1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
#include <stdio.h>
#include <capstone/capstone.h>
#include <capstone/platform.h>
static const char * ext_name[] = {
[BPF_EXT_LEN] = "#len",
};
void print_insn_detail_bpf(csh handle, cs_insn *ins);
void print_insn_detail_bpf(csh handle, cs_insn *ins)
{
unsigned i;
cs_bpf *bpf;
cs_regs regs_read, regs_write;
uint8_t regs_read_count, regs_write_count;
// detail can be NULL on "data" instruction if SKIPDATA option is turned ON
if (ins->detail == NULL)
return;
bpf = &(ins->detail->bpf);
printf("\tOperand count: %u\n", bpf->op_count);
for (i = 0; i < bpf->op_count; i++) {
cs_bpf_op *op = &(bpf->operands[i]);
printf("\t\toperands[%u].type: ", i);
switch (op->type) {
case BPF_OP_INVALID:
printf("INVALID\n");
break;
case BPF_OP_REG:
printf("REG = %s\n", cs_reg_name(handle, op->reg));
break;
case BPF_OP_IMM:
printf("IMM = 0x%" PRIx64 "\n", op->imm);
break;
case BPF_OP_OFF:
printf("OFF = +0x%x\n", op->off);
break;
case BPF_OP_MEM:
printf("MEM\n");
if (op->mem.base != BPF_REG_INVALID)
printf("\t\t\toperands[%u].mem.base: REG = %s\n",
i, cs_reg_name(handle, op->mem.base));
printf("\t\t\toperands[%u].mem.disp: 0x%x\n", i, op->mem.disp);
break;
case BPF_OP_MMEM:
printf("MMEM = M[0x%x]\n", op->mmem);
break;
case BPF_OP_MSH:
printf("MSH = 4*([0x%x]&0xf)\n", op->msh);
break;
case BPF_OP_EXT:
printf("EXT = %s\n", ext_name[op->ext]);
break;
}
}
/* print all registers that are involved in this instruction */
if (!cs_regs_access(handle, ins,
regs_read, ®s_read_count,
regs_write, ®s_write_count)) {
if (regs_read_count) {
printf("\tRegisters read:");
for(i = 0; i < regs_read_count; i++)
printf(" %s", cs_reg_name(handle, regs_read[i]));
printf("\n");
}
if (regs_write_count) {
printf("\tRegisters modified:");
for(i = 0; i < regs_write_count; i++)
printf(" %s", cs_reg_name(handle, regs_write[i]));
printf("\n");
}
}
}
|
