Trying to get starting with capstone (C)

Viewed 113

Today i have been tried to start with capstone because someone told me that it would be a good help for finding cross-reference (through a 64bit ARM (little-endian) bootloader) but after many attemps, it seems that i can't understand at all their examples ;(

for example, i tried to tweak their basic example :

int main(char *argv[]) {
  FILE *f;
  csh handle;
  cs_insn *insn;
  size_t count;
  int len = 0;
  char *file = NULL;

  f = fopen(argv[1], "rb");

  if (!fd) {
    return -1;
  }

  fseek(f,0,SEEK_END);
  len = ftell(f);
  fseek(f,0,SEEK_SET);
  file = malloc(len);
  fread(file,1,len,f);
    
  fflush(f);
  fclose(f);

  if (cs_open(CS_ARCH_ARM64,CS_MODE_LITTLE_ENDIAN,&handle) != CS_ERR_OK) 
    return -1;
  count = cs_disasm(handle,file,len-1,0x11DA,0,&insn);

  if (count > 0) {
    size_t j;
    for (j = 0; j < count; j++) {
      printf("0x%"PRIx64":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic, insn[j].op_str);
    }
    cs_free(insn, count);
  } else {
    printf("ERROR: Failed to disassemble given code!\n");
  }
  cs_close(&handle);
  free(file);

  return 0;
}

but i did not got the result that i expected (like, the 0x11DA offset should be a mov instruction but there, it outputs an adrp one so i think that I missed something....)

Can someone explain me how to find cross-references with capstone or if not, have at least link that introduce well to it ?

(Sorry in advance if you don't understand everything).

Thanks.

0 Answers
Related