Capstone for ARM

[1livv]

Capstone for ARM

[razvand]

@1livv, what do you mean by "backwards at runtime"? Could you please provide a concrete example of the issue?

[1livv]

Say that we have an arm binary that has parts of code in classic ARM syntax(32 bit) and parts in ARM THUMB code(16 bit) and these parts are mingled together(a common case).

Let's say that we want to disasm the whole text section. For that we have to switch the capstone MODE (from CS_MODE_ARM to CS_MODE_THUMB and backwards) depending on which part we are in the code(text section).

Something like this:
set_mode (CS_MODE_ARM)
disasm(arm_code, arm_code_size);
set_mode(CS_MODE_THUMB)
disasm(arm_thumb_code, arm_thumb_code_size);
...and so on until the end of the section.

Problem is that right now i don't know of any way of knowing which code portion is in ARM and which code portion is in ARM_THUMB to accordingly set the capstone mode as i move through the buffer.

[razvand]

@1livv, we need a form of recursive disassembling similar to what IDA Pro is using.

Please ask on the Capstone Engine mailing list whether there is a solution for this.

If not, check whether other (open source) disassemblers may be used; maybe radare2 is an option.

• http://wiki.yobi.be/wiki/Reverse-Engineering
• https://github.com/google/binnavi/wiki/Replacing-IDA-as-Disassembler-Frontend