Buffer containing raw binary code to be disassembled
Address of the first instruction in given raw code buffer
An input range over the disassembled instructions
auto CODE = cast(ubyte[])"\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x00\x91\x92"; auto cs = new CapstoneX86(ModeFlags(Mode.bit32)); // Initialise x86 32bit engine auto range = cs.disasmIter(CODE, 0x1000); // Disassemble one instruction at a time, offsetting addresses by 0x1000 assert("%s %s".format(range.front.mnemonic, range.front.opStr) == "lea ecx, dword ptr [edx + esi + 8]"); range.popFront; assert("%s %s".format(range.front.mnemonic, range.front.opStr) == "add eax, ebx"); range.popFront; assert("%s %s".format(range.front.mnemonic, range.front.opStr) == "add esi, 0x1234"); range.popFront; assert(range.empty);
Provides a range to iteratively disassemble binary code - one instruction at a time
Fast API to disassemble binary code, given the code buffer and start address. Provides access to only one disassembled instruction at a time, resulting in a smaller memory footprint.