capstone.h File Reference

#include <stdarg.h>
#include <stdlib.h>
#include <stdio.h>
#include "platform.h"

Go to the source code of this file.

Classes
struct	cs_opt_mem
struct	cs_opt_mnem

Macros
#define	CAPSTONE_API
#define	CAPSTONE_EXPORT
#define	CAPSTONE_DEPRECATED
#define	CS_API_MAJOR   4
#define	CS_API_MINOR   0
#define	CS_NEXT_VERSION   5
#define	CS_VERSION_MAJOR   CS_API_MAJOR
#define	CS_VERSION_MINOR   CS_API_MINOR
#define	CS_VERSION_EXTRA   2
#define	CS_MAKE_VERSION(major, minor)   ((major << 8) + minor)
#define	CS_MNEMONIC_SIZE   32
	Maximum size of an instruction mnemonic string. More...
#define	CS_SUPPORT_DIET   (CS_ARCH_ALL + 1)
#define	CS_SUPPORT_X86_REDUCE   (CS_ARCH_ALL + 2)

Typedefs
typedef size_t	csh
typedef enum cs_arch	cs_arch
	Architecture type. More...
typedef enum cs_mode	cs_mode
	Mode type. More...
typedef void *(CAPSTONE_API *	cs_malloc_t) (size_t size)
typedef void *(CAPSTONE_API *	cs_calloc_t) (size_t nmemb, size_t size)
typedef void *(CAPSTONE_API *	cs_realloc_t) (void *ptr, size_t size)
typedef void(CAPSTONE_API *	cs_free_t) (void *ptr)
typedef int(CAPSTONE_API *	cs_vsnprintf_t) (char *str, size_t size, const char *format, va_list ap)
typedef struct cs_opt_mem	cs_opt_mem
typedef struct cs_opt_mnem	cs_opt_mnem
typedef enum cs_opt_type	cs_opt_type
	Runtime option for the disassembled engine. More...
typedef enum cs_opt_value	cs_opt_value
	Runtime option value (associated with option type above) More...
typedef enum cs_op_type	cs_op_type
	Common instruction operand types - to be consistent across all architectures. More...
typedef enum cs_ac_type	cs_ac_type
typedef enum cs_group_type	cs_group_type
	Common instruction groups - to be consistent across all architectures. More...

