Linux capstone 反汇编引擎使用方法

最进在研究反汇编引擎，在google看到capstone反汇编工具，据说是IDA都使用了capstone的引擎，记录一下；
capstone 官方网站：http://www.capstone-engine.org/
github源码下载：https://github.com/aquynh/capstone
capstone在架构兼容性上来说是非常丰富了：Multi-architectures: Arm, Arm64 (Armv8), BPF, Ethereum Virtual Machine, M68K, M680X, Mips, MOS65XX, PowerPC, RISCV, Sparc, SystemZ, TMS320C64X, Web Assembly, XCore & X86 (include X86_64)

1.实测解码的速率并不是很快（原因是printf直接把信息往外丢，去掉prinf直接写文件14M内存bin文件耗时5s左右，甚至比intel-xed还快）；
2.需要使用动态内存，从代码实现来看，传入文件多大就需要申请多大的内存，还要给disam buffer分配内存；
3.代码架构比较复杂，改造成本还是比较高；

下载源码之后：

//解压文件
curtis@curtis-virtual-machine:~/Desktop$ unzip capstone-master.zip

//编译文件
curtis@curtis-virtual-machine:~/Desktop/capstone-master$ ./make.sh
.........省略..........
make[1]: Leaving directory `/home/curtis/Desktop/capstone-master/tests'
make -C suite/fuzz
make[1]: Entering directory `/home/curtis/Desktop/capstone-master/suite/fuzz'
  CC      fuzz_disasm.o
  CC      drivermc.o
  CC      driverbin.o
  LINK    fuzz_disasm
  LINK    fuzz_bindisasm
make[1]: Leaving directory `/home/curtis/Desktop/capstone-master/suite/fuzz'
install -m0755 ./libcapstone.so.5 ./tests/
cd ./tests/ && rm -f libcapstone.so && ln -s libcapstone.so.5 libcapstone.so

//安装引擎，创建文件夹，把对应的库安装好，安装cstool工具
curtis@curtis-virtual-machine:~/Desktop/capstone-master$ sudo ./make.sh install
mkdir -p /usr/lib
install -m0755 ./libcapstone.so.5 /usr/lib
cd /usr/lib && rm -f libcapstone.so && ln -s libcapstone.so.5 libcapstone.so
install -m0644 ./libcapstone.a /usr/lib
mkdir -p /usr/include/capstone
install -m0644 include/capstone/*.h /usr/include/capstone
mkdir -p /usr/lib/pkgconfig
install -m0644 ./capstone.pc /usr/lib/pkgconfig
mkdir -p /usr/bin
install -m0755 cstool/cstool /usr/bin

//capstone so&a 库大小
curtis@curtis-virtual-machine:/usr/lib$ ls -alh | grep capstone
-rw-r--r--   1 root root     5.7M 10月 26 17:57 libcapstone.a
lrwxrwxrwx   1 root root       16 10月 26 17:57 libcapstone.so -> libcapstone.so.5
-rwxr-xr-x   1 root root     4.4M 10月 26 17:57 libcapstone.so.5

//输出ins.asm大小
curtis@curtis-virtual-machine:~/Desktop$ ls -alh | grep ins.asm
-rwxr-xr-x  1 curtis curtis 395M 10月 28 10:40 ins.asm

//卸载capstone
curtis@curtis-virtual-machine:~/Desktop/capstone-master$ sudo ./make.sh uninstall
[sudo] password for curtis: 
rm -rf /usr/include/capstone
rm -f /usr/lib/libcapstone.*
rm -f /usr/lib/pkgconfig/capstone.pc
rm -f /usr/bin/cstool

这里先讲讲cstool工具的具体使用方法；

curtis@curtis-virtual-machine:~/Desktop/capstone-master$ cstool
Cstool for Capstone Disassembler Engine v5.0.0

Syntax: cstool [-u|-d|-s|-v] <arch+mode> <assembly-hexstring> [start-address-in-hex-format]

