You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
500 lines
16 KiB
500 lines
16 KiB
3 years ago
|
<#
|
||
|
|
.SYNOPSIS
|
||
|
|
Get Capstone version as Version object
|
||
|
|
#>
|
||
|
|
function Get-CapstoneVersion {
|
||
|
|
$Version = [System.BitConverter]::GetBytes(
|
||
|
|
[Capstone]::cs_version($null, $null)
|
||
|
|
)
|
||
|
|
|
||
|
|
New-Object -TypeName version -ArgumentList @(
|
||
|
|
$Version[1]
|
||
|
|
$Version[0]
|
||
|
|
0
|
||
|
|
0
|
||
|
|
)
|
||
|
|
}
|
||
|
|
|
||
|
|
<#
|
||
|
|
.SYNOPSIS
|
||
|
|
Create C# bindings for capstone.dll
|
||
|
|
|
||
|
|
.PARAMETER DllPath
|
||
|
|
Path to capstone.dll
|
||
|
|
#>
|
||
|
|
function Initialize-Capstone {
|
||
|
|
[CmdletBinding()]
|
||
|
|
Param (
|
||
|
|
[Parameter(Mandatory = $true)]
|
||
|
|
[ValidateScript( {
|
||
|
|
try {
|
||
|
|
Test-Path -Path $_ -PathType Leaf -ErrorAction Stop
|
||
|
|
} catch {
|
||
|
|
throw "Capstone DLL is missing: $DllPath"
|
||
|
|
}
|
||
|
|
})]
|
||
|
|
[ValidateNotNullOrEmpty()]
|
||
|
|
[string]$DllPath
|
||
|
|
)
|
||
|
|
|
||
|
|
# Escape path for use in inline C#
|
||
|
|
$DllPath = $DllPath.Replace('\', '\\')
|
||
|
|
|
||
|
|
# Inline C# to parse the unmanaged capstone DLL
|
||
|
|
# http://stackoverflow.com/questions/16552801/how-do-i-conditionally-add-a-class-with-add-type-typedefinition-if-it-isnt-add
|
||
|
|
if (-not ([System.Management.Automation.PSTypeName]'Capstone').Type) {
|
||
|
|
Add-Type -TypeDefinition @"
|
||
|
|
using System;
|
||
|
|
using System.Diagnostics;
|
||
|
|
using System.Runtime.InteropServices;
|
||
|
|
using System.Security.Principal;
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct cs_insn
|
||
|
|
{
|
||
|
|
public uint id;
|
||
|
|
public ulong address;
|
||
|
|
public ushort size;
|
||
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 24)]
|
||
|
|
public byte[] bytes;
|
||
|
|
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 32)]
|
||
|
|
public string mnemonic;
|
||
|
|
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 160)]
|
||
|
|
public string operands;
|
||
|
|
public IntPtr detail;
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Partial, only architecture-independent internal data
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct cs_detail
|
||
|
|
{
|
||
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
|
||
|
|
public byte[] regs_read;
|
||
|
|
public byte regs_read_count;
|
||
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 20)]
|
||
|
|
public byte[] regs_write;
|
||
|
|
public byte regs_write_count;
|
||
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
|
||
|
|
public byte[] groups;
|
||
|
|
public byte groups_count;
|
||
|
|
}
|
||
|
|
|
||
|
|
public enum cs_err : int
|
||
|
|
{
|
||
|
|
CS_ERR_OK = 0, /// No error: everything was fine
|
||
|
|
CS_ERR_MEM, /// Out-Of-Memory error: cs_open(), cs_disasm(), cs_disasm_iter()
|
||
|
|
CS_ERR_ARCH, /// Unsupported architecture: cs_open()
|
||
|
|
CS_ERR_HANDLE, /// Invalid handle: cs_op_count(), cs_op_index()
|
||
|
|
CS_ERR_CSH, /// Invalid csh argument: cs_close(), cs_errno(), cs_option()
|
||
|
|
CS_ERR_MODE, /// Invalid/unsupported mode: cs_open()
|
||
|
|
CS_ERR_OPTION, /// Invalid/unsupported option: cs_option()
|
||
|
|
CS_ERR_DETAIL, /// Information is unavailable because detail option is OFF
|
||
|
|
CS_ERR_MEMSETUP, /// Dynamic memory management uninitialized (see CS_OPT_MEM)
|
||
|
|