Enumerations
enum	cs_arch {   CS_ARCH_ARM = 0 , CS_ARCH_ARM64 , CS_ARCH_MIPS , CS_ARCH_X86 ,   CS_ARCH_PPC , CS_ARCH_SPARC , CS_ARCH_SYSZ , CS_ARCH_XCORE ,   CS_ARCH_M68K , CS_ARCH_TMS320C64X , CS_ARCH_M680X , CS_ARCH_EVM ,   CS_ARCH_MAX , CS_ARCH_ALL = 0xFFFF }
	Architecture type. More...
enum	cs_mode {   CS_MODE_LITTLE_ENDIAN = 0 , CS_MODE_ARM = 0 , CS_MODE_16 = 1 << 1 , CS_MODE_32 = 1 << 2 ,   CS_MODE_64 = 1 << 3 , CS_MODE_THUMB = 1 << 4 , CS_MODE_MCLASS = 1 << 5 , CS_MODE_V8 = 1 << 6 ,   CS_MODE_MICRO = 1 << 4 , CS_MODE_MIPS3 = 1 << 5 , CS_MODE_MIPS32R6 = 1 << 6 , CS_MODE_MIPS2 = 1 << 7 ,   CS_MODE_V9 = 1 << 4 , CS_MODE_QPX = 1 << 4 , CS_MODE_M68K_000 = 1 << 1 , CS_MODE_M68K_010 = 1 << 2 ,   CS_MODE_M68K_020 = 1 << 3 , CS_MODE_M68K_030 = 1 << 4 , CS_MODE_M68K_040 = 1 << 5 , CS_MODE_M68K_060 = 1 << 6 ,   CS_MODE_BIG_ENDIAN = 1U << 31 , CS_MODE_MIPS32 = CS_MODE_32 , CS_MODE_MIPS64 = CS_MODE_64 , CS_MODE_M680X_6301 = 1 << 1 ,   CS_MODE_M680X_6309 = 1 << 2 , CS_MODE_M680X_6800 = 1 << 3 , CS_MODE_M680X_6801 = 1 << 4 , CS_MODE_M680X_6805 = 1 << 5 ,   CS_MODE_M680X_6808 = 1 << 6 , CS_MODE_M680X_6809 = 1 << 7 , CS_MODE_M680X_6811 = 1 << 8 , CS_MODE_M680X_CPU12 = 1 << 9 ,   CS_MODE_M680X_HCS08 = 1 << 10 }
	Mode type. More...
enum	cs_opt_type {   CS_OPT_INVALID = 0 , CS_OPT_SYNTAX , CS_OPT_DETAIL , CS_OPT_MODE ,   CS_OPT_MEM , CS_OPT_SKIPDATA , CS_OPT_SKIPDATA_SETUP , CS_OPT_MNEMONIC ,   CS_OPT_UNSIGNED }
	Runtime option for the disassembled engine. More...
enum	cs_opt_value {   CS_OPT_OFF = 0 , CS_OPT_ON = 3 , CS_OPT_SYNTAX_DEFAULT = 0 , CS_OPT_SYNTAX_INTEL ,   CS_OPT_SYNTAX_ATT , CS_OPT_SYNTAX_NOREGNAME , CS_OPT_SYNTAX_MASM }
	Runtime option value (associated with option type above) More...
enum	cs_op_type {   CS_OP_INVALID = 0 , CS_OP_REG , CS_OP_IMM , CS_OP_MEM ,   CS_OP_FP }
	Common instruction operand types - to be consistent across all architectures. More...
enum	cs_ac_type { CS_AC_INVALID = 0 , CS_AC_READ = 1 << 0 , CS_AC_WRITE = 1 << 1 }
enum	cs_group_type {   CS_GRP_INVALID = 0 , CS_GRP_JUMP , CS_GRP_CALL , CS_GRP_RET ,   CS_GRP_INT , CS_GRP_IRET , CS_GRP_PRIVILEGE , CS_GRP_BRANCH_RELATIVE }
	Common instruction groups - to be consistent across all architectures. More...

Macro Definition Documentation

CAPSTONE_API

#define CAPSTONE_API

Definition at line 32 of file capstone.h.

CAPSTONE_DEPRECATED

#define CAPSTONE_DEPRECATED

Definition at line 46 of file capstone.h.

CAPSTONE_EXPORT

#define CAPSTONE_EXPORT

Definition at line 36 of file capstone.h.

CS_API_MAJOR

#define CS_API_MAJOR   4

Definition at line 50 of file capstone.h.

CS_API_MINOR

#define CS_API_MINOR   0

Definition at line 51 of file capstone.h.

CS_MAKE_VERSION

#define CS_MAKE_VERSION	(		major,
			minor
	)		((major << 8) + minor)

Macro to create combined version which can be compared to result of cs_version() API.

Definition at line 65 of file capstone.h.

CS_MNEMONIC_SIZE

#define CS_MNEMONIC_SIZE   32

Maximum size of an instruction mnemonic string.

Definition at line 68 of file capstone.h.

CS_NEXT_VERSION

#define CS_NEXT_VERSION   5

Definition at line 56 of file capstone.h.

CS_SUPPORT_DIET

#define CS_SUPPORT_DIET   (CS_ARCH_ALL + 1)

Definition at line 94 of file capstone.h.

CS_SUPPORT_X86_REDUCE

#define CS_SUPPORT_X86_REDUCE   (CS_ARCH_ALL + 2)

Definition at line 99 of file capstone.h.

CS_VERSION_EXTRA

#define CS_VERSION_EXTRA   2

Definition at line 61 of file capstone.h.

CS_VERSION_MAJOR

#define CS_VERSION_MAJOR   CS_API_MAJOR

Definition at line 59 of file capstone.h.

CS_VERSION_MINOR

#define CS_VERSION_MINOR   CS_API_MINOR

Definition at line 60 of file capstone.h.

