VERSION 5.00
Object = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}#2.0#0"; "mscomctl.ocx"
Begin VB.Form Form1 
   Caption         =   "Keystone Assembler Engine VB6 Bindings - Contributed by FireEye FLARE team"
   ClientHeight    =   4680
   ClientLeft      =   60
   ClientTop       =   345
   ClientWidth     =   10860
   LinkTopic       =   "Form1"
   ScaleHeight     =   4680
   ScaleWidth      =   10860
   StartUpPosition =   2  'CenterScreen
   Begin VB.CommandButton Command1 
      Caption         =   "Copy"
      Height          =   375
      Left            =   4680
      TabIndex        =   1
      Top             =   4200
      Width           =   1695
   End
   Begin MSComctlLib.ListView lv 
      Height          =   3975
      Left            =   120
      TabIndex        =   0
      Top             =   120
      Width           =   10695
      _ExtentX        =   18865
      _ExtentY        =   7011
      View            =   3
      LabelEdit       =   1
      LabelWrap       =   -1  'True
      HideSelection   =   -1  'True
      FullRowSelect   =   -1  'True
      GridLines       =   -1  'True
      _Version        =   393217
      ForeColor       =   -2147483640
      BackColor       =   -2147483643
      BorderStyle     =   1
      Appearance      =   1
      NumItems        =   3
      BeginProperty ColumnHeader(1) {BDD1F052-858B-11D1-B16A-00C0F0283628} 
         Text            =   "arch"
         Object.Width           =   5292
      EndProperty
      BeginProperty ColumnHeader(2) {BDD1F052-858B-11D1-B16A-00C0F0283628} 
         SubItemIndex    =   1
         Text            =   "asm"
         Object.Width           =   5292
      EndProperty
      BeginProperty ColumnHeader(3) {BDD1F052-858B-11D1-B16A-00C0F0283628} 
         SubItemIndex    =   2
         Text            =   "bytes"
         Object.Width           =   14111
      EndProperty
   End
End
Attribute VB_Name = "Form1"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Option Explicit

'Keystone Assembly Engine bindings for VB6
'Contributed by FireEye FLARE Team
'Author:  David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
'License: Apache
'Copyright: FireEye 2017

'NOTE: the VB code was built and tested against the latest binary release: Keystone 0.9.1
'      I will enabled the symbol resolver once it makes it into the stable release

Private Sub Form_Load()
    
    Const base As Long = 0 '&H1000
    
    initDll
    If hLib <> 0 Then Me.Caption = Me.Caption & " - loaded KeyStone v" & version
    
    'MsgBox err2str(KS_ERR_ASM_SYMBOL_MISSING)
    
    ' X86
    'AddResult test_ks(KS_ARCH_X86, KS_MODE_32, "jmp 0x2000; nop; nop;", 0, base)
    AddResult test_ks(KS_ARCH_X86, KS_MODE_16, "add eax, ecx", 0, base)
    AddResult test_ks(KS_ARCH_X86, KS_MODE_32, "add eax, ecx", 0, base)
    AddResult test_ks(KS_ARCH_X86, KS_MODE_64, "add rax, rcx", 0, base)
    AddResult test_ks(KS_ARCH_X86, KS_MODE_32, "add %ecx, %eax", KS_OPT_SYNTAX_ATT, base)
    AddResult test_ks(KS_ARCH_X86, KS_MODE_64, "add %rcx, %rax", KS_OPT_SYNTAX_ATT, base)

    ' ARM
    AddResult test_ks(KS_ARCH_ARM, KS_MODE_ARM, "sub r1, r2, r5", 0, base)
    AddResult test_ks(KS_ARCH_ARM, KS_MODE_ARM + KS_MODE_BIG_ENDIAN, "sub r1, r2, r5", 0, base)
    AddResult test_ks(KS_ARCH_ARM, KS_MODE_THUMB, "movs r4, #0xf0", 0, base)
    AddResult test_ks(KS_ARCH_ARM, KS_MODE_THUMB + KS_MODE_BIG_ENDIAN, "movs r4, #0xf0", 0, base)

    ' ARM64
    AddResult test_ks(KS_ARCH_ARM64, KS_MODE_LITTLE_ENDIAN, "ldr w1, [sp, #0x8]", 0, base)

