_PREFIX_REP = &HF3 ' rep (cs_x86.prefix[0]
+ X86_PREFIX_REPNE = &HF2 ' repne (cs_x86.prefix[0]
+ X86_PREFIX_CS = &H2E ' segment override CS (cs_x86.prefix[1]
+ X86_PREFIX_SS = &H36 ' segment override SS (cs_x86.prefix[1]
+ X86_PREFIX_DS = &H3E ' segment override DS (cs_x86.prefix[1]
+ X86_PREFIX_ES = &H26 ' segment override ES (cs_x86.prefix[1]
+ X86_PREFIX_FS = &H64 ' segment override FS (cs_x86.prefix[1]
+ X86_PREFIX_GS = &H65 ' segment override GS (cs_x86.prefix[1]
+ X86_PREFIX_OPSIZE = &H66 ' operand-size override (cs_x86.prefix[2]
+ X86_PREFIX_ADDRSIZE = &H67 ' address-size override (cs_x86.prefix[3]
+End Enum
+
+'Instruction's operand referring to memory
+'This is associated with X86_OP_MEM operand type above
+Public Type x86_op_mem
+ segment As Long ' segment register (or X86_REG_INVALID if irrelevant) UNSIGNED
+ base As Long ' base register (or X86_REG_INVALID if irrelevant) UNSIGNED
+ index As Long ' index register (or X86_REG_INVALID if irrelevant) UNSIGNED
+ scale As Long ' scale for index register
+ disp As Currency ' displacement value
+End Type
+
+'Instruction operand 48 bytes
+'typedef struct cs_x86_op {
+' x86_op_type type; // operand type
+' union {
+' x86_reg reg; // register value for REG operand
+' int64_t imm; // immediate value for IMM operand
+' double fp; // floating point value for FP operand
+' x86_op_mem mem; // base/index/scale/disp value for MEM operand
+' };
+'
+' // size of this operand (in bytes).
+' uint8_t size;
+'
+' // AVX broadcast type, or 0 if irrelevant
+' x86_avx_bcast avx_bcast;
+'
+' // AVX zero opmask {z}
+' bool avx_zero_opmask;
+'} cs_x86_op;
+
+'Instruction structure
+Public Type cs_x86
+ ' Instruction prefix, which can be up to 4 bytes.
+ ' A prefix byte gets value 0 when irrelevant.
+ ' prefix[0] indicates REP/REPNE/LOCK prefix (See X86_PREFIX_REP/REPNE/LOCK above)
+ ' prefix[1] indicates segment override (irrelevant for x86_64):
+ ' See X86_PREFIX_CS/SS/DS/ES/FS/GS above.
+ ' prefix[2] indicates operand-size override (X86_PREFIX_OPSIZE)
+ ' prefix[3] indicates address-size override (X86_PREFIX_ADDRSIZE)
+ prefix(0 To 3) As Byte ' UNSIGNED
+
+ ' Instruction opcode, wich can be from 1 to 4 bytes in size.
+ ' This contains VEX opcode as well.
+ ' An trailing opcode byte gets value 0 when irrelevant.
+ opcode(0 To 3) As Byte ' UNSIGNED
+
+ rex As Byte ' REX prefix: only a non-zero value is relavant for x86_64 UNSIGNED
+ addr_size As Byte ' Address size, which can be overrided with above prefix[5]. UNSIGNED
+ modrm As Byte ' ModR/M byte UNSIGNED
+ sib As Byte ' SIB value, or 0 when irrelevant. UNSIGNED
+ disp As Long ' Displacement value, or 0 when irrelevant.
+ sib_index As x86_reg ' SIB index register, or X86_REG_INVALID when irrelevant.
+ sib_scale As Byte ' SIB scale. only applicable if sib_index is relavant.
+ sib_base As x86_reg ' SIB base register, or X86_REG_INVALID when irrelevant.
+ sse_cc As x86_sse_cc ' SSE Code Condition
+ avx_cc As x86_avx_cc ' AVX Code Condition
+ avx_sae As Byte ' AVX Suppress all Exception
+ avx_rm As x86_avx_rm ' AVX static rounding mode
+ op_count As Byte ' Number of operands of this instruction, or 0 when instruction has no operand.UNSIGNED
+
+ 'operands(0 To 7) As cs_x86_op ' operands for this instruction.
+ 'opBuf(0 To 383) As Byte
+
+End Type
+
+'X86 instructions
+Public Enum x86_insn
+ X86_INS_INVALID = 0
+ X86_INS_AAA
+ X86_INS_AAD
+ X86_INS_AAM
+ X86_INS_AAS
+ X86_INS_FABS
+ X86_INS_ADC
+ X86_INS_ADCX
+ X86_INS_ADD
+ X86_INS_ADDPD
+ X86_INS_ADDPS
+ X86_INS_ADDSD
+ X86_INS_ADDSS
+ X86_INS_ADDSUBPD
+ X86_INS_ADDSUBPS
+ X86_INS_FADD
+ X86_INS_FIADD
+ X86_INS_FADDP
+ X86_INS_ADOX
+ X86_INS_AESDECLAST
+ X86_INS_AESDEC
+ X86_INS_AESENCLAST
+ X86_INS_AESENC
+ X86_INS_AESIMC
+ X86_INS_AESKEYGENASSIST
+ X86_INS_AND
+ X86_INS_ANDN
+ X86_INS_ANDNPD
+ X86_INS_ANDNPS
+ X86_INS_ANDPD
+ X86_INS_ANDPS
+ X86_INS_ARPL
+ X86_INS_BEXTR
+ X86_INS_BLCFILL
+ X86_INS_BLCI
+ X86_INS_BLCIC
+ X86_INS_BLCMSK
+ X86_INS_BLCS
+ X86_INS_BLENDPD
+ X86_INS_BLENDPS
+ X86_INS_BLENDVPD
+ X86_INS_BLENDVPS
+ X86_INS_BLSFILL
+ X86_INS_BLSI
+ X86_INS_BLSIC
+ X86_INS_BLSMSK
+ X86_INS_BLSR
+ X86_INS_BOUND
+ X86_INS_BSF
+ X86_INS_BSR
+ X86_INS_BSWAP
+ X86_INS_BT
+ X86_INS_BTC
+ X86_INS_BTR
+ X86_INS_BTS
+ X86_INS_BZHI
+ X86_INS_CALL
+ X86_INS_CBW
+ X86_INS_CDQ
+ X86_INS_CDQE
+ X86_INS_FCHS
+ X86_INS_CLAC
+ X86_INS_CLC
+ X86_INS_CLD
+ X86_INS_CLFLUSH
+ X86_INS_CLGI
+ X86_INS_CLI
+ X86_INS_CLTS
+ X86_INS_CMC
+ X86_INS_CMOVA
+ X86_INS_CMOVAE
+ X86_INS_CMOVB
+ X86_INS_CMOVBE
+ X86_INS_FCMOVBE
+ X86_INS_FCMOVB
+ X86_INS_CMOVE
+ X86_INS_FCMOVE
+ X86_INS_CMOVG
+ X86_INS_CMOVGE
+ X86_INS_CMOVL
+ X86_INS_CMOVLE
+ X86_INS_FCMOVNBE
+ X86_INS_FCMOVNB
+ X86_INS_CMOVNE
+ X86_INS_FCMOVNE
+ X86_INS_CMOVNO
+ X86_INS_CMOVNP
+ X86_INS_FCMOVNU
+ X86_INS_CMOVNS
+ X86_INS_CMOVO
