55import sys
66import time
77import subprocess
8- from capstone import *
9- from capstone .x86 import *
8+ from typing import Any , Dict
9+ from capstone import Cs
10+ from capstone .x86 import CS_ARCH_X86 , CS_MODE_32 , CS_MODE_64 , X86_OP_MEM , X86_OP_REG , X86_OP_IMM
11+ import capstone .x86 as csr
1012from flags import flags
1113
1214flags_maks = {
@@ -228,7 +230,7 @@ def read_operand(o):
228230 groups = map (instruction .group_name , instruction .groups )
229231
230232 PC = {"i386" : "EIP" , "amd64" : "RIP" }[arch ]
231- registers = {PC : gdb .getR (PC )}
233+ registers : Dict [ Any , Any ] = {PC : gdb .getR (PC )}
232234 memory = {}
233235
234236 # save the encoded instruction
@@ -246,11 +248,11 @@ def read_operand(o):
246248 if instruction .insn_name ().upper () in ["PUSHF" , "PUSHFD" ]:
247249 registers ["EFLAGS" ] = gdb .getR ("EFLAGS" )
248250
249- if instruction .insn_name ().upper () in ["XLAT" , "XLATB" ]:
250- registers ["AL" ] = gdb .getR ("AL" )
251- registers [B ] = gdb .getR (B )
252- address = registers [B ] + registers ["AL" ]
253- memory [address ] = chr (gdb .getByte (address ))
251+ # if instruction.insn_name().upper() in ["XLAT", "XLATB"]:
252+ # registers["AL"] = gdb.getR("AL")
253+ # registers[B] = gdb.getR(B)
254+ # address = registers[B] + registers["AL"]
255+ # memory[address] = chr(gdb.getByte(address))
254256
255257 if instruction .insn_name ().upper () in ["BTC" , "BTR" , "BTS" , "BT" ]:
256258 if instruction .operands [0 ].type == X86_OP_MEM :
@@ -310,34 +312,34 @@ def read_operand(o):
310312 # registers[reg_name] = gdb.getR(reg_name)
311313
312314 reg_sizes = {
313- X86_REG_AH : X86_REG_AX ,
314- X86_REG_AL : X86_REG_AX ,
315- X86_REG_AX : X86_REG_EAX ,
316- X86_REG_EAX : X86_REG_RAX ,
317- X86_REG_RAX : X86_REG_INVALID ,
318- X86_REG_BH : X86_REG_BX ,
319- X86_REG_BL : X86_REG_BX ,
320- X86_REG_BX : X86_REG_EBX ,
321- X86_REG_EBX : X86_REG_RBX ,
322- X86_REG_RBX : X86_REG_INVALID ,
323- X86_REG_CH : X86_REG_CX ,
324- X86_REG_CL : X86_REG_CX ,
325- X86_REG_CX : X86_REG_ECX ,
326- X86_REG_ECX : X86_REG_RCX ,
327- X86_REG_RCX : X86_REG_INVALID ,
328- X86_REG_DH : X86_REG_DX ,
329- X86_REG_DL : X86_REG_DX ,
330- X86_REG_DX : X86_REG_EDX ,
331- X86_REG_EDX : X86_REG_RDX ,
332- X86_REG_RDX : X86_REG_INVALID ,
333- X86_REG_DIL : X86_REG_EDI ,
334- X86_REG_DI : X86_REG_EDI ,
335- X86_REG_EDI : X86_REG_RDI ,
336- X86_REG_RDI : X86_REG_INVALID ,
337- X86_REG_SIL : X86_REG_ESI ,
338- X86_REG_SI : X86_REG_ESI ,
339- X86_REG_ESI : X86_REG_RSI ,
340- X86_REG_RSI : X86_REG_INVALID ,
315+ csr . X86_REG_AH : csr . X86_REG_AX ,
316+ csr . X86_REG_AL : csr . X86_REG_AX ,
317+ csr . X86_REG_AX : csr . X86_REG_EAX ,
318+ csr . X86_REG_EAX : csr . X86_REG_RAX ,
319+ csr . X86_REG_RAX : csr . X86_REG_INVALID ,
320+ csr . X86_REG_BH : csr . X86_REG_BX ,
321+ csr . X86_REG_BL : csr . X86_REG_BX ,
322+ csr . X86_REG_BX : csr . X86_REG_EBX ,
323+ csr . X86_REG_EBX : csr . X86_REG_RBX ,
324+ csr . X86_REG_RBX : csr . X86_REG_INVALID ,
325+ csr . X86_REG_CH : csr . X86_REG_CX ,
326+ csr . X86_REG_CL : csr . X86_REG_CX ,
327+ csr . X86_REG_CX : csr . X86_REG_ECX ,
328+ csr . X86_REG_ECX : csr . X86_REG_RCX ,
329+ csr . X86_REG_RCX : csr . X86_REG_INVALID ,
330+ csr . X86_REG_DH : csr . X86_REG_DX ,
331+ csr . X86_REG_DL : csr . X86_REG_DX ,
332+ csr . X86_REG_DX : csr . X86_REG_EDX ,
333+ csr . X86_REG_EDX : csr . X86_REG_RDX ,
334+ csr . X86_REG_RDX : csr . X86_REG_INVALID ,
335+ csr . X86_REG_DIL : csr . X86_REG_EDI ,
336+ csr . X86_REG_DI : csr . X86_REG_EDI ,
337+ csr . X86_REG_EDI : csr . X86_REG_RDI ,
338+ csr . X86_REG_RDI : csr . X86_REG_INVALID ,
339+ csr . X86_REG_SIL : csr . X86_REG_ESI ,
340+ csr . X86_REG_SI : csr . X86_REG_ESI ,
341+ csr . X86_REG_ESI : csr . X86_REG_RSI ,
342+ csr . X86_REG_RSI : csr . X86_REG_INVALID ,
341343 }
342344 # There is a capstone branch that should fix all these annoyances... soon
343345 # https://github.com/aquynh/capstone/tree/next
@@ -387,7 +389,7 @@ def read_operand(o):
387389 registers [reg_name ] = gdb .getR (reg_name )
388390 address += o .mem .scale * registers [reg_name ]
389391 address = address & ({"i386" : 0xFFFFFFFF , "amd64" : 0xFFFFFFFFFFFFFFFF }[arch ])
390- for i in xrange (address , address + o .size ):
392+ for i in range (address , address + o .size ):
391393 memory [i ] = chr (gdb .getByte (i ))
392394
393395 # gather PRE info
0 commit comments