Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP Integrate Capstone/Keystone #1195

Closed
wants to merge 1 commit into from
Closed

WIP Integrate Capstone/Keystone #1195

wants to merge 1 commit into from

Conversation

Isaac0616
Copy link
Contributor

I am surveying the possibility of integrating Capstone/Keystone as mentioned in #683. This is a pretty early and untested draft, but I want to bring up some discussion.

Here are some of my implementation choices.

  1. Currently, if I install Keystone by pip on Ubuntu, it can not correctly find the libkeystone.so. I have to compile it manually. Do we want to do this in setup.py for users?
  2. I move original asm/disasm to _asm_binutil/_disasm_binutil as a fallback because binutil support some architectures (e.g., ia64) which Capstone/Keystone don't support.
  3. Still rely on external cpp to support SYS_xxx.
  4. It seems that Capstone/Keystone do not support "real" 32-bit mode for some architectures. For example,
>>> ks = Ks(KS_ARCH_SPARC, KS_MODE_SPARC32)
>>> ks.asm("srlx %r1, %r2, %r3", as_bytes=True)
('\x02P0\x87', 1L)

>>> ks = Ks(KS_ARCH_PPC, KS_MODE_PPC32+KS_MODE_BIG_ENDIAN)
>>> ks.asm('rldicr  4,4,32,31', as_bytes=True)
('x\x84\x07\xc6', 1L)

Unlike binutil, 32-bit Sparc and PowerPC will not throw any exception when assembling 64-bit instructions. Capstone doesn't have corresponding 32-bit mode for Sparc and PowerPC. Should we fallback to binutil for them?
5. For implementation simplicity, disasm would show

   0:   b85d000000              mov    eax, 0x5d

instead of

   0:   b8 5d 00 00 00          mov    eax,0x5d

Besides, the spacing is also slightly different.

Any suggestions on these points?

@heapcrash
Copy link
Collaborator

Closing this out since the PR is two+ years old. Please rebase your changes on top of the current dev branch or create a new PR to get this merged.

@heapcrash heapcrash closed this Jun 6, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants