Capstone.disasm

Disassemble binary code, given the code buffer, start address and number of instructions to be decoded

class Capstone

abstract const

const(Instruction)[]

disasm

(

in ubyte[] code

in ulong address

in size_t count = 0

)

Parameters

code ubyte[]: Buffer containing raw binary code to be disassembled
address ulong: Address of the first instruction in given raw code buffer
count size_t: Number of instructions to be disassembled, or 0 to get all of them

Return Value

Type: const(Instruction)[]

The successfully disassembled instructions

Examples

auto CODE = cast(ubyte[])"\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x00\x91\x92";
auto cs = new CapstoneX86(ModeFlags(Mode.bit32)); // Initialise x86 32bit engine
auto res = cs.disasm(CODE, 0x1000);               // Disassemble, offsetting addresses by 0x1000
assert("%s %s".format(res[0].mnemonic, res[0].opStr) == "lea ecx, dword ptr [edx + esi + 8]");
assert("%s %s".format(res[1].mnemonic, res[1].opStr) == "add eax, ebx");
assert("%s %s".format(res[2].mnemonic, res[2].opStr) == "add esi, 0x1234");

Capstone.disasm

Parameters

Return Value

Examples

Meta

Source