    ' Hexagon
    AddResult test_ks(KS_ARCH_HEXAGON, KS_MODE_BIG_ENDIAN, "v23.w=vavg(v11.w,v2.w):rnd", 0, base)

    ' Mips
    AddResult test_ks(KS_ARCH_MIPS, KS_MODE_MIPS32, "and $9, $6, $7", 0)
    AddResult test_ks(KS_ARCH_MIPS, KS_MODE_MIPS32 + KS_MODE_BIG_ENDIAN, "and $9, $6, $7", 0, base)
    AddResult test_ks(KS_ARCH_MIPS, KS_MODE_MIPS64, "and $9, $6, $7", 0)
    AddResult test_ks(KS_ARCH_MIPS, KS_MODE_MIPS64 + KS_MODE_BIG_ENDIAN, "and $9, $6, $7", 0, base)

    ' PowerPC
    AddResult test_ks(KS_ARCH_PPC, KS_MODE_PPC32 + KS_MODE_BIG_ENDIAN, "add 1, 2, 3", 0, base)
    AddResult test_ks(KS_ARCH_PPC, KS_MODE_PPC64, "add 1, 2, 3", 0)
    AddResult test_ks(KS_ARCH_PPC, KS_MODE_PPC64 + KS_MODE_BIG_ENDIAN, "add 1, 2, 3", 0, base)

    ' Sparc
    AddResult test_ks(KS_ARCH_SPARC, KS_MODE_SPARC32 + KS_MODE_LITTLE_ENDIAN, "add %g1, %g2, %g3", 0, base)
    AddResult test_ks(KS_ARCH_SPARC, KS_MODE_SPARC32 + KS_MODE_BIG_ENDIAN, "add %g1, %g2, %g3", 0, base)

    ' SystemZ
    AddResult test_ks(KS_ARCH_SYSTEMZ, KS_MODE_BIG_ENDIAN, "a %r0, 4095(%r15,%r1)", 0, base)
    
    ' symbol resolver test (will enable once in stable release binaries not tested yet)
    'AddResult test_ks(KS_ARCH_X86, KS_MODE_32, "jmp _l1; nop", 0, , base, True)
    
End Sub


Public Function test_ks(arch As ks_arch, mode As ks_mode, assembly As String, Optional syntax As ks_opt_type = 0, Optional base As Long = 0, Optional withResolver As Boolean = False) As CAsmResult
    
    Dim r As New CAsmResult
    Dim buf As Long, size As Long, count As Long, b() As Byte
    Dim hKeystone As Long
    Dim address As Currency
    
    Set test_ks = r
    
    If hLib = 0 Then initDll r
    If hLib = 0 Then Exit Function
    
    r.arch = arch
    r.mode = mode
    r.syntax = syntax
    r.source = assembly
    
    If ks_arch_supported(arch) = 0 Then
        r.errMsg = "specified architecture not supported"
        Exit Function
    End If
    
    r.lastErr = ks_open(arch, mode, hKeystone)
    If r.lastErr <> KS_ERR_OK Then
        r.errMsg = err2str(r.lastErr)
        Exit Function
    End If

    'If withResolver Then setResolver hKeystone, AddressOf vbSymResolver
    If syntax <> 0 Then Call ks_option(hKeystone, KS_OPT_SYNTAX, syntax)
    
    address = lng2Cur(base)
    r.lastErr = ks_asm(hKeystone, assembly, address, buf, size, count)
    
    If r.lastErr = KS_ERR_OK Then
        ReDim b(size - 1)
        CopyMemory ByVal VarPtr(b(0)), ByVal buf, size
        ks_free buf
        r.result = b()
        r.count = count
        r.size = size
    End If
    
    ks_close hKeystone
    
End Function

Function AddResult(r As CAsmResult)
    
    Dim li As ListItem
    
    Set li = lv.ListItems.Add(, , ks_arch2str(r.arch))
    li.SubItems(1) = r.source
    If r.hadErr Then
        li.SubItems(2) = "Error: " & r.errMsg
    Else
        li.SubItems(2) = b2Str(r.result)
    End If
    Set li.Tag = r
    
End Function

Private Sub Command1_Click()
    Clipboard.Clear
    Clipboard.SetText GetAllElements(lv)
End Sub