CS_ERR_VERSION, /// Unsupported version (bindings)
|
||
|
|
CS_ERR_DIET, /// Access irrelevant data in "diet" engine
|
||
|
|
CS_ERR_SKIPDATA, /// Access irrelevant data for "data" instruction in SKIPDATA mode
|
||
|
|
CS_ERR_X86_ATT, /// X86 AT&T syntax is unsupported (opt-out at compile time)
|
||
|
|
CS_ERR_X86_INTEL, /// X86 Intel syntax is unsupported (opt-out at compile time)
|
||
|
|
}
|
||
|
|
public enum cs_arch : int
|
||
|
|
{
|
||
|
|
CS_ARCH_ARM = 0, /// ARM architecture (including Thumb, Thumb-2)
|
||
|
|
CS_ARCH_ARM64, /// ARM-64, also called AArch64
|
||
|
|
CS_ARCH_MIPS, /// Mips architecture
|
||
|
|
CS_ARCH_X86, /// X86 architecture (including x86 & x86-64)
|
||
|
|
CS_ARCH_PPC, /// PowerPC architecture
|
||
|
|
CS_ARCH_SPARC, /// Sparc architecture
|
||
|
|
CS_ARCH_SYSZ, /// SystemZ architecture
|
||
|
|
CS_ARCH_XCORE, /// XCore architecture
|
||
|
|
CS_ARCH_MAX,
|
||
|
|
CS_ARCH_ALL = 0xFFFF, /// All architectures - for cs_support()
|
||
|
|
}
|
||
|
|
public enum cs_mode : int
|
||
|
|
{
|
||
|
|
CS_MODE_LITTLE_ENDIAN = 0, /// little-endian mode (default mode)
|
||
|
|
CS_MODE_ARM = 0, /// 32-bit ARM
|
||
|
|
CS_MODE_16 = 1 << 1, /// 16-bit mode (X86)
|
||
|
|
CS_MODE_32 = 1 << 2, /// 32-bit mode (X86)
|
||
|
|
CS_MODE_64 = 1 << 3, /// 64-bit mode (X86, PPC)
|
||
|
|
CS_MODE_THUMB = 1 << 4, /// ARM's Thumb mode, including Thumb-2
|
||
|
|
CS_MODE_MCLASS = 1 << 5, /// ARM's Cortex-M series
|
||
|
|
CS_MODE_V8 = 1 << 6, /// ARMv8 A32 encodings for ARM
|
||
|
|
CS_MODE_MICRO = 1 << 4, /// MicroMips mode (MIPS)
|
||
|
|
CS_MODE_MIPS3 = 1 << 5, /// Mips III ISA
|
||
|
|
CS_MODE_MIPS32R6 = 1 << 6, /// Mips32r6 ISA
|
||
|
|
CS_MODE_MIPSGP64 = 1 << 7, /// General Purpose Registers are 64-bit wide (MIPS)
|
||
|
|
CS_MODE_V9 = 1 << 4, /// SparcV9 mode (Sparc)
|
||
|
|
CS_MODE_BIG_ENDIAN = 1 << 31, /// big-endian mode
|
||
|
|
CS_MODE_MIPS32 = CS_MODE_32, /// Mips32 ISA (Mips)
|
||
|
|
CS_MODE_MIPS64 = CS_MODE_64, /// Mips64 ISA (Mips)
|
||
|
|
}
|
||
|
|
|
||
|
|
public static class Capstone
|
||
|
|
{
|
||
|
|
[DllImport("$DllPath")]
|
||
|
|
public static extern cs_err cs_open(
|
||
|
|
cs_arch arch,
|
||
|
|
cs_mode mode,
|
||
|
|
ref IntPtr handle);
|
||
|
|
|
||
|
|
[DllImport("$DllPath")]
|
||
|
|
public static extern UInt32 cs_disasm(
|
||
|
|
IntPtr handle,
|
||
|
|
byte[] code,
|
||
|
|
int code_size,
|
||
|
|
ulong address,
|
||
|
|
int count,
|
||
|
|
ref IntPtr insn);
|
||
|
|
|
||
|
|
[DllImport("$DllPath")]
|
||
|
|
public static extern bool cs_free(
|
||
|
|
IntPtr insn,
|
||
|
|
int count);
|
||
|
|
|
||
|
|
[DllImport("$DllPath")]
|
||
|
|
public static extern cs_err cs_close(
|
||
|
|
ref IntPtr handle);
|
||
|
|
|
||
|
|
[DllImport("$DllPath")]
|
||
|
|
public static extern cs_err cs_option(
|
||
|
|
IntPtr handle,
|
||
|
|
int type,
|
||
|
|
int value);
|
||
|
|
|
||
|
|
[DllImport("$DllPath", CallingConvention = CallingConvention.Cdecl)]
|
||
|
|
public static extern IntPtr cs_reg_name(
|
||
|
|
IntPtr handle,
|
||
|
|
uint reg_id);
|
||
|
|
|
||
|
|
[DllImport("$DllPath")]
|
||
|
|
public static extern int cs_version(
|
||
|
|
uint major,
|
||
|
|
uint minor);
|
||
|
|
}
|
||
|
|
"@
|
||
|
|
} else {
|
||
|
|
Write-Verbose 'C# bindings are already compiled'
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
function Get-CapstoneDisassembly {
|
||
|
|
<#
|
||
|
|
.SYNOPSIS
|
||
|
|
Powershell wrapper for Capstone (using inline C#).