Typedef Documentation

cs_ac_type

typedef enum cs_ac_type cs_ac_type

Common instruction operand access types - to be consistent across all architectures. It is possible to combine access types, for example: CS_AC_READ | CS_AC_WRITE

cs_arch

typedef enum cs_arch cs_arch

Architecture type.

cs_calloc_t

typedef void*(CAPSTONE_API * cs_calloc_t) (size_t nmemb, size_t size)

Definition at line 140 of file capstone.h.

cs_free_t

typedef void(CAPSTONE_API * cs_free_t) (void *ptr)

Definition at line 142 of file capstone.h.

cs_group_type

typedef enum cs_group_type cs_group_type

Common instruction groups - to be consistent across all architectures.

cs_malloc_t

typedef void*(CAPSTONE_API * cs_malloc_t) (size_t size)

Definition at line 139 of file capstone.h.

cs_mode

typedef enum cs_mode cs_mode

Mode type.

cs_op_type

typedef enum cs_op_type cs_op_type

Common instruction operand types - to be consistent across all architectures.

cs_opt_mem

typedef struct cs_opt_mem cs_opt_mem

User-defined dynamic memory related functions: malloc/calloc/realloc/free/vsnprintf() By default, Capstone uses system's malloc(), calloc(), realloc(), free() & vsnprintf().

cs_opt_mnem

typedef struct cs_opt_mnem cs_opt_mnem

Customize mnemonic for instructions with alternative name. To reset existing customized instruction to its default mnemonic, call cs_option(CS_OPT_MNEMONIC) again with the same @id and NULL value for @mnemonic.

cs_opt_type

typedef enum cs_opt_type cs_opt_type

Runtime option for the disassembled engine.

cs_opt_value

typedef enum cs_opt_value cs_opt_value

Runtime option value (associated with option type above)

cs_realloc_t

typedef void*(CAPSTONE_API * cs_realloc_t) (void *ptr, size_t size)

Definition at line 141 of file capstone.h.

cs_vsnprintf_t

typedef int(CAPSTONE_API * cs_vsnprintf_t) (char *str, size_t size, const char *format, va_list ap)

Definition at line 143 of file capstone.h.

csh

typedef size_t csh

Definition at line 71 of file capstone.h.

Enumeration Type Documentation

cs_ac_type

enum cs_ac_type

Common instruction operand access types - to be consistent across all architectures. It is possible to combine access types, for example: CS_AC_READ | CS_AC_WRITE

Enumerator
CS_AC_INVALID	Uninitialized/invalid access type.
CS_AC_READ	Operand read from memory or register.
CS_AC_WRITE	Operand write to memory or register.

Definition at line 202 of file capstone.h.

                        {
    CS_AC_INVALID = 0,        
    CS_AC_READ    = 1 << 0,   
    CS_AC_WRITE   = 1 << 1,   
} cs_ac_type;

cs_arch

enum cs_arch

Architecture type.

Enumerator
CS_ARCH_ARM	ARM architecture (including Thumb, Thumb-2)
CS_ARCH_ARM64	ARM-64, also called AArch64.
CS_ARCH_MIPS	Mips architecture.
CS_ARCH_X86	X86 architecture (including x86 & x86-64)
CS_ARCH_PPC	PowerPC architecture.
CS_ARCH_SPARC	Sparc architecture.
CS_ARCH_SYSZ	SystemZ architecture.
CS_ARCH_XCORE	XCore architecture.
CS_ARCH_M68K	68K architecture
CS_ARCH_TMS320C64X	TMS320C64x architecture.
CS_ARCH_M680X	680X architecture
CS_ARCH_EVM	Ethereum architecture.
CS_ARCH_MAX
CS_ARCH_ALL

Definition at line 74 of file capstone.h.

                     {
    CS_ARCH_ARM = 0,    
    CS_ARCH_ARM64,      
    CS_ARCH_MIPS,       
    CS_ARCH_X86,        
    CS_ARCH_PPC,        
    CS_ARCH_SPARC,      
    CS_ARCH_SYSZ,       
    CS_ARCH_XCORE,      
    CS_ARCH_M68K,       
    CS_ARCH_TMS320C64X, 
    CS_ARCH_M680X,      
    CS_ARCH_EVM,        
    CS_ARCH_MAX,
    CS_ARCH_ALL = 0xFFFF, // All architectures - for cs_support()
} cs_arch;

cs_group_type

enum cs_group_type

Common instruction groups - to be consistent across all architectures.

