Function _toNative()

InsnType Native instruction struct.


Convert JavaScript object to native struct.

Source
Object.defineProperty(CsInsn.prototype, "_toNative", {
    "value" : function () {
        if (this._nativeInsn) {
            return this._nativeInsn;
        }

        // Convert arch number to string
        var archStr = exports.ARCH.toString(this.arch);

        var insn = new InsnType();

        insn.id.set(this.id);
        insn.address.set(this.address);
        insn.size.set(this.bytes.length);

        new Buffer(this.bytes).copy(insn.bytes);

        insn.mnemonic.writeCString(0, this.mnemonic);
        insn.op_str.writeCString(0, this.op_str);

        if (this.detail) {
            insn.detail = ref.alloc(DetailType);
            var detail = insn.detail.deref();

            detail.regs_read.buffer.fill(0);
            detail.regs_write.buffer.fill(0);
            detail.groups.buffer.fill(0);

            new Buffer(this.detail.regs_read).copy(detail.regs_read.buffer);
            new Buffer(this.detail.regs_write).copy(detail.regs_write.buffer);
            new Buffer(this.detail.groups).copy(detail.groups.buffer);

            detail.regs_read_count.set(this.detail.regs_read.length);
            detail.regs_write_count.set(this.detail.regs_write.length);
            detail.groups_count.set(this.detail.groups.length);

            detail.arch[archStr]._load(this.detail[archStr]);
        }

        Object.defineProperty(this, "_nativeInsn", {
            "get" : function () {
                return insn;
            }
        });

        return insn;
    }
});

Function INSN_OFFSET(insns, pos)

Number Instruction offset.


Arg Name Type Description
insns CsInsn[]

Array of instructions.

pos Number

Position.

Calculate the offset of a disassembled instruction in its buffer,
given its position in its array of disassembled insn

NOTE: this macro works with position >= 1, not index

Source
exports.INSN_OFFSET = function (insns, pos) {
    return insns[pos - 1].address - insns[0].address;
};

Function version()

Number[] Three-element array containing: [ combined, major, minor ]


Retrieve version number from the Capstone library.

var version = capstone.version();
console.log(
    "combined: 0x%s, version: %s",
    version[0].toString(16), version.slice(1).join(".")
);
//> combined: 0x201, version: 2.1
Source
exports.version = function () {
    var major = ref.alloc("int");
    var minor = ref.alloc("int");
    var combined = capstone.cs_version(major, minor);
    return [ combined, major.deref(), minor.deref() ];
};

Function version_bind()

Number[] Three-element array containing: [ combined, major, minor ]


Retrieve version number from the JavaScript bindings.

var version = capstone.version();
console.log(
    "combined: 0x%s, version: %s",
    version[0].toString(16), version.slice(1).join(".")
);
//> combined: 0x201, version: 2.1
Source
exports.version_bind = function () {
    return [ VERSION[0] << 8 | VERSION[1], VERSION[0], VERSION[1] ];
};

Function support(query)

Boolean True if Capstone supports the given arch or support.


Arg Name Type Description
query ARCH, SUPPORT

Architecture or Support query.

Query Capstone for supported architectures.

console.log(capstone.support(capstone.ARCH_ALL)); //> true
console.log(capstone.support(capstone.SUPPORT_DIET)); //> false
Source
exports.support = capstone.cs_support;

Function strerror(code)

String Error description


Arg Name Type Description
code ERR

Error code

Return a string describing the given error code.

console.log(capstone.strerror(capstone.ERR_DETAIL));
Source
exports.strerror = capstone.cs_strerror;

Function close()


Free allocated memory for this Capstone instance. This must be called when
the Capstone instance is no longer needed. DO NOT let the Capstone instance
get garbage collected until this method has been called.

Source
exports.Cs.prototype.close = function () {
    var errno = capstone.cs_close(this.csh);
    if (errno) {
        throw "cs_close returned " + errno + ": " + exports.strerror(errno);
    }
};

Function errno()

ERR Error code


Report last error when a Capstone API function fails.

Source
exports.Cs.prototype.errno = function () {
    return capstone.cs_errno(this.csh.deref());
};

Function disasm(buffer, addr, [max=0])

CsInsn[] Array of instructions.


Arg Name Type Description
buffer Buffer

Binary to disassemble.

addr Number

Starting address for the given buffer.

[max=0] Number

Max number of instructions to disassemble.

Disassemble the binary contained in a Buffer.

Source
exports.Cs.prototype.disasm = function (buffer, addr, max) {
    var insn = ref.alloc(new ArrayType(InsnType));

    var count = capstone.cs_disasm(
        this.csh.deref(),
        buffer,
        buffer.length,
        addr,
        max || 0,
        insn
    );
    if (!count) {
        var errno = this.errno();
        throw "cs_disasm returned " + errno + ": " + exports.strerror(errno);
    }

    // Get instruction array, and fix length
    var insns = insn.deref();
    insns.length = count;

    // Create a JavaScript view of the instruction array
    var instructions = [];
    for (var i = 0; i < count; i++) {
        instructions.push(new CsInsn(insns[i], this.arch));
    }

    // Free the native instruction array
    capstone.cs_free(insns.buffer, count);

    return instructions;
};

Function disasm_lite(buffer, addr, [max=0])

Array[] Instruction arrays: [ address, size, mnemonic, op_str ]


Arg Name Type Description
buffer Buffer

Binary to disassemble.

addr Number

Starting address for the given buffer.

