Buffer containing raw binary code to be disassembled
Address of the first instruction in given raw code buffer
An input range over the disassembled instructions
1 auto CODE = cast(ubyte[])"\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x00\x91\x92"; 2 auto cs = new CapstoneX86(ModeFlags(Mode.bit32)); // Initialise x86 32bit engine 3 auto range = cs.disasmIter(CODE, 0x1000); // Disassemble one instruction at a time, offsetting addresses by 0x1000 4 assert("%s %s".format(range.front.mnemonic, range.front.opStr) == "lea ecx, dword ptr [edx + esi + 8]"); 5 range.popFront; 6 assert("%s %s".format(range.front.mnemonic, range.front.opStr) == "add eax, ebx"); 7 range.popFront; 8 assert("%s %s".format(range.front.mnemonic, range.front.opStr) == "add esi, 0x1234"); 9 range.popFront; 10 assert(range.empty);
Provides a range to iteratively disassemble binary code - one instruction at a time
Fast API to disassemble binary code, given the code buffer and start address. Provides access to only one disassembled instruction at a time, resulting in a smaller memory footprint.