1 files changed, 80 insertions, 0 deletions
diff --git a/capstone/cstool/cstool_bpf.c b/capstone/cstool/cstool_bpf.c
new file mode 100644
index 000000000..879f45fef
--- /dev/null
+++ b/capstone/cstool/cstool_bpf.c
@@ -0,0 +1,80 @@
+#include <stdio.h>
+
+#include <capstone/capstone.h>
+#include <capstone/platform.h>
+
+static const char * ext_name[] = {
+	[BPF_EXT_LEN] = "#len",
+};
+
+void print_insn_detail_bpf(csh handle, cs_insn *ins);
+
+void print_insn_detail_bpf(csh handle, cs_insn *ins)
+{
+	unsigned i;
+	cs_bpf *bpf;
+	cs_regs regs_read, regs_write;
+	uint8_t regs_read_count, regs_write_count;
+
+	// detail can be NULL on "data" instruction if SKIPDATA option is turned ON
+	if (ins->detail == NULL)
+		return;
+
+	bpf = &(ins->detail->bpf);
+
+	printf("\tOperand count: %u\n", bpf->op_count);
+
+	for (i = 0; i < bpf->op_count; i++) {
+		cs_bpf_op *op = &(bpf->operands[i]);
+		printf("\t\toperands[%u].type: ", i);
+		switch (op->type) {
+		case BPF_OP_INVALID:
+			printf("INVALID\n");
+			break;
+		case BPF_OP_REG:
+			printf("REG = %s\n", cs_reg_name(handle, op->reg));
+			break;
+		case BPF_OP_IMM:
+			printf("IMM = 0x%" PRIx64 "\n", op->imm);
+			break;
+		case BPF_OP_OFF:
+			printf("OFF = +0x%x\n", op->off);
+			break;
+		case BPF_OP_MEM:
+			printf("MEM\n");
+			if (op->mem.base != BPF_REG_INVALID)
+				printf("\t\t\toperands[%u].mem.base: REG = %s\n",
+						i, cs_reg_name(handle, op->mem.base));
+			printf("\t\t\toperands[%u].mem.disp: 0x%x\n", i, op->mem.disp);
+			break;
+		case BPF_OP_MMEM:
+			printf("MMEM = M[0x%x]\n", op->mmem);
+			break;
+		case BPF_OP_MSH:
+			printf("MSH = 4*([0x%x]&0xf)\n", op->msh);
+			break;
+		case BPF_OP_EXT:
+			printf("EXT = %s\n", ext_name[op->ext]);
+			break;
+		}
+	}
+
+	/* print all registers that are involved in this instruction */
+	if (!cs_regs_access(handle, ins,
+			regs_read, &regs_read_count,
+			regs_write, &regs_write_count)) {
+		if (regs_read_count) {
+			printf("\tRegisters read:");
+			for(i = 0; i < regs_read_count; i++)
+				printf(" %s", cs_reg_name(handle, regs_read[i]));
+			printf("\n");
+		}
+
+		if (regs_write_count) {
+			printf("\tRegisters modified:");
+			for(i = 0; i < regs_write_count; i++)
+				printf(" %s", cs_reg_name(handle, regs_write[i]));
+			printf("\n");
+		}
+	}
+}