diff options
Diffstat (limited to 'Capstone/Capstone.psm1')
| -rw-r--r-- | Capstone/Capstone.psm1 | 173 |
1 files changed, 173 insertions, 0 deletions
diff --git a/Capstone/Capstone.psm1 b/Capstone/Capstone.psm1 new file mode 100644 index 0000000..6f55c1e --- /dev/null +++ b/Capstone/Capstone.psm1 @@ -0,0 +1,173 @@ +#Requires -Modules Capstone + +function Get-CSDisassembly +{ +<# +.SYNOPSIS + + Disassembles a byte array using the Capstone Engine disassembly framework. + + PowerSploit Function: Get-CSDisassembly + Author: Matthew Graeber (@mattifestation) + License: See LICENSE.TXT + Required Dependencies: lib\capstone.dll, lib\[x86|x64]\libcapstone.dll + Optional Dependencies: None + +.DESCRIPTION + + Get-CSDisassembly is compatible on 32 and 64-bit. + +.PARAMETER Architecture + + Specifies the architecture of the code to be disassembled. + +.PARAMETER Mode + + Specifies the mode in which to disassemble code. For example, to disassemble Amd64 code, architecture is set to 'X86' and Mode is set to 'MODE_64'. + +.PARAMETER Code + + A byte array consisting of the code to be disassembled. + +.PARAMETER Offset + + Specifies the starting address of the disassembly listing. + +.PARAMETER Count + + Specifies the maximum number of instructions to disassemble. + +.PARAMETER Syntax + + Specifies the syntax flavor to be used (INTEL vs. ATT). + +.PARAMETER DetailOn + + Specifies that detailed parsing should be performed - i.e. provide detailed information for each disassembled instruction. + +.PARAMETER Verstion + + Prints the running Capstone Framework version. + +.EXAMPLE + + $Bytes = [Byte[]] @( 0x8D, 0x4C, 0x32, 0x08, 0x01, 0xD8, 0x81, 0xC6, 0x34, 0x12, 0x00, 0x00 ) + Get-CSDisassembly -Architecture X86 -Mode Mode16 -Code $Bytes -Offset 0x1000 + + $Bytes = [Byte[]] @( 0x8D, 0x4C, 0x32, 0x08, 0x01, 0xD8, 0x81, 0xC6, 0x34, 0x12, 0x00, 0x00 ) + Get-CSDisassembly -Architecture X86 -Mode Mode32 -Code $Bytes + + $Bytes = [Byte[]] @( 0x8D, 0x4C, 0x32, 0x08, 0x01, 0xD8, 0x81, 0xC6, 0x34, 0x12, 0x00, 0x00 ) + Get-CSDisassembly -Architecture X86 -Mode Mode32 -Code $Bytes -Syntax ATT + + $Bytes = [Byte[]] @( 0x55, 0x48, 0x8b, 0x05, 0xb8, 0x13, 0x00, 0x00 ) + Get-CSDisassembly -Architecture X86 -Mode Mode64 -Code $Bytes -DetailOn + + $Bytes = [Byte[]] @( 0xED, 0xFF, 0xFF, 0xEB, 0x04, 0xe0, 0x2d, 0xe5, 0x00, 0x00, 0x00, 0x00, 0xe0, 0x83, 0x22, 0xe5, 0xf1, 0x02, 0x03, 0x0e, 0x00, 0x00, 0xa0, 0xe3, 0x02, 0x30, 0xc1, 0xe7, 0x00, 0x00, 0x53, 0xe3 ) + Get-CSDisassembly -Architecture Arm -Mode Arm -Code $Bytes + + $Bytes = [Byte[]] @( 0x4f, 0xf0, 0x00, 0x01, 0xbd, 0xe8, 0x00, 0x88, 0xd1, 0xe8, 0x00, 0xf0 ) + Get-CSDisassembly -Architecture Arm -Mode Thumb -Code $Bytes + + $Bytes = [Byte[]] @( 0x10, 0xf1, 0x10, 0xe7, 0x11, 0xf2, 0x31, 0xe7, 0xdc, 0xa1, 0x2e, 0xf3, 0xe8, 0x4e, 0x62, 0xf3 ) + Get-CSDisassembly -Architecture Arm -Mode Arm -Code $Bytes + + $Bytes = [Byte[]] @( 