|
||
|
|
|
||
|
|
.DESCRIPTION
|
||
|
|
Author: Ruben Boonen (@FuzzySec), @beatcracker
|
||
|
|
License: BSD 3-Clause
|
||
|
|
Required Dependencies: None
|
||
|
|
Optional Dependencies: None
|
||
|
|
|
||
|
|
.PARAMETER Architecture
|
||
|
|
Architecture type.
|
||
|
|
|
||
|
|
.PARAMETER Mode
|
||
|
|
Mode type.
|
||
|
|
|
||
|
|
.PARAMETER Bytes
|
||
|
|
Byte array to be disassembled.
|
||
|
|
|
||
|
|
.PARAMETER Syntax
|
||
|
|
Syntax for output assembly.
|
||
|
|
|
||
|
|
.PARAMETER Address
|
||
|
|
Assign address for the first instruction to be disassembled.
|
||
|
|
|
||
|
|
.PARAMETER Detailed
|
||
|
|
Return detailed output.
|
||
|
|
|
||
|
|
.PARAMETER Version
|
||
|
|
Print ASCII version banner.
|
||
|
|
|
||
|
|
.EXAMPLE
|
||
|
|
|
||
|
|
C:\PS> $Bytes = [byte[]] @( 0x10, 0xf1, 0x10, 0xe7, 0x11, 0xf2, 0x31, 0xe7, 0xdc, 0xa1, 0x2e, 0xf3, 0xe8, 0x4e, 0x62, 0xf3 )
|
||
|
|
C:\PS> Get-CapstoneDisassembly -Architecture CS_ARCH_ARM -Mode CS_MODE_ARM -Bytes $Bytes
|
||
|
|
|
||
|
|
Address : 0x100000
|
||
|
|
Instruction : sdiv r0, r0, r1
|
||
|
|
|
||
|
|
Address : 0x100004
|
||
|
|
Instruction : udiv r1, r1, r2
|
||
|
|
|
||
|
|
Address : 0x100008
|
||
|
|
Instruction : vbit q5, q15, q6
|
||
|
|
|
||
|
|
Address : 0x10000C
|
||
|
|
Instruction : vcgt.f32 q10, q9, q12
|
||
|
|
|
||
|
|
.EXAMPLE
|
||
|
|
|
||
|
|
# Detailed mode & ATT syntax
|
||
|
|
C:\PS> $Bytes = [byte[]] @( 0xB8, 0x0A, 0x00, 0x00, 0x00, 0xF7, 0xF3 )
|
||
|
|
C:\PS> Get-CapstoneDisassembly -Architecture CS_ARCH_X86 -Mode CS_MODE_32 -Bytes $Bytes -Syntax ATT -Detailed
|
||
|
|
|
||
|
|
Address : 0x100000
|
||
|
|
Mnemonic : movl
|
||
|
|
Operands : $0xa, %eax
|
||
|
|
Bytes : {184, 10, 0, 0...}
|
||
|
|
Size : 5
|
||
|
|
RegRead :
|
||
|
|
RegWrite :
|
||
|
|
|
||
|
|
Address : 0x100005
|
||
|
|
Mnemonic : divl
|
||
|
|
Operands : %ebx
|
||
|
|
Bytes : {247, 243}
|
||
|
|
Size : 2
|
||
|
|
RegRead : {eax, edx}
|
||
|
|
RegWrite : {eax, edx, eflags}
|
||
|
|
|
||
|
|
.EXAMPLE
|
||
|
|
|
||
|
|
# Get-CapstoneDisassembly emits objects
|
||
|
|
C:\PS> $Bytes = [byte[]] @( 0xB8, 0x0A, 0x00, 0x00, 0x00, 0xF7, 0xF3 )
|
||
|
|
C:\PS> $Object = Get-CapstoneDisassembly -Architecture CS_ARCH_X86 -Mode CS_MODE_32 -Bytes $Bytes -Detailed
|
||
|
|
C:\PS> $Object | Select-Object -Property Size, Mnemonic, Operands
|
||
|
|
|
||
|
|
Size Mnemonic Operands
|
||
|
|
---- -------- --------
|
||