+ X86_INS_CMOVP
+ X86_INS_FCMOVU
+ X86_INS_CMOVS
+ X86_INS_CMP
+ X86_INS_CMPPD
+ X86_INS_CMPPS
+ X86_INS_CMPSB
+ X86_INS_CMPSD
+ X86_INS_CMPSQ
+ X86_INS_CMPSS
+ X86_INS_CMPSW
+ X86_INS_CMPXCHG16B
+ X86_INS_CMPXCHG
+ X86_INS_CMPXCHG8B
+ X86_INS_COMISD
+ X86_INS_COMISS
+ X86_INS_FCOMP
+ X86_INS_FCOMPI
+ X86_INS_FCOMI
+ X86_INS_FCOM
+ X86_INS_FCOS
+ X86_INS_CPUID
+ X86_INS_CQO
+ X86_INS_CRC32
+ X86_INS_CVTDQ2PD
+ X86_INS_CVTDQ2PS
+ X86_INS_CVTPD2DQ
+ X86_INS_CVTPD2PS
+ X86_INS_CVTPS2DQ
+ X86_INS_CVTPS2PD
+ X86_INS_CVTSD2SI
+ X86_INS_CVTSD2SS
+ X86_INS_CVTSI2SD
+ X86_INS_CVTSI2SS
+ X86_INS_CVTSS2SD
+ X86_INS_CVTSS2SI
+ X86_INS_CVTTPD2DQ
+ X86_INS_CVTTPS2DQ
+ X86_INS_CVTTSD2SI
+ X86_INS_CVTTSS2SI
+ X86_INS_CWD
+ X86_INS_CWDE
+ X86_INS_DAA
+ X86_INS_DAS
+ X86_INS_DATA16
+ X86_INS_DEC
+ X86_INS_DIV
+ X86_INS_DIVPD
+ X86_INS_DIVPS
+ X86_INS_FDIVR
+ X86_INS_FIDIVR
+ X86_INS_FDIVRP
+ X86_INS_DIVSD
+ X86_INS_DIVSS
+ X86_INS_FDIV
+ X86_INS_FIDIV
+ X86_INS_FDIVP
+ X86_INS_DPPD
+ X86_INS_DPPS
+ X86_INS_RET
+ X86_INS_ENCLS
+ X86_INS_ENCLU
+ X86_INS_ENTER
+ X86_INS_EXTRACTPS
+ X86_INS_EXTRQ
+ X86_INS_F2XM1
+ X86_INS_LCALL
+ X86_INS_LJMP
+ X86_INS_FBLD
+ X86_INS_FBSTP
+ X86_INS_FCOMPP
+ X86_INS_FDECSTP
+ X86_INS_FEMMS
+ X86_INS_FFREE
+ X86_INS_FICOM
+ X86_INS_FICOMP
+ X86_INS_FINCSTP
+ X86_INS_FLDCW
+ X86_INS_FLDENV
+ X86_INS_FLDL2E
+ X86_INS_FLDL2T
+ X86_INS_FLDLG2
+ X86_INS_FLDLN2
+ X86_INS_FLDPI
+ X86_INS_FNCLEX
+ X86_INS_FNINIT
+ X86_INS_FNOP
+ X86_INS_FNSTCW
+ X86_INS_FNSTSW
+ X86_INS_FPATAN
+ X86_INS_FPREM
+ X86_INS_FPREM1
+ X86_INS_FPTAN
+ X86_INS_FRNDINT
+ X86_INS_FRSTOR
+ X86_INS_FNSAVE
+ X86_INS_FSCALE
+ X86_INS_FSETPM
+ X86_INS_FSINCOS
+ X86_INS_FNSTENV
+ X86_INS_FXAM
+ X86_INS_FXRSTOR
+ X86_INS_FXRSTOR64
+ X86_INS_FXSAVE
+ X86_INS_FXSAVE64
+ X86_INS_FXTRACT
+ X86_INS_FYL2X
+ X86_INS_FYL2XP1
+ X86_INS_MOVAPD
+ X86_INS_MOVAPS
+ X86_INS_ORPD
+ X86_INS_ORPS
+ X86_INS_VMOVAPD
+ X86_INS_VMOVAPS
+ X86_INS_XORPD
+ X86_INS_XORPS
+ X86_INS_GETSEC
+ X86_INS_HADDPD
+ X86_INS_HADDPS
+ X86_INS_HLT
+ X86_INS_HSUBPD
+ X86_INS_HSUBPS
+ X86_INS_IDIV
+ X86_INS_FILD
+ X86_INS_IMUL
+ X86_INS_IN
+ X86_INS_INC
+ X86_INS_INSB
+ X86_INS_INSERTPS
+ X86_INS_INSERTQ
+ X86_INS_INSD
+ X86_INS_INSW
+ X86_INS_INT
+ X86_INS_INT1
+ X86_INS_INT3
+ X86_INS_INTO
+ X86_INS_INVD
+ X86_INS_INVEPT
+ X86_INS_INVLPG
+ X86_INS_INVLPGA
+ X86_INS_INVPCID
+ X86_INS_INVVPID
+ X86_INS_IRET
+ X86_INS_IRETD
+ X86_INS_IRETQ
+ X86_INS_FISTTP
+ X86_INS_FIST
+ X86_INS_FISTP
+ X86_INS_UCOMISD
+ X86_INS_UCOMISS
+ X86_INS_VCMP
+ X86_INS_VCOMISD
+ X86_INS_VCOMISS
+ X86_INS_VCVTSD2SS
+ X86_INS_VCVTSI2SD
+ X86_INS_VCVTSI2SS
+ X86_INS_VCVTSS2SD
+ X86_INS_VCVTTSD2SI
+ X86_INS_VCVTTSD2USI
+ X86_INS_VCVTTSS2SI
+ X86_INS_VCVTTSS2USI
+ X86_INS_VCVTUSI2SD
+ X86_INS_VCVTUSI2SS
+ X86_INS_VUCOMISD
+ X86_INS_VUCOMISS
+ X86_INS_JAE
+ X86_INS_JA
+ X86_INS_JBE
+ X86_INS_JB
+ X86_INS_JCXZ
+ X86_INS_JECXZ
+ X86_INS_JE
+ X86_INS_JGE
+ X86_INS_JG
+ X86_INS_JLE
+ X86_INS_JL
+ X86_INS_JMP
+ X86_INS_JNE
+ X86_INS_JNO
+ X86_INS_JNP
+ X86_INS_JNS
+ X86_INS_JO
+ X86_INS_JP
+ X86_INS_JRCXZ
+ X86_INS_JS
+ X86_INS_KANDB
+ X86_INS_KANDD
+ X86_INS_KANDNB
+ X86_INS_KANDND
+ X86_INS_KANDNQ
+ X86_INS_KANDNW
+ X86_INS_KANDQ
+ X86_INS_KANDW
+ X86_INS_KMOVB
+ X86_INS_KMOVD
+ X86_INS_KMOVQ
+ X86_INS_KMOVW
+ X86_INS_KNOTB
+ X86_INS_KNOTD
+ X86_INS_KNOTQ
+ X86_INS_KNOTW
+ X86_INS_KORB
+ X86_INS_KORD
+ X86_INS_KORQ
+ X86_INS_KORTESTW
+ X86_INS_KORW
+ X86_INS_KSHIFTLW
+ X86_INS_KSHIFTRW
+ X86_INS_KUNPCKBW
+ X86_INS_KXNORB
+ X86_INS_KXNORD
+ X86_INS_KXNORQ
+ X86_INS_KXNORW
+ X86_INS_KXORB
+ X86_INS_KXORD
+ X86_INS_KXORQ
+ X86_INS_KXORW
+ X86_INS_LAHF
+ X86_INS_LAR
+ X86_INS_LDDQU
+ X86_INS_LDMXCSR
+ X86_INS_LDS
+ X86_INS_FLDZ
+ X86_INS_FLD1
+ X86_INS_FLD
+ X86_INS_LEA
+ X86_INS_LEAVE
+ X86_INS_LES
+ X86_INS_LFENCE
+ X86_INS_LFS
+ X86_INS_LGDT
+ X86_INS_LGS
+ X86_INS_LIDT
+ X86_INS_LLDT
+ X86_INS_LMSW
+ X86_INS_OR
+ X86_INS_SUB
+ X86_INS_XOR
+ X86_INS_LODSB
+ X86_INS_LODSD
+ X86_INS_LODSQ
+ X86_INS_LODSW
+ X86_INS_LOOP
+ X86_INS_LOOPE
+ X86_INS_LOOPNE
+ X86_INS_RETF
+ X86_INS_RETFQ
+ X86_INS_LSL
+ X86_INS_LSS
+ X86_INS_LTR
+ X86_INS_XADD
+ X86_INS_LZCNT
+ X86_INS_MASKMOVDQU
+ X86_INS_MAXPD
+ X86_INS_MAXPS
+ X86_INS_MAXSD
+ X86_INS_MAXSS
+ X86_INS_MFENCE
+ X86_INS_MINPD
+ X86_INS_MINPS
+ X86_INS_MINSD
+ X86_INS_MINSS
+ X86_INS_CVTPD2PI
+ X86_INS_CVTPI2PD
+ X86_INS_CVTPI2PS
+ X86_INS_CVTPS2PI
+ X86_INS_CVTTPD2PI
+ X86_INS_CVTTPS2PI
+ X86_INS_EMMS
+ X86_INS_MASKMOVQ
+ X86_INS_MOVD
+ X86_INS_MOVDQ2Q
+ X86_INS_MOVNTQ
+ X86_INS_MOVQ2DQ
+ X86_INS_MOVQ
+ X86_INS_PABSB
+ X86_INS_PABSD
+ X86_INS_PABSW
+ X86_INS_PACKSSDW
+ X86_INS_PACKSSWB
+ X86_INS_PACKUSWB
+ X86_INS_PADDB
+ X86_INS_PADDD
+ X86_INS_PADDQ
+ X86_INS_PADDSB
+ X86_INS_PADDSW
+ X86_INS_PADDUSB
+ X86_INS_PADDUSW
+ X86_INS_PADDW
+ X86_INS_PALIGNR
+ X86_INS_PANDN