[max=0] Number

Max number of instructions to disassemble.

Disassemble the binary contained in a Buffer, with a lightweight API.

Source
exports.Cs.prototype.disasm_lite = function (buffer, addr, max) {
    var insn = ref.alloc(new ArrayType(InsnType));

    var count = capstone.cs_disasm(
        this.csh.deref(),
        buffer,
        buffer.length,
        addr,
        max || 0,
        insn
    );
    if (!count) {
        var errno = this.errno();
        throw "cs_disasm_lite returned " + errno + ": " +
            exports.strerror(errno);
    }

    // Get instruction array, and fix length
    var insns = insn.deref();
    insns.length = count;

    // Create a JavaScript view of the instruction array
    var instructions = [];
    for (var i = 0; i < count; i++) {
        instructions.push([
            insns[i].address,
            insns[i].size,
            insns[i].mnemonic.buffer.readCString(0),
            insns[i].op_str.buffer.readCString(0)
        ]);
    }

    // Free the native instruction array
    capstone.cs_free(insns.buffer, count);

    return instructions;
};

Function disasm_iter(buffer, addr, insn)

Boolean True if successfully disassembled one instruction.


Arg Name Type Description
buffer Buffer

Binary to disassemble.

addr Number

Starting address for the given buffer.

insn CsInsn

Disassembled instruction detail.

Disassemble the binary contained in a Buffer, with the iterator API.

Source
exports.Cs.prototype.disasm_iter = function () { //(iter, callback) {
    // TODO
    // `iter` is a dictionary that the iterator will update
    // `callback` is called for each iteration, receiving the CsInsn
    // Will need to interally allocate a cs_insn buffer for this method
};

Function reg_name(id)

String Register name, or null on error


Arg Name Type Description
id Number

Register ID

Return register name as a string for given register ID.

Source
exports.Cs.prototype.reg_name = function (id) {
    return capstone.cs_reg_name(this.csh.deref(), id);
};

Function insn_name(id)

String Instruction name, or null on error


Arg Name Type Description
id Number

Instruction ID

Return instruction name as a string for given instruction ID.

Source
exports.Cs.prototype.insn_name = function (id) {
    return capstone.cs_insn_name(this.csh.deref(), id);
};

Function insn_group(insn, id)

Boolean True if the instruction belongs to the given group.


Arg Name Type Description
insn CsInsn

Instruction

id Number

Group ID

Check if a disassembled instruction belongs to a particular group.

NOTE: this API is only valid when detail option is ON (OFF by default)

Source
exports.Cs.prototype.insn_group = function (insn, id) {
    return capstone.cs_insn_group(this.csh.deref(), insn._toNative(), id);
};

Function reg_read(insn, id)

Boolean True if the instruction reads the given register.


Arg Name Type Description
insn CsInsn

Instruction

id Number

Register ID

Check if a disassembled instruction IMPLICITLY reads a particular register.

NOTE: this API is only valid when detail option is ON (OFF by default)

Source
exports.Cs.prototype.reg_read = function (insn, id) {
    return capstone.cs_reg_read(this.csh.deref(), insn._toNative(), id);
};

Function reg_write(insn, id)

Boolean True if the instruction writes the given register.


Arg Name Type Description
insn CsInsn

Instruction

id Number

Register ID

Check if a disassembled instruction IMPLICITLY writes a particular register.

NOTE: this API is only valid when detail option is ON (OFF by default)

Source
exports.Cs.prototype.reg_write = function (insn, id) {
    return capstone.cs_reg_write(this.csh.deref(), insn._toNative(), id);
};

Function op_count(insn, op_type)

Number Number of operands, or -1 on failure.


Arg Name Type Description
insn CsInsn

Instruction

op_type Number

Operand type to be found.

Count the number of operands with a particular type for an instruction.

NOTE: this API is only valid when detail option is ON (OFF by default)

Source
exports.Cs.prototype.op_count = function (insn, op_type) {
    return capstone.cs_op_count(this.csh.deref(), insn._toNative(), op_type);
};

Function op_index(insn, op_type, position)

Number Number of operands, or -1 on failure.


Arg Name Type Description
insn CsInsn

Instruction

op_type Number

Operand type to be found.

position Number

Position of the operand to be found.

Retrieve position of the operand of given type in disassembled instruction.

position must be in range: [1, n] where n == Cs.op_count(insn, op_type)

NOTE: this API is only valid when detail option is ON (OFF by default)

Source
exports.Cs.prototype.op_index = function (insn, op_type, position) {
    return capstone.cs_op_index(
        this.csh.deref(),
        insn._toNative(),
        op_type,
        position
    );
};

Function REL_ADDR(insn)

Number Instruction address


Arg Name Type Description
insn CsInsn

Instruction

Calculate relative address for X86_64, for the given CsInsn structure.

Source
exports.REL_ADDR = function (insn) {
    return insn.address + insn.size + insn.detail.arch.x86.disp;
};