Capstone.disasm

Disassemble binary code, given the code buffer, start address and number of instructions to be decoded

class Capstone

abstract

const(Instruction)[]

disasm

const

(

in ubyte[] code

in ulong address

in size_t count = 0

)

Parameters

code: Type: ubyte[]
Buffer containing raw binary code to be disassembled
address: Type: ulong
Address of the first instruction in given raw code buffer
count: Type: size_t
Number of instructions to be disassembled, or 0 to get all of them

Return Value

Type: const(Instruction)[]

The successfully disassembled instructions

Examples

1 auto CODE = cast(ubyte[])"\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x00\x91\x92";
2 auto cs = new CapstoneX86(ModeFlags(Mode.bit32)); // Initialise x86 32bit engine
3 auto res = cs.disasm(CODE, 0x1000);               // Disassemble, offsetting addresses by 0x1000
4 assert("%s %s".format(res[0].mnemonic, res[0].opStr) == "lea ecx, dword ptr [edx + esi + 8]");
5 assert("%s %s".format(res[1].mnemonic, res[1].opStr) == "add eax, ebx");
6 assert("%s %s".format(res[2].mnemonic, res[2].opStr) == "add esi, 0x1234");

Capstone.disasm

Parameters

Return Value

Examples

Meta

Source