|
|
5 mov eax, 0xa
|
||
|
|
2 div ebx
|
||
|
|
#>
|
||
|
|
[CmdletBinding(DefaultParameterSetName = 'Capstone')]
|
||
|
|
Param (
|
||
|
|
[Parameter(ParameterSetName = 'Capstone', Mandatory = $true)]
|
||
|
|
[ValidateSet(
|
||
|
|
'CS_ARCH_ARM',
|
||
|
|
'CS_ARCH_ARM64',
|
||
|
|
'CS_ARCH_MIPS',
|
||
|
|
'CS_ARCH_X86',
|
||
|
|
'CS_ARCH_PPC',
|
||
|
|
'CS_ARCH_SPARC',
|
||
|
|
'CS_ARCH_SYSZ',
|
||
|
|
'CS_ARCH_XCORE',
|
||
|
|
'CS_ARCH_MAX',
|
||
|
|
'CS_ARCH_ALL'
|
||
|
|
)]
|
||
|
|
[string]$Architecture,
|
||
|
|
|
||
|
|
[Parameter(ParameterSetName = 'Capstone', Mandatory = $true)]
|
||
|
|
[ValidateSet(
|
||
|
|
'CS_MODE_LITTLE_ENDIAN',
|
||
|
|
'CS_MODE_ARM',
|
||
|
|
'CS_MODE_16',
|
||
|
|
'CS_MODE_32',
|
||
|
|
'CS_MODE_64',
|
||
|
|
'CS_MODE_THUMB',
|
||
|
|
'CS_MODE_MCLASS',
|
||
|
|
'CS_MODE_V8',
|
||
|
|
'CS_MODE_MICRO',
|
||
|
|
'CS_MODE_MIPS3',
|
||
|
|
'CS_MODE_MIPS32R6',
|
||
|
|
'CS_MODE_MIPSGP64',
|
||
|
|
'CS_MODE_V9',
|
||
|
|
'CS_MODE_BIG_ENDIAN',
|
||
|
|
'CS_MODE_MIPS32',
|
||
|
|
'CS_MODE_MIPS64'
|
||
|
|
)]
|
||
|
|
[string]$Mode,
|
||
|
|
|
||
|
|
[Parameter(ParameterSetName = 'Capstone', Mandatory = $true)]
|
||
|
|
[ValidateNotNullOrEmpty()]
|
||
|
|
[byte[]]$Bytes,
|
||
|
|
|
||
|
|
[Parameter(ParameterSetName = 'Capstone')]
|
||
|
|
[ValidateSet(
|
||
|
|
'Intel',
|
||
|
|
'ATT'
|
||
|
|
)]
|
||
|
|
[string]$Syntax = 'Intel',
|
||
|
|
|
||
|
|
[Parameter(ParameterSetName = 'Capstone')]
|
||
|
|
[uint64]$Address = 0x100000,
|
||
|
|
|
||
|
|
[Parameter(ParameterSetName = 'Capstone')]
|
||
|
|
[switch]$Detailed,
|
||
|
|
|
||
|
|
[Parameter(ParameterSetName = 'Version')]
|
||
|
|
[switch]$Version
|
||
|
|
)
|
||
|
|
|
||
|
|
if ($Version) {
|
||
|
|
$Banner = @'
|
||
|
|
|
||
|
|
(((;
|
||
|
|
(; "((((\
|
||
|
|
;((((((; "((((;
|
||
|
|
((((""\(((( "((((
|
||
|
|
((((" ((\ "(((( "(((\
|
||
|
|
;(((/ ((((((( "(((( \(((
|
||
|
|
((((" (((* "(((( \(((;"(((\
|
||
|
|
((((";((("/(( \(((;"(((\"(((\
|
||
|
|
(((( (((( ((((" "(((\ ((() (((\
|
||
|
|
;((("(((( (((* **"" ((()"(((;
|
||
|
|
(((" ((( (((( ((((((((((((((:*(((
|
||
|
|
(((( (((*)((( ********"""" ;;(((((;
|
||
|
|
(((* ((( (((((((((((((((((((((*"" (
|
||
|
|
((("(((( """***********"""" ;;(((((
|
||
|
|
"" (((((((((((((((((((((((((((*""
|
||
|
|
"""****(((((****"""
|
||
|
|
|
||
|
|
-=[Capstone Engine v{0}]=-
|
||
|
|
|
||
|
|
'@ -f (Get-CapstoneVersion).ToString(2)