+ X86_INS_PAND
+ X86_INS_PAVGB
+ X86_INS_PAVGW
+ X86_INS_PCMPEQB
+ X86_INS_PCMPEQD
+ X86_INS_PCMPEQW
+ X86_INS_PCMPGTB
+ X86_INS_PCMPGTD
+ X86_INS_PCMPGTW
+ X86_INS_PEXTRW
+ X86_INS_PHADDSW
+ X86_INS_PHADDW
+ X86_INS_PHADDD
+ X86_INS_PHSUBD
+ X86_INS_PHSUBSW
+ X86_INS_PHSUBW
+ X86_INS_PINSRW
+ X86_INS_PMADDUBSW
+ X86_INS_PMADDWD
+ X86_INS_PMAXSW
+ X86_INS_PMAXUB
+ X86_INS_PMINSW
+ X86_INS_PMINUB
+ X86_INS_PMOVMSKB
+ X86_INS_PMULHRSW
+ X86_INS_PMULHUW
+ X86_INS_PMULHW
+ X86_INS_PMULLW
+ X86_INS_PMULUDQ
+ X86_INS_POR
+ X86_INS_PSADBW
+ X86_INS_PSHUFB
+ X86_INS_PSHUFW
+ X86_INS_PSIGNB
+ X86_INS_PSIGND
+ X86_INS_PSIGNW
+ X86_INS_PSLLD
+ X86_INS_PSLLQ
+ X86_INS_PSLLW
+ X86_INS_PSRAD
+ X86_INS_PSRAW
+ X86_INS_PSRLD
+ X86_INS_PSRLQ
+ X86_INS_PSRLW
+ X86_INS_PSUBB
+ X86_INS_PSUBD
+ X86_INS_PSUBQ
+ X86_INS_PSUBSB
+ X86_INS_PSUBSW
+ X86_INS_PSUBUSB
+ X86_INS_PSUBUSW
+ X86_INS_PSUBW
+ X86_INS_PUNPCKHBW
+ X86_INS_PUNPCKHDQ
+ X86_INS_PUNPCKHWD
+ X86_INS_PUNPCKLBW
+ X86_INS_PUNPCKLDQ
+ X86_INS_PUNPCKLWD
+ X86_INS_PXOR
+ X86_INS_MONITOR
+ X86_INS_MONTMUL
+ X86_INS_MOV
+ X86_INS_MOVABS
+ X86_INS_MOVBE
+ X86_INS_MOVDDUP
+ X86_INS_MOVDQA
+ X86_INS_MOVDQU
+ X86_INS_MOVHLPS
+ X86_INS_MOVHPD
+ X86_INS_MOVHPS
+ X86_INS_MOVLHPS
+ X86_INS_MOVLPD
+ X86_INS_MOVLPS
+ X86_INS_MOVMSKPD
+ X86_INS_MOVMSKPS
+ X86_INS_MOVNTDQA
+ X86_INS_MOVNTDQ
+ X86_INS_MOVNTI
+ X86_INS_MOVNTPD
+ X86_INS_MOVNTPS
+ X86_INS_MOVNTSD
+ X86_INS_MOVNTSS
+ X86_INS_MOVSB
+ X86_INS_MOVSD
+ X86_INS_MOVSHDUP
+ X86_INS_MOVSLDUP
+ X86_INS_MOVSQ
+ X86_INS_MOVSS
+ X86_INS_MOVSW
+ X86_INS_MOVSX
+ X86_INS_MOVSXD
+ X86_INS_MOVUPD
+ X86_INS_MOVUPS
+ X86_INS_MOVZX
+ X86_INS_MPSADBW
+ X86_INS_MUL
+ X86_INS_MULPD
+ X86_INS_MULPS
+ X86_INS_MULSD
+ X86_INS_MULSS
+ X86_INS_MULX
+ X86_INS_FMUL
+ X86_INS_FIMUL
+ X86_INS_FMULP
+ X86_INS_MWAIT
+ X86_INS_NEG
+ X86_INS_NOP
+ X86_INS_NOT
+ X86_INS_OUT
+ X86_INS_OUTSB
+ X86_INS_OUTSD
+ X86_INS_OUTSW
+ X86_INS_PACKUSDW
+ X86_INS_PAUSE
+ X86_INS_PAVGUSB
+ X86_INS_PBLENDVB
+ X86_INS_PBLENDW
+ X86_INS_PCLMULQDQ
+ X86_INS_PCMPEQQ
+ X86_INS_PCMPESTRI
+ X86_INS_PCMPESTRM
+ X86_INS_PCMPGTQ
+ X86_INS_PCMPISTRI
+ X86_INS_PCMPISTRM
+ X86_INS_PDEP
+ X86_INS_PEXT
+ X86_INS_PEXTRB
+ X86_INS_PEXTRD
+ X86_INS_PEXTRQ
+ X86_INS_PF2ID
+ X86_INS_PF2IW
+ X86_INS_PFACC
+ X86_INS_PFADD
+ X86_INS_PFCMPEQ
+ X86_INS_PFCMPGE
+ X86_INS_PFCMPGT
+ X86_INS_PFMAX
+ X86_INS_PFMIN
+ X86_INS_PFMUL
+ X86_INS_PFNACC
+ X86_INS_PFPNACC
+ X86_INS_PFRCPIT1
+ X86_INS_PFRCPIT2
+ X86_INS_PFRCP
+ X86_INS_PFRSQIT1
+ X86_INS_PFRSQRT
+ X86_INS_PFSUBR
+ X86_INS_PFSUB
+ X86_INS_PHMINPOSUW
+ X86_INS_PI2FD
+ X86_INS_PI2FW
+ X86_INS_PINSRB
+ X86_INS_PINSRD
+ X86_INS_PINSRQ
+ X86_INS_PMAXSB
+ X86_INS_PMAXSD
+ X86_INS_PMAXUD
+ X86_INS_PMAXUW
+ X86_INS_PMINSB
+ X86_INS_PMINSD
+ X86_INS_PMINUD
+ X86_INS_PMINUW
+ X86_INS_PMOVSXBD
+ X86_INS_PMOVSXBQ
+ X86_INS_PMOVSXBW
+ X86_INS_PMOVSXDQ
+ X86_INS_PMOVSXWD
+ X86_INS_PMOVSXWQ
+ X86_INS_PMOVZXBD
+ X86_INS_PMOVZXBQ
+ X86_INS_PMOVZXBW
+ X86_INS_PMOVZXDQ
+ X86_INS_PMOVZXWD
+ X86_INS_PMOVZXWQ
+ X86_INS_PMULDQ
+ X86_INS_PMULHRW
+ X86_INS_PMULLD
+ X86_INS_POP
+ X86_INS_POPAW
+ X86_INS_POPAL
+ X86_INS_POPCNT
+ X86_INS_POPF
+ X86_INS_POPFD
+ X86_INS_POPFQ
+ X86_INS_PREFETCH
+ X86_INS_PREFETCHNTA
+ X86_INS_PREFETCHT0
+ X86_INS_PREFETCHT1
+ X86_INS_PREFETCHT2
+ X86_INS_PREFETCHW
+ X86_INS_PSHUFD
+ X86_INS_PSHUFHW
+ X86_INS_PSHUFLW
+ X86_INS_PSLLDQ
+ X86_INS_PSRLDQ
+ X86_INS_PSWAPD
+ X86_INS_PTEST
+ X86_INS_PUNPCKHQDQ
+ X86_INS_PUNPCKLQDQ
+ X86_INS_PUSH
+ X86_INS_PUSHAW
+ X86_INS_PUSHAL
+ X86_INS_PUSHF
+ X86_INS_PUSHFD
+ X86_INS_PUSHFQ
+ X86_INS_RCL
+ X86_INS_RCPPS
+ X86_INS_RCPSS
+ X86_INS_RCR
+ X86_INS_RDFSBASE
+ X86_INS_RDGSBASE
+ X86_INS_RDMSR
+ X86_INS_RDPMC
+ X86_INS_RDRAND
+ X86_INS_RDSEED
+ X86_INS_RDTSC
+ X86_INS_RDTSCP
+ X86_INS_ROL
+ X86_INS_ROR
+ X86_INS_RORX
+ X86_INS_ROUNDPD
+ X86_INS_ROUNDPS
+ X86_INS_ROUNDSD
+ X86_INS_ROUNDSS
+ X86_INS_RSM
+ X86_INS_RSQRTPS
+ X86_INS_RSQRTSS
+ X86_INS_SAHF
+ X86_INS_SAL
+ X86_INS_SALC
+ X86_INS_SAR
+ X86_INS_SARX
+ X86_INS_SBB
+ X86_INS_SCASB
+ X86_INS_SCASD
+ X86_INS_SCASQ
+ X86_INS_SCASW
+ X86_INS_SETAE
+ X86_INS_SETA
+ X86_INS_SETBE
+ X86_INS_SETB
+ X86_INS_SETE
+ X86_INS_SETGE
+ X86_INS_SETG
+ X86_INS_SETLE
+ X86_INS_SETL
+ X86_INS_SETNE
+ X86_INS_SETNO
+ X86_INS_SETNP
+ X86_INS_SETNS
+ X86_INS_SETO
+ X86_INS_SETP
+ X86_INS_SETS
+ X86_INS_SFENCE
+ X86_INS_SGDT
+ X86_INS_SHA1MSG1
+ X86_INS_SHA1MSG2
+ X86_INS_SHA1NEXTE
+ X86_INS_SHA1RNDS4
+ X86_INS_SHA256MSG1
+ X86_INS_SHA256MSG2
+ X86_INS_SHA256RNDS2
+ X86_INS_SHL
+ X86_INS_SHLD
+ X86_INS_SHLX
+ X86_INS_SHR
+ X86_INS_SHRD
+ X86_INS_SHRX
+ X86_INS_SHUFPD
+ X86_INS_SHUFPS
+ X86_INS_SIDT
+ X86_INS_FSIN
+ X86_INS_SKINIT
+ X86_INS_SLDT
+ X86_INS_SMSW
+ X86_INS_SQRTPD
+ X86_INS_SQRTPS
+ X86_INS_SQRTSD
+ X86_INS_SQRTSS
+ X86_INS_FSQRT
+ X86_INS_STAC
