#!/usr/bin/env python3 """dis.py — quick capstone disassembler for soothe_mem.bin (base 0x180000000). Usage: dis.py [len] [va2 len2 ...] """ import sys from capstone import Cs, CS_ARCH_X86, CS_MODE_64 BASE = 0x180000000 _data = open('/home/m/re-tools/soothe_mem.bin', 'rb').read() def dis(va, n=256): off = va - BASE code = _data[off:off + n] md = Cs(CS_ARCH_X86, CS_MODE_64) md.detail = False out = [] for ins in md.disasm(code, va): s = '%08x %-24s %s %s' % (ins.address, ins.bytes.hex(), ins.mnemonic, ins.op_str) out.append(s) if ins.mnemonic == 'ret': break return '\n'.join(out) if __name__ == '__main__': a = sys.argv[1:] for i in range(0, len(a), 2): va = int(a[i], 16) n = int(a[i + 1], 16) if i + 1 < len(a) else 256 print('==== %x (len %x) ====' % (va, n)) print(dis(va, n))