The following <arch+mode> options are supported:
        x16         16-bit mode (X86)
        x32         32-bit mode (X86)
        x64         64-bit mode (X86)
        x16att      16-bit mode (X86), syntax AT&T
        x32att      32-bit mode (X86), syntax AT&T
        x64att      64-bit mode (X86), syntax AT&T
        arm         arm
        armbe       arm + big endian
        thumb       thumb mode
        thumbbe     thumb + big endian
        cortexm     thumb + cortex-m extensions
        arm64       aarch64 mode
        arm64be     aarch64 + big endian
        mips        mips32 + little endian
        mipsbe      mips32 + big endian
        mips64      mips64 + little endian
        mips64be    mips64 + big endian
        ppc64       ppc64 + little endian
        ppc64be     ppc64 + big endian
        sparc       sparc
        systemz     systemz (s390x)
        xcore       xcore
        m68k        m68k + big endian
        m68k40      m68k_040
        tms320c64x  TMS320C64x
        m6800       M6800/2
        m6801       M6801/3
        m6805       M6805
        m6808       M68HC08
        m6809       M6809
        m6811       M68HC11
        cpu12       M68HC12/HCS12
        hd6301      HD6301/3
        hd6309      HD6309
        hcs08       HCS08
        evm         Ethereum Virtual Machine
        mos65xx     MOS65XX family

Extra options:
        -d show detailed information of the instructions
        -u show immediates as unsigned
        -s decode in SKIPDATA mode
        -v show version & Capstone core build info

再看看REME中的具体实施例；

$cstool x32 "90 91"

也就是选择好cstool参数之后输入需要反汇汇编的编码；

//举个例子，想要看x86_64编码所对应的汇编代码：
488d 2551 3f60 01e8 d400 0000 488d 3ded ffff ff56 e8d7 0100 005e 4805 0060 f203 eb20 0f1f 4000 662e 0f1f 8400 0000 0000 e8ab 0000 0056 e8c5 1f00 005e 4805 00a0
curtis@curtis-virtual-machine:~/Desktop/capstone-master/cstool$ cstool -u x64 "488d 2551 3f60 01e8 d400 0000 488d 3ded ffff ff56 e8d7 0100 005e 4805 0060 f203 eb20 0f1f 4000 662e 0f1f 8400 0000 0000 e8ab 0000 0056 e8c5 1f00 005e 4805 00a0"
 0  48 8d 25 51 3f 60 01                             lea	rsp, [rip + 0x1603f51]
 7  e8 d4 00 00 00                                   call	0xe0
 c  48 8d 3d ed ff ff ff                             lea	rdi, [rip - 0x13]
13  56                                               push	rsi
14  e8 d7 01 00 00                                   call	0x1f0
19  5e                                               pop	rsi
1a  48 05 00 60 f2 03                                add	rax, 0x3f26000
20  eb 20                                            jmp	0x42
22  0f 1f 40 00                                      nop	dword ptr [rax]
26  66 2e 0f 1f 84 00 00 00 00 00                    nop	word ptr cs:[rax + rax]
30  e8 ab 00 00 00                                   call	0xe0
35  56                                               push	rsi
36  e8 c5 1f 00 00                                   call	0x2000
3b  5e                                               pop	rsi
//成功反汇编出汇编代码

使用intel-xed反汇编同一编码；

curtis@curtis-virtual-machine:~/Desktop$ cat 11.txt | head -n 14
XDIS 0: MISC      BASE       488D25513F6001           lea rsp, ptr [rip+0x1603f51]
XDIS 7: CALL      BASE       E8D4000000               call 0xe0
XDIS c: MISC      BASE       488D3DEDFFFFFF           lea rdi, ptr [rip-0x13]
XDIS 13: PUSH      BASE       56                       push rsi
XDIS 14: CALL      BASE       E8D7010000               call 0x1f0
XDIS 19: POP       BASE       5E                       pop rsi
XDIS 1a: BINARY    BASE       48050060F203             add rax, 0x3f26000
XDIS 20: UNCOND_BR BASE       EB20                     jmp 0x42
XDIS 22: WIDENOP   BASE       0F1F4000                 nop dword ptr [rax], eax
XDIS 26: WIDENOP   BASE       662E0F1F840000000000     nop word ptr [rax+rax*1], ax
XDIS 30: CALL      BASE       E8AB000000               call 0xe0
XDIS 35: PUSH      BASE       56                       push rsi
XDIS 36: CALL      BASE       E8C51F0000               call 0x2000
XDIS 3b: POP       BASE       5E                       pop rsi