+ X86_INS_STC
+ X86_INS_STD
+ X86_INS_STGI
+ X86_INS_STI
+ X86_INS_STMXCSR
+ X86_INS_STOSB
+ X86_INS_STOSD
+ X86_INS_STOSQ
+ X86_INS_STOSW
+ X86_INS_STR
+ X86_INS_FST
+ X86_INS_FSTP
+ X86_INS_FSTPNCE
+ X86_INS_SUBPD
+ X86_INS_SUBPS
+ X86_INS_FSUBR
+ X86_INS_FISUBR
+ X86_INS_FSUBRP
+ X86_INS_SUBSD
+ X86_INS_SUBSS
+ X86_INS_FSUB
+ X86_INS_FISUB
+ X86_INS_FSUBP
+ X86_INS_SWAPGS
+ X86_INS_SYSCALL
+ X86_INS_SYSENTER
+ X86_INS_SYSEXIT
+ X86_INS_SYSRET
+ X86_INS_T1MSKC
+ X86_INS_TEST
+ X86_INS_UD2
+ X86_INS_FTST
+ X86_INS_TZCNT
+ X86_INS_TZMSK
+ X86_INS_FUCOMPI
+ X86_INS_FUCOMI
+ X86_INS_FUCOMPP
+ X86_INS_FUCOMP
+ X86_INS_FUCOM
+ X86_INS_UD2B
+ X86_INS_UNPCKHPD
+ X86_INS_UNPCKHPS
+ X86_INS_UNPCKLPD
+ X86_INS_UNPCKLPS
+ X86_INS_VADDPD
+ X86_INS_VADDPS
+ X86_INS_VADDSD
+ X86_INS_VADDSS
+ X86_INS_VADDSUBPD
+ X86_INS_VADDSUBPS
+ X86_INS_VAESDECLAST
+ X86_INS_VAESDEC
+ X86_INS_VAESENCLAST
+ X86_INS_VAESENC
+ X86_INS_VAESIMC
+ X86_INS_VAESKEYGENASSIST
+ X86_INS_VALIGND
+ X86_INS_VALIGNQ
+ X86_INS_VANDNPD
+ X86_INS_VANDNPS
+ X86_INS_VANDPD
+ X86_INS_VANDPS
+ X86_INS_VBLENDMPD
+ X86_INS_VBLENDMPS
+ X86_INS_VBLENDPD
+ X86_INS_VBLENDPS
+ X86_INS_VBLENDVPD
+ X86_INS_VBLENDVPS
+ X86_INS_VBROADCASTF128
+ X86_INS_VBROADCASTI128
+ X86_INS_VBROADCASTI32X4
+ X86_INS_VBROADCASTI64X4
+ X86_INS_VBROADCASTSD
+ X86_INS_VBROADCASTSS
+ X86_INS_VCMPPD
+ X86_INS_VCMPPS
+ X86_INS_VCMPSD
+ X86_INS_VCMPSS
+ X86_INS_VCVTDQ2PD
+ X86_INS_VCVTDQ2PS
+ X86_INS_VCVTPD2DQX
+ X86_INS_VCVTPD2DQ
+ X86_INS_VCVTPD2PSX
+ X86_INS_VCVTPD2PS
+ X86_INS_VCVTPD2UDQ
+ X86_INS_VCVTPH2PS
+ X86_INS_VCVTPS2DQ
+ X86_INS_VCVTPS2PD
+ X86_INS_VCVTPS2PH
+ X86_INS_VCVTPS2UDQ
+ X86_INS_VCVTSD2SI
+ X86_INS_VCVTSD2USI
+ X86_INS_VCVTSS2SI
+ X86_INS_VCVTSS2USI
+ X86_INS_VCVTTPD2DQX
+ X86_INS_VCVTTPD2DQ
+ X86_INS_VCVTTPD2UDQ
+ X86_INS_VCVTTPS2DQ
+ X86_INS_VCVTTPS2UDQ
+ X86_INS_VCVTUDQ2PD
+ X86_INS_VCVTUDQ2PS
+ X86_INS_VDIVPD
+ X86_INS_VDIVPS
+ X86_INS_VDIVSD
+ X86_INS_VDIVSS
+ X86_INS_VDPPD
+ X86_INS_VDPPS
+ X86_INS_VERR
+ X86_INS_VERW
+ X86_INS_VEXTRACTF128
+ X86_INS_VEXTRACTF32X4
+ X86_INS_VEXTRACTF64X4
+ X86_INS_VEXTRACTI128
+ X86_INS_VEXTRACTI32X4
+ X86_INS_VEXTRACTI64X4
+ X86_INS_VEXTRACTPS
+ X86_INS_VFMADD132PD
+ X86_INS_VFMADD132PS
+ X86_INS_VFMADD213PD
+ X86_INS_VFMADD213PS
+ X86_INS_VFMADDPD
+ X86_INS_VFMADD231PD
+ X86_INS_VFMADDPS
+ X86_INS_VFMADD231PS
+ X86_INS_VFMADDSD
+ X86_INS_VFMADD213SD
+ X86_INS_VFMADD132SD
+ X86_INS_VFMADD231SD
+ X86_INS_VFMADDSS
+ X86_INS_VFMADD213SS
+ X86_INS_VFMADD132SS
+ X86_INS_VFMADD231SS
+ X86_INS_VFMADDSUB132PD
+ X86_INS_VFMADDSUB132PS
+ X86_INS_VFMADDSUB213PD
+ X86_INS_VFMADDSUB213PS
+ X86_INS_VFMADDSUBPD
+ X86_INS_VFMADDSUB231PD
+ X86_INS_VFMADDSUBPS
+ X86_INS_VFMADDSUB231PS
+ X86_INS_VFMSUB132PD
+ X86_INS_VFMSUB132PS
+ X86_INS_VFMSUB213PD
+ X86_INS_VFMSUB213PS
+ X86_INS_VFMSUBADD132PD
+ X86_INS_VFMSUBADD132PS
+ X86_INS_VFMSUBADD213PD
+ X86_INS_VFMSUBADD213PS
+ X86_INS_VFMSUBADDPD
+ X86_INS_VFMSUBADD231PD
+ X86_INS_VFMSUBADDPS
+ X86_INS_VFMSUBADD231PS
+ X86_INS_VFMSUBPD
+ X86_INS_VFMSUB231PD
+ X86_INS_VFMSUBPS
+ X86_INS_VFMSUB231PS
+ X86_INS_VFMSUBSD
+ X86_INS_VFMSUB213SD
+ X86_INS_VFMSUB132SD
+ X86_INS_VFMSUB231SD
+ X86_INS_VFMSUBSS
+ X86_INS_VFMSUB213SS
+ X86_INS_VFMSUB132SS
+ X86_INS_VFMSUB231SS
+ X86_INS_VFNMADD132PD
+ X86_INS_VFNMADD132PS
+ X86_INS_VFNMADD213PD
+ X86_INS_VFNMADD213PS
+ X86_INS_VFNMADDPD
+ X86_INS_VFNMADD231PD
+ X86_INS_VFNMADDPS
+ X86_INS_VFNMADD231PS
+ X86_INS_VFNMADDSD
+ X86_INS_VFNMADD213SD
+ X86_INS_VFNMADD132SD
+ X86_INS_VFNMADD231SD
+ X86_INS_VFNMADDSS
+ X86_INS_VFNMADD213SS
+ X86_INS_VFNMADD132SS
+ X86_INS_VFNMADD231SS
+ X86_INS_VFNMSUB132PD
+ X86_INS_VFNMSUB132PS
+ X86_INS_VFNMSUB213PD
+ X86_INS_VFNMSUB213PS
+ X86_INS_VFNMSUBPD
+ X86_INS_VFNMSUB231PD
+ X86_INS_VFNMSUBPS
+ X86_INS_VFNMSUB231PS
+ X86_INS_VFNMSUBSD
+ X86_INS_VFNMSUB213SD
+ X86_INS_VFNMSUB132SD
+ X86_INS_VFNMSUB231SD
+ X86_INS_VFNMSUBSS
+ X86_INS_VFNMSUB213SS
+ X86_INS_VFNMSUB132SS
+ X86_INS_VFNMSUB231SS
+ X86_INS_VFRCZPD
+ X86_INS_VFRCZPS
+ X86_INS_VFRCZSD
+ X86_INS_VFRCZSS
+ X86_INS_VORPD
+ X86_INS_VORPS
+ X86_INS_VXORPD
+ X86_INS_VXORPS
+ X86_INS_VGATHERDPD
+ X86_INS_VGATHERDPS
+ X86_INS_VGATHERPF0DPD
+ X86_INS_VGATHERPF0DPS
+ X86_INS_VGATHERPF0QPD
+ X86_INS_VGATHERPF0QPS
+ X86_INS_VGATHERPF1DPD
+ X86_INS_VGATHERPF1DPS
+ X86_INS_VGATHERPF1QPD
+ X86_INS_VGATHERPF1QPS
+ X86_INS_VGATHERQPD
+ X86_INS_VGATHERQPS
+ X86_INS_VHADDPD
+ X86_INS_VHADDPS
+ X86_INS_VHSUBPD
+ X86_INS_VHSUBPS
+ X86_INS_VINSERTF128
+ X86_INS_VINSERTF32X4
+ X86_INS_VINSERTF64X4
+ X86_INS_VINSERTI128
+ X86_INS_VINSERTI32X4
+ X86_INS_VINSERTI64X4
+ X86_INS_VINSERTPS
+ X86_INS_VLDDQU
+ X86_INS_VLDMXCSR
+ X86_INS_VMASKMOVDQU
+ X86_INS_VMASKMOVPD
+ X86_INS_VMASKMOVPS
+ X86_INS_VMAXPD
+ X86_INS_VMAXPS
+ X86_INS_VMAXSD
+ X86_INS_VMAXSS
+ X86_INS_VMCALL
+ X86_INS_VMCLEAR
