5
5
import sys
6
6
import time
7
7
import subprocess
8
- from capstone import *
9
- from capstone .x86 import *
8
+ from typing import Any , Dict
9
+ from capstone import Cs
10
+ from capstone .x86 import CS_ARCH_X86 , CS_MODE_32 , CS_MODE_64 , X86_OP_MEM , X86_OP_REG , X86_OP_IMM
11
+ import capstone .x86 as csr
10
12
from flags import flags
11
13
12
14
flags_maks = {
@@ -228,7 +230,7 @@ def read_operand(o):
228
230
groups = map (instruction .group_name , instruction .groups )
229
231
230
232
PC = {"i386" : "EIP" , "amd64" : "RIP" }[arch ]
231
- registers = {PC : gdb .getR (PC )}
233
+ registers : Dict [ Any , Any ] = {PC : gdb .getR (PC )}
232
234
memory = {}
233
235
234
236
# save the encoded instruction
@@ -246,11 +248,11 @@ def read_operand(o):
246
248
if instruction .insn_name ().upper () in ["PUSHF" , "PUSHFD" ]:
247
249
registers ["EFLAGS" ] = gdb .getR ("EFLAGS" )
248
250
249
- if instruction .insn_name ().upper () in ["XLAT" , "XLATB" ]:
250
- registers ["AL" ] = gdb .getR ("AL" )
251
- registers [B ] = gdb .getR (B )
252
- address = registers [B ] + registers ["AL" ]
253
- memory [address ] = chr (gdb .getByte (address ))
251
+ # if instruction.insn_name().upper() in ["XLAT", "XLATB"]:
252
+ # registers["AL"] = gdb.getR("AL")
253
+ # registers[B] = gdb.getR(B)
254
+ # address = registers[B] + registers["AL"]
255
+ # memory[address] = chr(gdb.getByte(address))
254
256
255
257
if instruction .insn_name ().upper () in ["BTC" , "BTR" , "BTS" , "BT" ]:
256
258
if instruction .operands [0 ].type == X86_OP_MEM :
@@ -310,34 +312,34 @@ def read_operand(o):
310
312
# registers[reg_name] = gdb.getR(reg_name)
311
313
312
314
reg_sizes = {
313
- X86_REG_AH : X86_REG_AX ,
314
- X86_REG_AL : X86_REG_AX ,
315
- X86_REG_AX : X86_REG_EAX ,
316
- X86_REG_EAX : X86_REG_RAX ,
317
- X86_REG_RAX : X86_REG_INVALID ,
318
- X86_REG_BH : X86_REG_BX ,
319
- X86_REG_BL : X86_REG_BX ,
320
- X86_REG_BX : X86_REG_EBX ,
321
- X86_REG_EBX : X86_REG_RBX ,
322
- X86_REG_RBX : X86_REG_INVALID ,
323
- X86_REG_CH : X86_REG_CX ,
324
- X86_REG_CL : X86_REG_CX ,
325
- X86_REG_CX : X86_REG_ECX ,
326
- X86_REG_ECX : X86_REG_RCX ,
327
- X86_REG_RCX : X86_REG_INVALID ,
328
- X86_REG_DH : X86_REG_DX ,
329
- X86_REG_DL : X86_REG_DX ,
330
- X86_REG_DX : X86_REG_EDX ,
331
- X86_REG_EDX : X86_REG_RDX ,
332
- X86_REG_RDX : X86_REG_INVALID ,
333
- X86_REG_DIL : X86_REG_EDI ,
334
- X86_REG_DI : X86_REG_EDI ,
335
- X86_REG_EDI : X86_REG_RDI ,
336
- X86_REG_RDI : X86_REG_INVALID ,
337
- X86_REG_SIL : X86_REG_ESI ,
338
- X86_REG_SI : X86_REG_ESI ,
339
- X86_REG_ESI : X86_REG_RSI ,
340
- X86_REG_RSI : X86_REG_INVALID ,
315
+ csr . X86_REG_AH : csr . X86_REG_AX ,
316
+ csr . X86_REG_AL : csr . X86_REG_AX ,
317
+ csr . X86_REG_AX : csr . X86_REG_EAX ,
318
+ csr . X86_REG_EAX : csr . X86_REG_RAX ,
319
+ csr . X86_REG_RAX : csr . X86_REG_INVALID ,
320
+ csr . X86_REG_BH : csr . X86_REG_BX ,
321
+ csr . X86_REG_BL : csr . X86_REG_BX ,
322
+ csr . X86_REG_BX : csr . X86_REG_EBX ,
323
+ csr . X86_REG_EBX : csr . X86_REG_RBX ,
324
+ csr . X86_REG_RBX : csr . X86_REG_INVALID ,
325
+ csr . X86_REG_CH : csr . X86_REG_CX ,
326
+ csr . X86_REG_CL : csr . X86_REG_CX ,
327
+ csr . X86_REG_CX : csr . X86_REG_ECX ,
328
+ csr . X86_REG_ECX : csr . X86_REG_RCX ,
329
+ csr . X86_REG_RCX : csr . X86_REG_INVALID ,
330
+ csr . X86_REG_DH : csr . X86_REG_DX ,
331
+ csr . X86_REG_DL : csr . X86_REG_DX ,
332
+ csr . X86_REG_DX : csr . X86_REG_EDX ,
333
+ csr . X86_REG_EDX : csr . X86_REG_RDX ,
334
+ csr . X86_REG_RDX : csr . X86_REG_INVALID ,
335
+ csr . X86_REG_DIL : csr . X86_REG_EDI ,
336
+ csr . X86_REG_DI : csr . X86_REG_EDI ,
337
+ csr . X86_REG_EDI : csr . X86_REG_RDI ,
338
+ csr . X86_REG_RDI : csr . X86_REG_INVALID ,
339
+ csr . X86_REG_SIL : csr . X86_REG_ESI ,
340
+ csr . X86_REG_SI : csr . X86_REG_ESI ,
341
+ csr . X86_REG_ESI : csr . X86_REG_RSI ,
342
+ csr . X86_REG_RSI : csr . X86_REG_INVALID ,
341
343
}
342
344
# There is a capstone branch that should fix all these annoyances... soon
343
345
# https://github.com/aquynh/capstone/tree/next
@@ -387,7 +389,7 @@ def read_operand(o):
387
389
registers [reg_name ] = gdb .getR (reg_name )
388
390
address += o .mem .scale * registers [reg_name ]
389
391
address = address & ({"i386" : 0xFFFFFFFF , "amd64" : 0xFFFFFFFFFFFFFFFF }[arch ])
390
- for i in xrange (address , address + o .size ):
392
+ for i in range (address , address + o .size ):
391
393
memory [i ] = chr (gdb .getByte (i ))
392
394
393
395
# gather PRE info
0 commit comments