README
1This directory contains cstool of Capstone Engine.
2
3Cstool is a command-line tool to disassemble assembly hex-string.
4For example, to decode a hexcode string for Intel 32bit, run:
5
6 $ cstool x32 "90 91"
7
8 0 90 nop
9 1 91 xchg eax, ecx
10
11Cstool disassembles the input and prints out the assembly instructions.
12On each line, the first column is the instruction offset, the second
13column is opcodes, and the rest is the instruction itself.
14
15Cstool is flexible enough to accept all kind of hexcode format. The following
16inputs have the same output with the example above.
17
18 $ cstool x32 "0x90 0x91"
19 $ cstool x32 "\x90\x91"
20 $ cstool x32 "90,91"
21 $ cstool x32 "90;91"
22 $ cstool x32 "90+91"
23 $ cstool x32 "90:91"
24
25To print out instruction details, run Cstool with -d option, like below.
26
27 $ cstool -d x32 "01 d8"
28 0 01d8 add eax, ebx
29 Prefix:0x00 0x00 0x00 0x00
30 Opcode:0x01 0x00 0x00 0x00
31 rex: 0x0
32 addr_size: 4
33 modrm: 0xd8
34 disp: 0x0
35 sib: 0x0
36 op_count: 2
37 operands[0].type: REG = eax
38 operands[0].size: 4
39 operands[0].access: READ | WRITE
40 operands[1].type: REG = ebx
41 operands[1].size: 4
42 operands[1].access: READ
43 Registers read: eax ebx
44 Registers modified: eflags eax
45 EFLAGS: MOD_AF MOD_CF MOD_SF MOD_ZF MOD_PF MOD_OF
46
47To see all the supported options, run ./cstool
48