+ X86_INS_VMFUNC
+ X86_INS_VMINPD
+ X86_INS_VMINPS
+ X86_INS_VMINSD
+ X86_INS_VMINSS
+ X86_INS_VMLAUNCH
+ X86_INS_VMLOAD
+ X86_INS_VMMCALL
+ X86_INS_VMOVQ
+ X86_INS_VMOVDDUP
+ X86_INS_VMOVD
+ X86_INS_VMOVDQA32
+ X86_INS_VMOVDQA64
+ X86_INS_VMOVDQA
+ X86_INS_VMOVDQU16
+ X86_INS_VMOVDQU32
+ X86_INS_VMOVDQU64
+ X86_INS_VMOVDQU8
+ X86_INS_VMOVDQU
+ X86_INS_VMOVHLPS
+ X86_INS_VMOVHPD
+ X86_INS_VMOVHPS
+ X86_INS_VMOVLHPS
+ X86_INS_VMOVLPD
+ X86_INS_VMOVLPS
+ X86_INS_VMOVMSKPD
+ X86_INS_VMOVMSKPS
+ X86_INS_VMOVNTDQA
+ X86_INS_VMOVNTDQ
+ X86_INS_VMOVNTPD
+ X86_INS_VMOVNTPS
+ X86_INS_VMOVSD
+ X86_INS_VMOVSHDUP
+ X86_INS_VMOVSLDUP
+ X86_INS_VMOVSS
+ X86_INS_VMOVUPD
+ X86_INS_VMOVUPS
+ X86_INS_VMPSADBW
+ X86_INS_VMPTRLD
+ X86_INS_VMPTRST
+ X86_INS_VMREAD
+ X86_INS_VMRESUME
+ X86_INS_VMRUN
+ X86_INS_VMSAVE
+ X86_INS_VMULPD
+ X86_INS_VMULPS
+ X86_INS_VMULSD
+ X86_INS_VMULSS
+ X86_INS_VMWRITE
+ X86_INS_VMXOFF
+ X86_INS_VMXON
+ X86_INS_VPABSB
+ X86_INS_VPABSD
+ X86_INS_VPABSQ
+ X86_INS_VPABSW
+ X86_INS_VPACKSSDW
+ X86_INS_VPACKSSWB
+ X86_INS_VPACKUSDW
+ X86_INS_VPACKUSWB
+ X86_INS_VPADDB
+ X86_INS_VPADDD
+ X86_INS_VPADDQ
+ X86_INS_VPADDSB
+ X86_INS_VPADDSW
+ X86_INS_VPADDUSB
+ X86_INS_VPADDUSW
+ X86_INS_VPADDW
+ X86_INS_VPALIGNR
+ X86_INS_VPANDD
+ X86_INS_VPANDND
+ X86_INS_VPANDNQ
+ X86_INS_VPANDN
+ X86_INS_VPANDQ
+ X86_INS_VPAND
+ X86_INS_VPAVGB
+ X86_INS_VPAVGW
+ X86_INS_VPBLENDD
+ X86_INS_VPBLENDMD
+ X86_INS_VPBLENDMQ
+ X86_INS_VPBLENDVB
+ X86_INS_VPBLENDW
+ X86_INS_VPBROADCASTB
+ X86_INS_VPBROADCASTD
+ X86_INS_VPBROADCASTMB2Q
+ X86_INS_VPBROADCASTMW2D
+ X86_INS_VPBROADCASTQ
+ X86_INS_VPBROADCASTW
+ X86_INS_VPCLMULQDQ
+ X86_INS_VPCMOV
+ X86_INS_VPCMP
+ X86_INS_VPCMPD
+ X86_INS_VPCMPEQB
+ X86_INS_VPCMPEQD
+ X86_INS_VPCMPEQQ
+ X86_INS_VPCMPEQW
+ X86_INS_VPCMPESTRI
+ X86_INS_VPCMPESTRM
+ X86_INS_VPCMPGTB
+ X86_INS_VPCMPGTD
+ X86_INS_VPCMPGTQ
+ X86_INS_VPCMPGTW
+ X86_INS_VPCMPISTRI
+ X86_INS_VPCMPISTRM
+ X86_INS_VPCMPQ
+ X86_INS_VPCMPUD
+ X86_INS_VPCMPUQ
+ X86_INS_VPCOMB
+ X86_INS_VPCOMD
+ X86_INS_VPCOMQ
+ X86_INS_VPCOMUB
+ X86_INS_VPCOMUD
+ X86_INS_VPCOMUQ
+ X86_INS_VPCOMUW
+ X86_INS_VPCOMW
+ X86_INS_VPCONFLICTD
+ X86_INS_VPCONFLICTQ
+ X86_INS_VPERM2F128
+ X86_INS_VPERM2I128
+ X86_INS_VPERMD
+ X86_INS_VPERMI2D
+ X86_INS_VPERMI2PD
+ X86_INS_VPERMI2PS
+ X86_INS_VPERMI2Q
+ X86_INS_VPERMIL2PD
+ X86_INS_VPERMIL2PS
+ X86_INS_VPERMILPD
+ X86_INS_VPERMILPS
+ X86_INS_VPERMPD
+ X86_INS_VPERMPS
+ X86_INS_VPERMQ
+ X86_INS_VPERMT2D
+ X86_INS_VPERMT2PD
+ X86_INS_VPERMT2PS
+ X86_INS_VPERMT2Q
+ X86_INS_VPEXTRB
+ X86_INS_VPEXTRD
+ X86_INS_VPEXTRQ
+ X86_INS_VPEXTRW
+ X86_INS_VPGATHERDD
+ X86_INS_VPGATHERDQ
+ X86_INS_VPGATHERQD
+ X86_INS_VPGATHERQQ
+ X86_INS_VPHADDBD
+ X86_INS_VPHADDBQ
+ X86_INS_VPHADDBW
+ X86_INS_VPHADDDQ
+ X86_INS_VPHADDD
+ X86_INS_VPHADDSW
+ X86_INS_VPHADDUBD
+ X86_INS_VPHADDUBQ
+ X86_INS_VPHADDUBW
+ X86_INS_VPHADDUDQ
+ X86_INS_VPHADDUWD
+ X86_INS_VPHADDUWQ
+ X86_INS_VPHADDWD
+ X86_INS_VPHADDWQ
+ X86_INS_VPHADDW
+ X86_INS_VPHMINPOSUW
+ X86_INS_VPHSUBBW
+ X86_INS_VPHSUBDQ
+ X86_INS_VPHSUBD
+ X86_INS_VPHSUBSW
+ X86_INS_VPHSUBWD
+ X86_INS_VPHSUBW
+ X86_INS_VPINSRB
+ X86_INS_VPINSRD
+ X86_INS_VPINSRQ
+ X86_INS_VPINSRW
+ X86_INS_VPLZCNTD
+ X86_INS_VPLZCNTQ
+ X86_INS_VPMACSDD
+ X86_INS_VPMACSDQH
+ X86_INS_VPMACSDQL
+ X86_INS_VPMACSSDD
+ X86_INS_VPMACSSDQH
+ X86_INS_VPMACSSDQL
+ X86_INS_VPMACSSWD
+ X86_INS_VPMACSSWW
+ X86_INS_VPMACSWD
+ X86_INS_VPMACSWW
+ X86_INS_VPMADCSSWD
+ X86_INS_VPMADCSWD
+ X86_INS_VPMADDUBSW
+ X86_INS_VPMADDWD
+ X86_INS_VPMASKMOVD
+ X86_INS_VPMASKMOVQ
+ X86_INS_VPMAXSB
+ X86_INS_VPMAXSD
+ X86_INS_VPMAXSQ
+ X86_INS_VPMAXSW
+ X86_INS_VPMAXUB
+ X86_INS_VPMAXUD
+ X86_INS_VPMAXUQ
+ X86_INS_VPMAXUW
+ X86_INS_VPMINSB
+ X86_INS_VPMINSD
+ X86_INS_VPMINSQ
+ X86_INS_VPMINSW
+ X86_INS_VPMINUB
+ X86_INS_VPMINUD
+ X86_INS_VPMINUQ
+ X86_INS_VPMINUW
+ X86_INS_VPMOVDB
+ X86_INS_VPMOVDW
+ X86_INS_VPMOVMSKB
+ X86_INS_VPMOVQB
+ X86_INS_VPMOVQD
+ X86_INS_VPMOVQW
+ X86_INS_VPMOVSDB
+ X86_INS_VPMOVSDW
+ X86_INS_VPMOVSQB
+ X86_INS_VPMOVSQD
+ X86_INS_VPMOVSQW
+ X86_INS_VPMOVSXBD
+ X86_INS_VPMOVSXBQ
+ X86_INS_VPMOVSXBW
+ X86_INS_VPMOVSXDQ
+ X86_INS_VPMOVSXWD
+ X86_INS_VPMOVSXWQ
+ X86_INS_VPMOVUSDB
+ X86_INS_VPMOVUSDW
+ X86_INS_VPMOVUSQB
+ X86_INS_VPMOVUSQD
+ X86_INS_VPMOVUSQW
+ X86_INS_VPMOVZXBD
+ X86_INS_VPMOVZXBQ
+ X86_INS_VPMOVZXBW
+ X86_INS_VPMOVZXDQ
+ X86_INS_VPMOVZXWD
+ X86_INS_VPMOVZXWQ
+ X86_INS_VPMULDQ
+ X86_INS_VPMULHRSW
+ X86_INS_VPMULHUW
+ X86_INS_VPMULHW
+ X86_INS_VPMULLD
+ X86_INS_VPMULLW
+ X86_INS_VPMULUDQ
+ X86_INS_VPORD
+ X86_INS_VPORQ
+ X86_INS_VPOR
+ X86_INS_VPPERM
+ X86_INS_VPROTB
+ X86_INS_VPROTD
+ X86_INS_VPROTQ
+ X86_INS_VPROTW
+ X86_INS_VPSADBW
+ X86_INS_VPSCATTERDD
+ X86_INS_VPSCATTERDQ
+ X86_INS_VPSCATTERQD
+ X86_INS_VPSCATTERQQ
+ X86_INS_VPSHAB
+ X86_INS_VPSHAD
+ X86_INS_VPSHAQ
+ X86_INS_VPSHAW
