winappdbg.disasm.CapstoneEngine

Class CapstoneEngine

Integration with the Capstone disassembler by Nguyen Anh Quynh.

Instance Methods

[hide private]

_import_dependencies(self)
Loads the dependencies for this disassembler.

source code

list of tuple( long, int, str, str )

decode(self, address, code)
Returns: List of tuples.

source code

__init__(self, arch=None)
x.__init__(...) initializes x; see help(type(x)) for signature (Inherited from winappdbg.disasm.Engine)

source code

str

_validate_arch(self, arch=None)
Returns: Name of the processor architecture. (Inherited from winappdbg.disasm.Engine)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables

[hide private]

str

name = 'Capstone'
Engine name to use with the Disassembler class.

str

desc = 'Capstone disassembler by Nguyen Anh Quynh'
User friendly name of the disassembler engine.

str

url = 'http://www.capstone-engine.org/'
Download URL.

set(str)

supported = set(['amd64', 'arm', 'arm64', 'i386', 'thumb'])
Set of supported processor architectures.

Instance Variables

[hide private]

str

arch
Name of the processor architecture. (Inherited from winappdbg.disasm.Engine)

Properties

[hide private]

Inherited from object: __class__

_import_dependencies(self)

source code

Loads the dependencies for this disassembler.

Raises:

ImportError - This disassembler cannot find or load the necessary dependencies to make it work.

Overrides: Engine._import_dependencies

(inherited documentation)

decode(self, address, code)

source code

Parameters:

address - Memory address where the code was read from.
code - Machine code to disassemble.

Returns: list of tuple( long, int, str, str )

List of tuples. Each tuple represents an assembly instruction and contains:

Memory address of instruction.
Size of instruction in bytes.
Disassembly line of instruction.
Hexadecimal dump of instruction.

Raises:

NotImplementedError - This disassembler could not be loaded. This may be due to missing dependencies.

Overrides: Engine.decode

(inherited documentation)