keystone icon indicating copy to clipboard operation
keystone copied to clipboard

setting ks.syntax in python bindings breaks correct asm generation.

Open Caesurus opened this issue 6 years ago • 0 comments
trafficstars

Please consider this very simple script to reproduce the issue:

import sys
from keystone import *

CODE= """
mov     edx, 0x16
mov     edx, 16
mov     eax, 0x4020a1
mov     eax, 4202657
"""

def output_encoding(encoding):
  myasm = ''.join(map(chr, encoding))
  for i in myasm:
    sys.stdout.write("\\x"+i.encode('hex'))
  print("\n")

# separate assembly instructions by ; or \n
try:
  print(CODE)
  # Initialize engine in X86-64bit mode
  ks = Ks(KS_ARCH_X86, KS_MODE_64)
  print("Without setting syntax:")
  saved = ks.syntax
  encoding, count = ks.asm(CODE)
  output_encoding(encoding)

  print("Setting syntax:")
  #ks.syntax = KS_OPT_SYNTAX_INTEL
  ks.syntax = saved
  encoding, count = ks.asm(CODE)
  output_encoding(encoding)
  #print("%s = %s (number of statements: %u)" %(CODE, encoding, count))

except KsError as e:
  print("ERROR: %s" %e)

The output of the script:


mov     edx, 0x16
mov     edx, 16
mov     eax, 0x4020a1
mov     eax, 4202657

Without setting syntax:
\xba\x16\x00\x00\x00\xba\x10\x00\x00\x00\xb8\xa1\x20\x40\x00\xb8\xa1\x20\x40\x00

Setting syntax:
\xba\x16\x00\x00\x00\xba\x16\x00\x00\x00\xb8\xa1\x20\x40\x00\xb8\x57\x26\x20\x04

As you can see, the first run is correct, after setting ks.syntax to the same value, the generated asm is wrong. mov edx, 16 should be: \xba\x10\x00\x00\x00 not \xba\x16\x00\x00\x00 mov eax, 4202657 should be: \xb8\xa1\x20\x40\x00 not \xb8\x57\x26\x20\x04

It seem like everything is interpreted as hex even when it's clearly not.

Caesurus avatar Oct 18 '19 17:10 Caesurus