+ X86_INS_VPSHLB
+ X86_INS_VPSHLD
+ X86_INS_VPSHLQ
+ X86_INS_VPSHLW
+ X86_INS_VPSHUFB
+ X86_INS_VPSHUFD
+ X86_INS_VPSHUFHW
+ X86_INS_VPSHUFLW
+ X86_INS_VPSIGNB
+ X86_INS_VPSIGND
+ X86_INS_VPSIGNW
+ X86_INS_VPSLLDQ
+ X86_INS_VPSLLD
+ X86_INS_VPSLLQ
+ X86_INS_VPSLLVD
+ X86_INS_VPSLLVQ
+ X86_INS_VPSLLW
+ X86_INS_VPSRAD
+ X86_INS_VPSRAQ
+ X86_INS_VPSRAVD
+ X86_INS_VPSRAVQ
+ X86_INS_VPSRAW
+ X86_INS_VPSRLDQ
+ X86_INS_VPSRLD
+ X86_INS_VPSRLQ
+ X86_INS_VPSRLVD
+ X86_INS_VPSRLVQ
+ X86_INS_VPSRLW
+ X86_INS_VPSUBB
+ X86_INS_VPSUBD
+ X86_INS_VPSUBQ
+ X86_INS_VPSUBSB
+ X86_INS_VPSUBSW
+ X86_INS_VPSUBUSB
+ X86_INS_VPSUBUSW
+ X86_INS_VPSUBW
+ X86_INS_VPTESTMD
+ X86_INS_VPTESTMQ
+ X86_INS_VPTESTNMD
+ X86_INS_VPTESTNMQ
+ X86_INS_VPTEST
+ X86_INS_VPUNPCKHBW
+ X86_INS_VPUNPCKHDQ
+ X86_INS_VPUNPCKHQDQ
+ X86_INS_VPUNPCKHWD
+ X86_INS_VPUNPCKLBW
+ X86_INS_VPUNPCKLDQ
+ X86_INS_VPUNPCKLQDQ
+ X86_INS_VPUNPCKLWD
+ X86_INS_VPXORD
+ X86_INS_VPXORQ
+ X86_INS_VPXOR
+ X86_INS_VRCP14PD
+ X86_INS_VRCP14PS
+ X86_INS_VRCP14SD
+ X86_INS_VRCP14SS
+ X86_INS_VRCP28PD
+ X86_INS_VRCP28PS
+ X86_INS_VRCP28SD
+ X86_INS_VRCP28SS
+ X86_INS_VRCPPS
+ X86_INS_VRCPSS
+ X86_INS_VRNDSCALEPD
+ X86_INS_VRNDSCALEPS
+ X86_INS_VRNDSCALESD
+ X86_INS_VRNDSCALESS
+ X86_INS_VROUNDPD
+ X86_INS_VROUNDPS
+ X86_INS_VROUNDSD
+ X86_INS_VROUNDSS
+ X86_INS_VRSQRT14PD
+ X86_INS_VRSQRT14PS
+ X86_INS_VRSQRT14SD
+ X86_INS_VRSQRT14SS
+ X86_INS_VRSQRT28PD
+ X86_INS_VRSQRT28PS
+ X86_INS_VRSQRT28SD
+ X86_INS_VRSQRT28SS
+ X86_INS_VRSQRTPS
+ X86_INS_VRSQRTSS
+ X86_INS_VSCATTERDPD
+ X86_INS_VSCATTERDPS
+ X86_INS_VSCATTERPF0DPD
+ X86_INS_VSCATTERPF0DPS
+ X86_INS_VSCATTERPF0QPD
+ X86_INS_VSCATTERPF0QPS
+ X86_INS_VSCATTERPF1DPD
+ X86_INS_VSCATTERPF1DPS
+ X86_INS_VSCATTERPF1QPD
+ X86_INS_VSCATTERPF1QPS
+ X86_INS_VSCATTERQPD
+ X86_INS_VSCATTERQPS
+ X86_INS_VSHUFPD
+ X86_INS_VSHUFPS
+ X86_INS_VSQRTPD
+ X86_INS_VSQRTPS
+ X86_INS_VSQRTSD
+ X86_INS_VSQRTSS
+ X86_INS_VSTMXCSR
+ X86_INS_VSUBPD
+ X86_INS_VSUBPS
+ X86_INS_VSUBSD
+ X86_INS_VSUBSS
+ X86_INS_VTESTPD
+ X86_INS_VTESTPS
+ X86_INS_VUNPCKHPD
+ X86_INS_VUNPCKHPS
+ X86_INS_VUNPCKLPD
+ X86_INS_VUNPCKLPS
+ X86_INS_VZEROALL
+ X86_INS_VZEROUPPER
+ X86_INS_WAIT
+ X86_INS_WBINVD
+ X86_INS_WRFSBASE
+ X86_INS_WRGSBASE
+ X86_INS_WRMSR
+ X86_INS_XABORT
+ X86_INS_XACQUIRE
+ X86_INS_XBEGIN
+ X86_INS_XCHG
+ X86_INS_FXCH
+ X86_INS_XCRYPTCBC
+ X86_INS_XCRYPTCFB
+ X86_INS_XCRYPTCTR
+ X86_INS_XCRYPTECB
+ X86_INS_XCRYPTOFB
+ X86_INS_XEND
+ X86_INS_XGETBV
+ X86_INS_XLATB
+ X86_INS_XRELEASE
+ X86_INS_XRSTOR
+ X86_INS_XRSTOR64
+ X86_INS_XSAVE
+ X86_INS_XSAVE64
+ X86_INS_XSAVEOPT
+ X86_INS_XSAVEOPT64
+ X86_INS_XSETBV
+ X86_INS_XSHA1
+ X86_INS_XSHA256
+ X86_INS_XSTORE
+ X86_INS_XTEST
+ X86_INS_ENDING ' mark the end of the list of insn
+End Enum
+
+'Group of X86 instructions
+Public Enum x86_insn_group
+ X86_GRP_INVALID = 0 ' = CS_GRP_INVALID
+
+ ' > Generic groups '
+ X86_GRP_JUMP 'all jump instructions (conditional+direct+indirect jumps) = CS_GRP_JUMP
+ X86_GRP_CALL 'all call instructions = CS_GRP_CALL
+ X86_GRP_RET ' all return instructions = CS_GRP_RET
+ X86_GRP_INT 'all interrupt instructions (int+syscall) = CS_GRP_INT
+ X86_GRP_IRET 'all interrupt return instructions = CS_GRP_IRET
+
+ ' > Architecture-specific groups
+ X86_GRP_VM = 128 ' all virtualization instructions (VT-x + AMD-V)
+ X86_GRP_3DNOW
+ X86_GRP_AES
+ X86_GRP_ADX
+ X86_GRP_AVX
+ X86_GRP_AVX2
+ X86_GRP_AVX512
+ X86_GRP_BMI
+ X86_GRP_BMI2
+ X86_GRP_CMOV
+ X86_GRP_F16C
+ X86_GRP_FMA
+ X86_GRP_FMA4
+ X86_GRP_FSGSBASE
+ X86_GRP_HLE
+ X86_GRP_MMX
+ X86_GRP_MODE32
+ X86_GRP_MODE64
+ X86_GRP_RTM
+ X86_GRP_SHA
+ X86_GRP_SSE1
+ X86_GRP_SSE2
+ X86_GRP_SSE3
+ X86_GRP_SSE41
+ X86_GRP_SSE42
+ X86_GRP_SSE4A
+ X86_GRP_SSSE3
+ X86_GRP_PCLMUL
+ X86_GRP_XOP
+ X86_GRP_CDI
+ X86_GRP_ERI
+ X86_GRP_TBM
+ X86_GRP_16BITMODE
+ X86_GRP_NOT64BITMODE
+ X86_GRP_SGX
+ X86_GRP_DQI
+ X86_GRP_BWI
+ X86_GRP_PFI
+ X86_GRP_VLX
+ X86_GRP_SMAP
+ X86_GRP_NOVLX
+ X86_GRP_ENDING
+End Enum
+
+
+
+Function x86_sse_cc2str(v As x86_sse_cc) As String
+ Dim r As String
+ If v = X86_SSE_CC_INVALID Then r = "X86_SSE_CC_INVALID"
+ If v = X86_SSE_CC_EQ Then r = "X86_SSE_CC_EQ"
+ If v = X86_SSE_CC_LT Then r = "X86_SSE_CC_LT"
+ If v = X86_SSE_CC_LE Then r = "X86_SSE_CC_LE"
+ If v = X86_SSE_CC_UNORD Then r = "X86_SSE_CC_UNORD"
+ If v = X86_SSE_CC_NEQ Then r = "X86_SSE_CC_NEQ"
+ If v = X86_SSE_CC_NLT Then r = "X86_SSE_CC_NLT"
+ If v = X86_SSE_CC_NLE Then r = "X86_SSE_CC_NLE"
+ If v = X86_SSE_CC_ORD Then r = "X86_SSE_CC_ORD"
+ If v = X86_SSE_CC_EQ_UQ Then r = "X86_SSE_CC_EQ_UQ"
+ If v = X86_SSE_CC_NGE Then r = "X86_SSE_CC_NGE"
+ If v = X86_SSE_CC_NGT Then r = "X86_SSE_CC_NGT"
+ If v = X86_SSE_CC_FALSE Then r = "X86_SSE_CC_FALSE"
+ If v = X86_SSE_CC_NEQ_OQ Then r = "X86_SSE_CC_NEQ_OQ"
+ If v = X86_SSE_CC_GE Then r = "X86_SSE_CC_GE"