0x70, 0x47, 0xeb, 0x46, 0x83, 0xb0, 0xc9, 0x68 ) + Get-CSDisassembly -Architecture Arm -Mode Thumb -Code $Bytes -DetailOn + + $Bytes = [Byte[]] @( 0x21, 0x7c, 0x02, 0x9b, 0x21, 0x7c, 0x00, 0x53, 0x00, 0x40, 0x21, 0x4b, 0xe1, 0x0b, 0x40, 0xb9 ) + Get-CSDisassembly -Architecture Arm64 -Mode Arm -Code $Bytes + + $Bytes = [Byte[]] @( 0x0C, 0x10, 0x00, 0x97, 0x00, 0x00, 0x00, 0x00, 0x24, 0x02, 0x00, 0x0c, 0x8f, 0xa2, 0x00, 0x00, 0x34, 0x21, 0x34, 0x56 ) + Get-CSDisassembly -Architecture Mips -Mode 'Mode32, BigEndian' -Code $Bytes + + $Bytes = [Byte[]] @( 0x56, 0x34, 0x21, 0x34, 0xc2, 0x17, 0x01, 0x00 ) + Get-CSDisassembly -Architecture Mips -Mode 'Mode64, LittleEndian' -Code $Bytes + + $Bytes = [Byte[]] @( 0x80, 0x20, 0x00, 0x00, 0x80, 0x3f, 0x00, 0x00, 0x10, 0x43, 0x23, 0x0e, 0xd0, 0x44, 0x00, 0x80, 0x4c, 0x43, 0x22, 0x02, 0x2d, 0x03, 0x00, 0x80, 0x7c, 0x43, 0x20, 0x14, 0x7c, 0x43, 0x20, 0x93, 0x4f, 0x20, 0x00, 0x21, 0x4c, 0xc8, 0x00, 0x21 ) + Get-CSDisassembly -Architecture PPC -Mode BigEndian -Code $Bytes + +.INPUTS + + None + + You cannot pipe objects to Get-CSDisassembly. + +.OUTPUTS + + Capstone.Instruction[] + + Get-CSDisassembly returns an array of Instruction objects. +#> + + [OutputType([Capstone.Instruction])] + [CmdletBinding(DefaultParameterSetName = 'Disassemble')] + Param ( + [Parameter(Mandatory, ParameterSetName = 'Disassemble')] + [Capstone.Architecture] + $Architecture, + + [Parameter(Mandatory, ParameterSetName = 'Disassemble')] + [Capstone.Mode] + $Mode, + + [Parameter(Mandatory, ParameterSetName = 'Disassemble')] + [ValidateNotNullOrEmpty()] + [Byte[]] + $Code, + + [Parameter( ParameterSetName = 'Disassemble' )] + [UInt64] + $Offset = 0, + + [Parameter( ParameterSetName = 'Disassemble' )] + [UInt32] + $Count = 0, + + [Parameter( ParameterSetName = 'Disassemble' )] + [ValidateSet('Intel', 'ATT')] + [String] + $Syntax, + + [Parameter( ParameterSetName = 'Disassemble' )] + [Switch] + $DetailOn, + + [Parameter( ParameterSetName = 'Version' )] + [Switch] + $Version + ) + + if ($PsCmdlet.ParameterSetName -eq 'Version') + { + $Disassembly = New-Object Capstone.Capstone([Capstone.Architecture]::X86, [Capstone.Mode]::Mode16) + $Disassembly.Version + + return + } + + $Disassembly = New-Object Capstone.Capstone($Architecture, $Mode) + + if ($Disassembly.Version -ne [Capstone.Capstone]::BindingVersion) + { + Write-Error "capstone.dll version ($([Capstone.Capstone]::BindingVersion.ToString())) should be the same as libcapstone.dll version. Otherwise, undefined behavior is likely." + } + + if ($Syntax) + { + switch ($Syntax) + { + 'Intel' { $SyntaxMode = [Capstone.OptionValue]::SyntaxIntel } + 'ATT' { $SyntaxMode = [Capstone.OptionValue]::SyntaxATT } + } + + $Disassembly.SetSyntax($SyntaxMode) + } + + if ($DetailOn) + { + $Disassembly.SetDetail($True) + } + + $Disassembly.Disassemble($Code, $Offset, $Count) +}
\ No newline at end of file |