|
||
|
|
# Mmm ASCII version banner!
|
||
|
|
return $Banner
|
||
|
|
}
|
||
|
|
|
||
|
|
# Disasm Handle
|
||
|
|
$DisAsmHandle = [System.IntPtr]::Zero
|
||
|
|
|
||
|
|
# Initialize Capstone with cs_open()
|
||
|
|
$CallResult = [Capstone]::cs_open($Architecture, $Mode, [ref]$DisAsmHandle)
|
||
|
|
if ($CallResult -ne 'CS_ERR_OK') {
|
||
|
|
if ($CallResult -eq 'CS_ERR_MODE') {
|
||
|
|
throw "Invalid Architecture/Mode combination: $Architecture/$Mode"
|
||
|
|
} else {
|
||
|
|
throw "cs_open error: $CallResult"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Set disassembly syntax
|
||
|
|
#---
|
||
|
|
# cs_opt_type -> CS_OPT_SYNTAX = 1
|
||
|
|
#---
|
||
|
|
# cs_opt_value -> CS_OPT_SYNTAX_INTEL = 1
|
||
|
|
# -> CS_OPT_SYNTAX_ATT = 2
|
||
|
|
if ($Syntax -eq 'Intel') {
|
||
|
|
$CS_OPT_SYNTAX = 1
|
||
|
|
} else {
|
||
|
|
$CS_OPT_SYNTAX = 2
|
||
|
|
}
|
||
|
|
|
||
|
|
$CallResult = [Capstone]::cs_option($DisAsmHandle, 1, $CS_OPT_SYNTAX)
|
||
|
|
if ($CallResult -ne 'CS_ERR_OK') {
|
||
|
|
$CallResult = [Capstone]::cs_close([ref]$DisAsmHandle)
|
||
|
|
throw "cs_option error: $CallResult"
|
||
|
|
}
|
||
|
|
|
||
|
|
# Set disassembly detail
|
||
|
|
#---
|
||
|
|
# cs_opt_type -> CS_OPT_DETAIL = 2
|
||
|
|
#---
|
||
|
|
# cs_opt_value -> CS_OPT_ON = 3
|
||
|
|
# -> CS_OPT_OFF = 0
|
||
|
|
if ($Detailed) {
|
||
|
|
$CS_OPT = 3
|
||
|
|
} else {
|
||
|
|
$CS_OPT = 0
|
||
|
|
}
|
||
|
|
|
||
|
|
$CallResult = [Capstone]::cs_option($DisAsmHandle, 2, $CS_OPT)
|
||
|
|
if ($CallResult -ne 'CS_ERR_OK') {
|
||
|
|
$CallResult = [Capstone]::cs_close([ref]$DisAsmHandle)
|
||
|
|
throw "cs_option error: $CallResult"
|
||
|
|
}
|
||
|
|
|
||
|
|
# Out Buffer Handle
|
||
|
|
$InsnHandle = [System.IntPtr]::Zero
|
||
|
|
|
||
|
|
# Disassemble bytes
|
||
|
|
$Count = [Capstone]::cs_disasm($DisAsmHandle, $Bytes, $Bytes.Count, $Address, 0, [ref]$InsnHandle)
|
||
|
|
|
||
|
|
if ($Count -gt 0) {
|
||
|
|
# Result struct
|
||
|
|
$cs_insn = if ($PSVersionTable.PSVersion.Major -gt 2) {
|
||
|
|
[cs_insn]@{}
|
||
|
|
} else {
|
||
|
|
New-Object -TypeName cs_insn
|
||
|
|
}
|
||
|
|
|
||
|
|
$cs_insn_size = [System.Runtime.InteropServices.Marshal]::SizeOf($cs_insn)
|
||
|
|
$cs_insn = $cs_insn.GetType()
|
||
|
|
|
||
|
|
# Result detail struct
|
||
|
|
$cs_detail = if ($PSVersionTable.PSVersion.Major -gt 2) {
|
||
|
|
[cs_detail]@{}
|
||
|
|
} else {
|
||
|
|
New-Object -TypeName cs_detail
|
||
|
|
}
|
||
|
|
$cs_detail = $cs_detail.GetType()
|
||
|
|
|
||
|
|
# Result buffer offset
|
||
|
|
$BuffOffset = $InsnHandle.ToInt64()
|
||
|
|
|
||
|
|
for ($i = 0 ; $i -lt $Count ; $i++) {
|
||
|
|
# Cast Offset to cs_insn
|
||
|
|
$Cast = [System.Runtime.InteropServices.Marshal]::PtrToStructure([System.Intptr]$BuffOffset, [type]$cs_insn)
|
||
|
|
|
||
|
|
if ($CS_OPT -eq 0) {
|
||
|
|