+ If v = X86_SSE_CC_GT Then r = "X86_SSE_CC_GT"
+ If v = X86_SSE_CC_TRUE Then r = "X86_SSE_CC_TRUE"
+
+ If Len(r) = 0 Then
+ r = "Unknown: " & Hex(v)
+ ElseIf DEBUG_DUMP Then
+ r = r & " (" & Hex(v) & ")"
+ End If
+
+ x86_sse_cc2str = r
+
+End Function
+
+Function x86_avx_cc2str(v As x86_avx_cc) As String
+ Dim r As String
+ If v = X86_AVX_CC_INVALID Then r = "X86_AVX_CC_INVALID"
+ If v = X86_AVX_CC_EQ Then r = "X86_AVX_CC_EQ"
+ If v = X86_AVX_CC_LT Then r = "X86_AVX_CC_LT"
+ If v = X86_AVX_CC_LE Then r = "X86_AVX_CC_LE"
+ If v = X86_AVX_CC_UNORD Then r = "X86_AVX_CC_UNORD"
+ If v = X86_AVX_CC_NEQ Then r = "X86_AVX_CC_NEQ"
+ If v = X86_AVX_CC_NLT Then r = "X86_AVX_CC_NLT"
+ If v = X86_AVX_CC_NLE Then r = "X86_AVX_CC_NLE"
+ If v = X86_AVX_CC_ORD Then r = "X86_AVX_CC_ORD"
+ If v = X86_AVX_CC_EQ_UQ Then r = "X86_AVX_CC_EQ_UQ"
+ If v = X86_AVX_CC_NGE Then r = "X86_AVX_CC_NGE"
+ If v = X86_AVX_CC_NGT Then r = "X86_AVX_CC_NGT"
+ If v = X86_AVX_CC_FALSE Then r = "X86_AVX_CC_FALSE"
+ If v = X86_AVX_CC_NEQ_OQ Then r = "X86_AVX_CC_NEQ_OQ"
+ If v = X86_AVX_CC_GE Then r = "X86_AVX_CC_GE"
+ If v = X86_AVX_CC_GT Then r = "X86_AVX_CC_GT"
+ If v = X86_AVX_CC_TRUE Then r = "X86_AVX_CC_TRUE"
+ If v = X86_AVX_CC_EQ_OS Then r = "X86_AVX_CC_EQ_OS"
+ If v = X86_AVX_CC_LT_OQ Then r = "X86_AVX_CC_LT_OQ"
+ If v = X86_AVX_CC_LE_OQ Then r = "X86_AVX_CC_LE_OQ"
+ If v = X86_AVX_CC_UNORD_S Then r = "X86_AVX_CC_UNORD_S"
+ If v = X86_AVX_CC_NEQ_US Then r = "X86_AVX_CC_NEQ_US"
+ If v = X86_AVX_CC_NLT_UQ Then r = "X86_AVX_CC_NLT_UQ"
+ If v = X86_AVX_CC_NLE_UQ Then r = "X86_AVX_CC_NLE_UQ"
+ If v = X86_AVX_CC_ORD_S Then r = "X86_AVX_CC_ORD_S"
+ If v = X86_AVX_CC_EQ_US Then r = "X86_AVX_CC_EQ_US"
+ If v = X86_AVX_CC_NGE_UQ Then r = "X86_AVX_CC_NGE_UQ"
+ If v = X86_AVX_CC_NGT_UQ Then r = "X86_AVX_CC_NGT_UQ"
+ If v = X86_AVX_CC_FALSE_OS Then r = "X86_AVX_CC_FALSE_OS"
+ If v = X86_AVX_CC_NEQ_OS Then r = "X86_AVX_CC_NEQ_OS"
+ If v = X86_AVX_CC_GE_OQ Then r = "X86_AVX_CC_GE_OQ"
+ If v = X86_AVX_CC_GT_OQ Then r = "X86_AVX_CC_GT_OQ"
+ If v = X86_AVX_CC_TRUE_US Then r = "X86_AVX_CC_TRUE_US"
+
+ If Len(r) = 0 Then
+ r = "Unknown: " & Hex(v)
+ ElseIf DEBUG_DUMP Then
+ r = r & " (" & Hex(v) & ")"
+ End If
+
+ x86_avx_cc2str = r
+
+End Function
+
+
+Function x86_avx_rm2str(v As x86_avx_rm) As String
+ Dim r As String
+
+ If v = X86_AVX_RM_INVALID Then r = "X86_AVX_RM_INVALID"
+ If v = X86_AVX_RM_RN Then r = "X86_AVX_RM_RN"
+ If v = X86_AVX_RM_RD Then r = "X86_AVX_RM_RD"
+ If v = X86_AVX_RM_RU Then r = "X86_AVX_RM_RU"
+ If v = X86_AVX_RM_RZ Then r = "X86_AVX_RM_RZ"
+
+ If Len(r) = 0 Then
+ r = "Unknown: " & Hex(v)
+ ElseIf DEBUG_DUMP Then
+ r = r & " (" & Hex(v) & ")"
+ End If
+
+ x86_avx_rm2str = r
+End Function
+
+
diff --git a/capstone/bindings/vb6/screenshot.png b/capstone/bindings/vb6/screenshot.png Binary files differnew file mode 100644 index 000000000..3780f6702 --- /dev/null +++ b/capstone/bindings/vb6/screenshot.png diff --git a/capstone/bindings/vb6/vbCapstone.cpp b/capstone/bindings/vb6/vbCapstone.cpp new file mode 100644 index 000000000..90ee1654d --- /dev/null +++ b/capstone/bindings/vb6/vbCapstone.cpp @@ -0,0 +1,119 @@ +/*
+ Capstone Disassembly Engine bindings for VB6
+ Contributed by FireEye FLARE Team
+ Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
+ License: Apache
+ Copyright: FireEye 2017
+
+ This dll is a small stdcall shim so VB6 can access the capstone API
+*/
+
+#include <stdio.h>
+#include <conio.h>
+#include <string.h>
+
+#include <capstone.h>
+#pragma comment(lib, "capstone.lib")
+
+#define EXPORT comment(linker, "/EXPORT:"__FUNCTION__"="__FUNCDNAME__)
+
+unsigned int __stdcall bs_version(int *major, int *minor){
+#pragma EXPORT
+ return cs_version(major,minor);
+}
+
+bool __stdcall bs_support(int query){
+#pragma EXPORT
+ return cs_support(query);
+}
+
+cs_err __stdcall bs_open(cs_arch arch, cs_mode mode, csh *handle){
+#pragma EXPORT
+ return cs_open(arch, mode, handle);
+}
+
+cs_err __stdcall bs_close(csh *handle){
+#pragma EXPORT
+ return cs_close(handle);
+}
+
+cs_err __stdcall bs_option(csh handle, cs_opt_type type, size_t value){
+#pragma EXPORT
+ return cs_option(handle, type, value);
+}
+
+cs_err __stdcall bs_errno(csh handle){
+#pragma EXPORT
+ return cs_errno(handle);
+}
+
+const char* __stdcall bs_strerror(cs_err code){
+#pragma EXPORT
+ return cs_strerror(code);
+}
+
+size_t __stdcall bs_disasm(csh handle, const uint8_t *code, size_t code_size, uint64_t address, size_t count, cs_insn **insn){
+#pragma EXPORT
+ return cs_disasm(handle, code, code_size, address, count, insn);
+}
+
+void __stdcall getInstruction(cs_insn *insn, uint32_t index, void* curInst, uint32_t bufSize){
+#pragma EXPORT
+ memcpy(curInst, (void*)&insn[index], bufSize); //size lets us get a partial version of whatever we have implemented in the vbstruct...