Enumerator
CS_GRP_INVALID	uninitialized/invalid group.
CS_GRP_JUMP	all jump instructions (conditional+direct+indirect jumps)
CS_GRP_CALL	all call instructions
CS_GRP_RET	all return instructions
CS_GRP_INT	all interrupt instructions (int+syscall)
CS_GRP_IRET	all interrupt return instructions
CS_GRP_PRIVILEGE	all privileged instructions
CS_GRP_BRANCH_RELATIVE	all relative branching instructions

Definition at line 209 of file capstone.h.

                           {
    CS_GRP_INVALID = 0,  
    CS_GRP_JUMP,    
    CS_GRP_CALL,    
    CS_GRP_RET,     
    CS_GRP_INT,     
    CS_GRP_IRET,    
    CS_GRP_PRIVILEGE,    
    CS_GRP_BRANCH_RELATIVE, 
} cs_group_type;

cs_mode

enum cs_mode

Mode type.

Enumerator
CS_MODE_LITTLE_ENDIAN	little-endian mode (default mode)
CS_MODE_ARM	32-bit ARM
CS_MODE_16	16-bit mode (X86)
CS_MODE_32	32-bit mode (X86)
CS_MODE_64	64-bit mode (X86, PPC)
CS_MODE_THUMB	ARM's Thumb mode, including Thumb-2.
CS_MODE_MCLASS	ARM's Cortex-M series.
CS_MODE_V8	ARMv8 A32 encodings for ARM.
CS_MODE_MICRO	MicroMips mode (MIPS)
CS_MODE_MIPS3	Mips III ISA.
CS_MODE_MIPS32R6	Mips32r6 ISA.
CS_MODE_MIPS2	Mips II ISA.
CS_MODE_V9	SparcV9 mode (Sparc)
CS_MODE_QPX	Quad Processing eXtensions mode (PPC)
CS_MODE_M68K_000	M68K 68000 mode.
CS_MODE_M68K_010	M68K 68010 mode.
CS_MODE_M68K_020	M68K 68020 mode.
CS_MODE_M68K_030	M68K 68030 mode.
CS_MODE_M68K_040	M68K 68040 mode.
CS_MODE_M68K_060	M68K 68060 mode.
CS_MODE_BIG_ENDIAN	big-endian mode
CS_MODE_MIPS32	Mips32 ISA (Mips)
CS_MODE_MIPS64	Mips64 ISA (Mips)
CS_MODE_M680X_6301	M680X Hitachi 6301,6303 mode.
CS_MODE_M680X_6309	M680X Hitachi 6309 mode.
CS_MODE_M680X_6800	M680X Motorola 6800,6802 mode.
CS_MODE_M680X_6801	M680X Motorola 6801,6803 mode.
CS_MODE_M680X_6805	M680X Motorola/Freescale 6805 mode.
CS_MODE_M680X_6808	M680X Motorola/Freescale/NXP 68HC08 mode.
CS_MODE_M680X_6809	M680X Motorola 6809 mode.
CS_MODE_M680X_6811	M680X Motorola/Freescale/NXP 68HC11 mode.
CS_MODE_M680X_CPU12	used on M68HC12/HCS12 M680X Motorola/Freescale/NXP CPU12
CS_MODE_M680X_HCS08	M680X Freescale/NXP HCS08 mode.

Definition at line 102 of file capstone.h.