$Disassembly = @{
|
||
|
|
Address = $Cast.address
|
||
|
|
Instruction = '{0} {1}' -f $Cast.mnemonic, $Cast.operands
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($PSVersionTable.PSVersion.Major -gt 2) {
|
||
|
|
# Add TypeName for PS formatting and output result
|
||
|
|
$Disassembly.PSTypeName ='CapstoneDisassembly.Simple'
|
||
|
|
[pscustomobject]$Disassembly
|
||
|
|
} else {
|
||
|
|
$Disassembly = New-Object -TypeName PSObject -Property $Disassembly
|
||
|
|
# Add TypeName for PS formatting and output result
|
||
|
|
$Disassembly.PSObject.TypeNames.Insert(0, 'CapstoneDisassembly.Simple')
|
||
|
|
$Disassembly
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
$DetailCast = [System.Runtime.InteropServices.Marshal]::PtrToStructure($Cast.detail, [type]$cs_detail)
|
||
|
|
if ($DetailCast.regs_read_count -gt 0) {
|
||
|
|
$RegRead = for ($r = 0 ; $r -lt $DetailCast.regs_read_count ; $r++) {
|
||
|
|
$NamePointer = [Capstone]::cs_reg_name($DisAsmHandle, $DetailCast.regs_read[$r])
|
||
|
|
[System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($NamePointer)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($DetailCast.regs_write_count -gt 0) {
|
||
|
|
$RegWrite = for ($r = 0 ; $r -lt $DetailCast.regs_write_count ; $r++) {
|
||
|
|
$NamePointer = [Capstone]::cs_reg_name($DisAsmHandle, $DetailCast.regs_write[$r])
|
||
|
|
[System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($NamePointer)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
$Disassembly = @{
|
||
|
|
Address = $Cast.address
|
||
|
|
Mnemonic = $Cast.mnemonic
|
||
|
|
Operands = $Cast.operands
|
||
|
|
Bytes = $Cast.bytes[0..($Cast.size - 1)]
|
||
|
|
Size = $Cast.size
|
||
|
|
RegRead = $RegRead
|
||
|
|
RegWrite = $RegWrite
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($PSVersionTable.PSVersion.Major -gt 2) {
|
||
|
|
# Add TypeName for PS formatting and output result
|
||
|
|
$Disassembly.PSTypeName = 'CapstoneDisassembly.Detailed'
|
||
|
|
[pscustomobject]$Disassembly
|
||
|
|
} else {
|
||
|
|
$Disassembly = New-Object -TypeName PSObject -Property $Disassembly
|
||
|
|
# Add TypeName for PS formatting and output result
|
||
|
|
$Disassembly.PSObject.TypeNames.Insert(0, 'CapstoneDisassembly.Detailed')
|
||
|
|
$Disassembly
|
||
|
|
}
|
||
|
|
}
|
||
|
|
$BuffOffset = $BuffOffset + $cs_insn_size
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
$CallResult = [Capstone]::cs_close([ref]$DisAsmHandle)
|
||
|
|
throw 'Disassembly Failed'
|
||
|
|
}
|
||
|
|
|
||
|
|
# Free Buffer Handle
|
||
|
|
$CallResult = [Capstone]::cs_free($InsnHandle, $Count)
|
||
|
|
}
|
||
|
|
|
||
|
|
#region Init
|
||
|
|
|
||
|
|
Initialize-Capstone -DllPath (
|
||
|
|
Join-Path -Path $PSScriptRoot -ChildPath 'Lib\Capstone\capstone.dll'
|
||
|
|
) -ErrorAction Stop
|
||
|
|
|
||
|
|
#endregion
|