Today i have been tried to start with capstone because someone told me that it would be a good help for finding cross-reference (through a 64bit ARM (little-endian) bootloader) but after many attemps, it seems that i can't understand at all their examples ;(
for example, i tried to tweak their basic example :
int main(char *argv[]) {
FILE *f;
csh handle;
cs_insn *insn;
size_t count;
int len = 0;
char *file = NULL;
f = fopen(argv[1], "rb");
if (!fd) {
return -1;
}
fseek(f,0,SEEK_END);
len = ftell(f);
fseek(f,0,SEEK_SET);
file = malloc(len);
fread(file,1,len,f);
fflush(f);
fclose(f);
if (cs_open(CS_ARCH_ARM64,CS_MODE_LITTLE_ENDIAN,&handle) != CS_ERR_OK)
return -1;
count = cs_disasm(handle,file,len-1,0x11DA,0,&insn);
if (count > 0) {
size_t j;
for (j = 0; j < count; j++) {
printf("0x%"PRIx64":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic, insn[j].op_str);
}
cs_free(insn, count);
} else {
printf("ERROR: Failed to disassemble given code!\n");
}
cs_close(&handle);
free(file);
return 0;
}
but i did not got the result that i expected (like, the 0x11DA offset should be a mov instruction but there, it outputs an adrp one so i think that I missed something....)
Can someone explain me how to find cross-references with capstone or if not, have at least link that introduce well to it ?
(Sorry in advance if you don't understand everything).
Thanks.