1.打算添加两个功能，将传入code的参数改为传入文件的路径，反汇编时只需要传入文件路径即可；
2.添加输出参数，将反汇编代码写入文件；
3.添加一个参数，只要传入内存地址即可把该地址前后10条汇编指令打印出来；

功能一已经实现，代码就不公开了，效果如下：

curtis@curtis-virtual-machine:~/Desktop/capstone-master/cstool$ ./cstool -u x64 "/home/curtis/Desktop/ins.txt"
 0  0f 1f 44 00 00                                   nop	dword ptr [rax + rax]
 5  55                                               push	rbp
 6  48 89 e5                                         mov	rbp, rsp
 9  5d                                               pop	rbp
 a  c3                                               ret	
 b  0f 1f 44 00 00                                   nop	dword ptr [rax + rax]

功能二已经实现，代码就不公开了，效果如下：

//命令
curtis@curtis-virtual-machine:~/Desktop/capstone-master/cstool$ ./cstool -u x64 "/home/curtis/Desktop/ins.txt" -o "/home/curtis/Desktop/ins.asm"
//效果，成功将内容写入文件
curtis@curtis-virtual-machine:~/Desktop/capstone-master/cstool$ cat /home/curtis/Desktop/ins.asm 
0x 0   48 8d 25 51 3f 60 01                           lea	rsp, [rip + 0x1603f51]
0x 7   e8 d4 00 00 00                                 call	0xe0
0x c   48 8d 3d ed ff ff ff                           lea	rdi, [rip - 0x13]
0x13   56                                             push	rsi
0x14   e8 d7 01 00 00                                 call	0x1f0
0x19   5e                                             pop	rsi
0x1a   48 05 00 60 b2 1e                              add	rax, 0x1eb26000
0x20   eb 20                                          jmp	0x42
0x22   0f 1f 40 00                                    nop	dword ptr [rax]

在实现这个功能的过程中发现如果使用-u参数的话，从添加log打印，代码已经限定count的值位312，那么如果你传入参数size大于312条汇编指令的话，剩余部分没有进行反汇编操作，仔细研究capstone代码之后，我们应该使用-s参数进行反汇编；

curtis@curtis-virtual-machine:~/Desktop/capstone-master/cstool$ ./cstool -s x64 "/home/curtis/Desktop/ins.txt"
0x 0   48 8d 25 51 3f 60 01                           lea	rsp, [rip + 0x1603f51]
0x 7   e8 d4 00 00 00                                 call	0xe0
0x c   48 8d 3d ed ff ff ff                           lea	rdi, [rip - 0x13]
0x13   56                                             push	rsi
0x14   e8 d7 01 00 00                                 call	0x1f0
0x19   5e                                             pop	rsi
0x1a   48 05 00 60 b2 1e                              add	rax, 0x1eb26000
0x20   eb 20                                          jmp	0x42
0x22   0f 1f 40 00                                    nop	dword ptr [rax]
.......省略.........
0x447b4  e8 27 2d 03 00                               call	0x774e0
0x447b9  66 90                                        nop	
0x447bb  41 83 fc 02                                  cmp	r12d, 2
0x447bf  0f 8e 6f ff ff ff                            jle	0x44734
0x447c5  48 8d 7b 18                                  lea	rdi, [rbx + 0x18]
0x447c9  e8 d2 fd ff ff                               call	0x445a0
0x447ce  e9 61 ff ff ff                               jmp	0x44734
0x447d3  48 8b 05 12 e1 7f 01                         mov	rax, qword ptr [rip + 0x17fe112]