Capstone

Encapsulates an instance of the Capstone dissassembly engine

This class encapsulates the core functionality of the Capstone disassembly engine, providing access to runtime options for

changing the Mode of interpretation
changing the Syntax of the disassembly
choosing whether Instruction's should be disassembled in detail, i.e. filling Instruction.detail
defining manual handling of broken instructions through the SKIPDATA mode of operation (optionally via a Callback)

Note that, since the architecture is chosen at runtime, this base class only provides access to the architecture-indepentent aspects, e.g. disasm returns Instructions instead of X86Instructions. However, if necessary, it can be casted to the architecture-specific variant, such as CapstoneX86.

abstract

class Capstone {

Handle handle;

ModeFlags _mode;

Syntax _syntax;

bool _detail;

bool _skipData;

string mnemonic;

Callback callback;

string[int] customMnemonics;

Arch arch;

auto mode [@property getter];

ModeFlags mode [@property setter];

auto syntax [@property getter];

Syntax syntax [@property setter];

auto detail [@property getter];

bool detail [@property setter];

auto skipData [@property getter];

bool skipData [@property setter];

void setupSkipdata(in string mnemonic = ".byte", Callback callback = null);

const(Instruction)[] disasm(in ubyte[] code, in ulong address, in size_t count = 0);

InstructionRange disasmIter(in ubyte[] code, in ulong address);

}

Destructor

A destructor is present on this object, but not explicitly documented in the source.

Members

Functions

disasm const(Instruction)[] disasm(in ubyte[] code, in ulong address, in size_t count = 0): Disassemble binary code, given the code buffer, start address and number of instructions to be decoded
disasmIter InstructionRange disasmIter(in ubyte[] code, in ulong address): Provides a range to iteratively disassemble binary code - one instruction at a time
setupSkipdata void setupSkipdata(in string mnemonic = ".byte", Callback callback = null): Customises behaviour in SKIPDATA mode of operation

Properties

detail auto detail [@property getter]: Indicates whether instructions will be disassembled in detail
detail bool detail [@property setter]: Sets whether instructions will be disassembled in detail
mode auto mode [@property getter]: Gets the mode of interpretation
mode ModeFlags mode [@property setter]: Sets the mode of interpretation
skipData auto skipData [@property getter]: Indicates whether SKIPDATA mode of operation is in use
skipData bool skipData [@property setter]: Sets whether to use SKIPDATA mode of operation
syntax auto syntax [@property getter]: Gets the disassembly syntax variant
syntax Syntax syntax [@property setter]: Sets the disassembly syntax variant

Variables

arch Arch arch;: The architecture this Capstone instance is set up for