+}
+
+const char* __stdcall bs_reg_name(csh handle, unsigned int reg_id){
+#pragma EXPORT
+ return cs_reg_name(handle, reg_id);
+}
+
+void __stdcall bs_free(cs_insn *insn, size_t count){
+#pragma EXPORT
+ return cs_free(insn, count);
+}
+
+cs_insn* __stdcall bs_malloc(csh handle){
+#pragma EXPORT
+ return cs_malloc(handle);
+}
+
+
+int __stdcall bs_op_index(csh handle, const cs_insn *insn, unsigned int op_type, unsigned int position){
+#pragma EXPORT
+ return cs_op_index(handle,insn,op_type,position);
+}
+
+int __stdcall bs_op_count(csh handle, const cs_insn *insn, unsigned int op_type){
+#pragma EXPORT
+ return cs_op_count(handle,insn,op_type);
+}
+
+bool __stdcall bs_reg_write(csh handle, const cs_insn *insn, unsigned int reg_id){
+#pragma EXPORT
+ return cs_reg_write(handle,insn,reg_id);
+}
+
+bool __stdcall bs_reg_read(csh handle, const cs_insn *insn, unsigned int reg_id){
+#pragma EXPORT
+ return cs_reg_read(handle,insn,reg_id);
+}
+
+bool __stdcall bs_insn_group(csh handle, const cs_insn *insn, unsigned int group_id){
+#pragma EXPORT
+ return cs_insn_group(handle,insn,group_id);
+}
+
+const char* __stdcall bcs_group_name(csh handle, unsigned int group_id){
+#pragma EXPORT
+ return cs_group_name(handle,group_id);
+}
+
+const char* __stdcall bs_insn_name(csh handle, unsigned int insn_id){
+#pragma EXPORT
+ return cs_insn_name(handle,insn_id);
+}
+
+bool __stdcall bs_disasm_iter(csh handle, const uint8_t **code, size_t *size, uint64_t *address, cs_insn *insn){
+#pragma EXPORT
+ return cs_disasm_iter(handle, code, size, address, insn);
+}
diff --git a/capstone/bindings/vb6/vbCapstone.sln b/capstone/bindings/vb6/vbCapstone.sln new file mode 100644 index 000000000..8451d6027 --- /dev/null +++ b/capstone/bindings/vb6/vbCapstone.sln @@ -0,0 +1,20 @@ +
+Microsoft Visual Studio Solution File, Format Version 10.00
+# Visual Studio 2008
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "vbCapstone", "vbCapstone.vcproj", "{B693CA7B-8B91-4413-AAED-14F1947F012A}"
+EndProject
+Global
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
+ Debug|Win32 = Debug|Win32
+ Release|Win32 = Release|Win32
+ EndGlobalSection
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
+ {B693CA7B-8B91-4413-AAED-14F1947F012A}.Debug|Win32.ActiveCfg = Debug|Win32
+ {B693CA7B-8B91-4413-AAED-14F1947F012A}.Debug|Win32.Build.0 = Debug|Win32
+ {B693CA7B-8B91-4413-AAED-14F1947F012A}.Release|Win32.ActiveCfg = Release|Win32
+ {B693CA7B-8B91-4413-AAED-14F1947F012A}.Release|Win32.Build.0 = Release|Win32
+ EndGlobalSection
+ GlobalSection(SolutionProperties) = preSolution
+ HideSolutionNode = FALSE
+ EndGlobalSection
+EndGlobal
diff --git a/capstone/bindings/vb6/vbCapstone.vcproj b/capstone/bindings/vb6/vbCapstone.vcproj new file mode 100644 index 000000000..3085c8e7d --- /dev/null +++ b/capstone/bindings/vb6/vbCapstone.vcproj @@ -0,0 +1,182 @@ +<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioProject
+ ProjectType="Visual C++"
+ Version="9.00"
+ Name="vbCapstone"
+ ProjectGUID="{B693CA7B-8B91-4413-AAED-14F1947F012A}"
+ RootNamespace="yy"
+ Keyword="Win32Proj"
+ TargetFrameworkVersion="196613"
+ >
+ <Platforms>
+ <Platform
+ Name="Win32"
+ />
+ </Platforms>
+ <ToolFiles>
+ </ToolFiles>
+ <Configurations>
+ <Configuration
+ Name="Debug|Win32"
+ OutputDirectory="$(SolutionDir)$(ConfigurationName)"
+ IntermediateDirectory="$(ConfigurationName)"
+ ConfigurationType="2"
+ CharacterSet="2"
+ >
+ <Tool
+ Name="VCPreBuildEventTool"
+ />
+ <Tool
+ Name="VCCustomBuildTool"
+ />
+ <Tool
+ Name="VCXMLDataGeneratorTool"
+ />
+ <Tool
+ Name="VCWebServiceProxyGeneratorTool"
+ />
+ <Tool
+ Name="VCMIDLTool"
+ />
+ <Tool
+ Name="VCCLCompilerTool"
+ Optimization="0"
+ AdditionalIncludeDirectories="./../../include/"
+ PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE"
+ MinimalRebuild="true"
+ BasicRuntimeChecks="3"
+ RuntimeLibrary="1"
+ UsePrecompiledHeader="0"
+ WarningLevel="3"
+ DebugInformationFormat="4"
+ />
+ <Tool
+ Name="VCManagedResourceCompilerTool"
+ />
+ <Tool
+ Name="VCResourceCompilerTool"
+ />
+ <Tool
+ Name="VCPreLinkEventTool"
+ />
+ <Tool
+ Name="VCLinkerTool"
+ OutputFile="./vbCapstone.dll"
+ LinkIncremental="2"
+ GenerateManifest="false"
+ GenerateDebugInformation="true"
+ SubSystem="1"
+ TargetMachine="1"
+ />
+ <Tool
+ Name="VCALinkTool"
+ />
+ <Tool
+ Name="VCManifestTool"
+ EmbedManifest="false"
+ />
+ <Tool
+ Name="VCXDCMakeTool"
+ />
+ <Tool
+ Name="VCBscMakeTool"
+ />
+ <Tool
+ Name="VCFxCopTool"
+ />
+ <Tool
+ Name="VCAppVerifierTool"
+ />
+ <Tool
+ Name="VCPostBuildEventTool"
+ />
+ </Configuration>
+ <Configuration
+ Name="Release|Win32"
+ OutputDirectory="$(SolutionDir)$(ConfigurationName)"
+ IntermediateDirectory="$(ConfigurationName)"
+ ConfigurationType="2"
+ CharacterSet="2"
+ WholeProgramOptimization="1"
+ >
+ <Tool
+ Name="VCPreBuildEventTool"
+ />
+ <Tool
+ Name="VCCustomBuildTool"
+ />
+ <Tool
+ Name="VCXMLDataGeneratorTool"
+ />
+ <Tool
+ Name="VCWebServiceProxyGeneratorTool"
+ />
+ <Tool
+ Name="VCMIDLTool"
+ />
+ <Tool
+ Name="VCCLCompilerTool"
+ Optimization="2"
+ EnableIntrinsicFunctions="true"
+ AdditionalIncludeDirectories="./../../include/"
+ PreprocessorDefinitions="WIN32;NDEBUG;_CONSOLE"
+ RuntimeLibrary="0"
+ EnableFunctionLevelLinking="true"
+ UsePrecompiledHeader="0"
+ WarningLevel="3"
+ DebugInformationFormat="3"
+ />
+ <Tool
+ Name="VCManagedResourceCompilerTool"
+ />
+ <Tool
+ Name="VCResourceCompilerTool"
+ />
+ <Tool
+ Name="VCPreLinkEventTool"
+ />
+ <Tool
+ Name="VCLinkerTool"
+ OutputFile="./vbCapstone.dll"
+ LinkIncremental="1"
+ GenerateManifest="false"
+ GenerateDebugInformation="true"
+ SubSystem="1"
+ OptimizeReferences="2"
+ EnableCOMDATFolding="2"
+ TargetMachine="1"
+ />
+ <Tool
+ Name="VCALinkTool"
+ />
+ <Tool
+ Name="VCManifestTool"
+ />
+ <Tool
+ Name="VCXDCMakeTool"
+ />
+ <Tool
+ Name="VCBscMakeTool"
+ />
+ <Tool
+ Name="VCFxCopTool"
+ />
+ <Tool
+ Name="VCAppVerifierTool"
+ />
+ <Tool
+ Name="VCPostBuildEventTool"
+ />
+ </Configuration>
+ </Configurations>
+ <References>
+ </References>
+ <Files>
+ <File
+ RelativePath=".\vbCapstone.cpp"
+ >
+ </File>
+ </Files>
+ <Globals>
+ </Globals>
+</VisualStudioProject>
|