                     {
    CS_MODE_LITTLE_ENDIAN = 0,  
    CS_MODE_ARM = 0,    
    CS_MODE_16 = 1 << 1,    
    CS_MODE_32 = 1 << 2,    
    CS_MODE_64 = 1 << 3,    
    CS_MODE_THUMB = 1 << 4, 
    CS_MODE_MCLASS = 1 << 5,    
    CS_MODE_V8 = 1 << 6,    
    CS_MODE_MICRO = 1 << 4, 
    CS_MODE_MIPS3 = 1 << 5, 
    CS_MODE_MIPS32R6 = 1 << 6, 
    CS_MODE_MIPS2 = 1 << 7, 
    CS_MODE_V9 = 1 << 4, 
    CS_MODE_QPX = 1 << 4, 
    CS_MODE_M68K_000 = 1 << 1, 
    CS_MODE_M68K_010 = 1 << 2, 
    CS_MODE_M68K_020 = 1 << 3, 
    CS_MODE_M68K_030 = 1 << 4, 
    CS_MODE_M68K_040 = 1 << 5, 
    CS_MODE_M68K_060 = 1 << 6, 
    CS_MODE_BIG_ENDIAN = 1U << 31,  
    CS_MODE_MIPS32 = CS_MODE_32,    
    CS_MODE_MIPS64 = CS_MODE_64,    
    CS_MODE_M680X_6301 = 1 << 1, 
    CS_MODE_M680X_6309 = 1 << 2, 
    CS_MODE_M680X_6800 = 1 << 3, 
    CS_MODE_M680X_6801 = 1 << 4, 
    CS_MODE_M680X_6805 = 1 << 5, 
    CS_MODE_M680X_6808 = 1 << 6, 
    CS_MODE_M680X_6809 = 1 << 7, 
    CS_MODE_M680X_6811 = 1 << 8, 
    CS_MODE_M680X_CPU12 = 1 << 9, 
    CS_MODE_M680X_HCS08 = 1 << 10, 
} cs_mode;

cs_op_type

enum cs_op_type

Common instruction operand types - to be consistent across all architectures.

Enumerator
CS_OP_INVALID	uninitialized/invalid operand.
CS_OP_REG	Register operand.
CS_OP_IMM	Immediate operand.
CS_OP_MEM	Memory operand.
CS_OP_FP	Floating-Point operand.

Definition at line 192 of file capstone.h.

                        {
    CS_OP_INVALID = 0,  
    CS_OP_REG,          
    CS_OP_IMM,          
    CS_OP_MEM,          
    CS_OP_FP,           
} cs_op_type;

cs_opt_type

enum cs_opt_type

Runtime option for the disassembled engine.

Enumerator
CS_OPT_INVALID	No option specified.
CS_OPT_SYNTAX	Assembly output syntax.
CS_OPT_DETAIL	Break down instruction structure into details.
CS_OPT_MODE	Change engine's mode at run-time.
CS_OPT_MEM	User-defined dynamic memory related functions.
CS_OPT_SKIPDATA	Skip data when disassembling. Then engine is in SKIPDATA mode.
CS_OPT_SKIPDATA_SETUP	Setup user-defined function for SKIPDATA option.
CS_OPT_MNEMONIC	Customize instruction mnemonic.
CS_OPT_UNSIGNED	print immediate operands in unsigned form

Definition at line 168 of file capstone.h.

                         {
    CS_OPT_INVALID = 0, 
    CS_OPT_SYNTAX,  
    CS_OPT_DETAIL,  
    CS_OPT_MODE,    
    CS_OPT_MEM, 
    CS_OPT_SKIPDATA, 
    CS_OPT_SKIPDATA_SETUP, 
    CS_OPT_MNEMONIC, 
    CS_OPT_UNSIGNED, 
} cs_opt_type;

cs_opt_value

enum cs_opt_value

Runtime option value (associated with option type above)

Enumerator
CS_OPT_OFF	Turn OFF an option - default for CS_OPT_DETAIL, CS_OPT_SKIPDATA, CS_OPT_UNSIGNED.
CS_OPT_ON	Turn ON an option (CS_OPT_DETAIL, CS_OPT_SKIPDATA).
CS_OPT_SYNTAX_DEFAULT	Default asm syntax (CS_OPT_SYNTAX).
CS_OPT_SYNTAX_INTEL	X86 Intel asm syntax - default on X86 (CS_OPT_SYNTAX).
CS_OPT_SYNTAX_ATT	X86 ATT asm syntax (CS_OPT_SYNTAX).
CS_OPT_SYNTAX_NOREGNAME	Prints register name with only number (CS_OPT_SYNTAX)
CS_OPT_SYNTAX_MASM	X86 Intel Masm syntax (CS_OPT_SYNTAX).

Definition at line 181 of file capstone.h.

                          {
    CS_OPT_OFF = 0,  
    CS_OPT_ON = 3, 
    CS_OPT_SYNTAX_DEFAULT = 0, 
    CS_OPT_SYNTAX_INTEL, 
    CS_OPT_SYNTAX_ATT,   
    CS_OPT_SYNTAX_NOREGNAME, 
    CS_OPT_SYNTAX_MASM, 
} cs_opt_value;