keystone
keystone copied to clipboard
setting ks.syntax in python bindings breaks correct asm generation.
trafficstars
Please consider this very simple script to reproduce the issue:
import sys
from keystone import *
CODE= """
mov edx, 0x16
mov edx, 16
mov eax, 0x4020a1
mov eax, 4202657
"""
def output_encoding(encoding):
myasm = ''.join(map(chr, encoding))
for i in myasm:
sys.stdout.write("\\x"+i.encode('hex'))
print("\n")
# separate assembly instructions by ; or \n
try:
print(CODE)
# Initialize engine in X86-64bit mode
ks = Ks(KS_ARCH_X86, KS_MODE_64)
print("Without setting syntax:")
saved = ks.syntax
encoding, count = ks.asm(CODE)
output_encoding(encoding)
print("Setting syntax:")
#ks.syntax = KS_OPT_SYNTAX_INTEL
ks.syntax = saved
encoding, count = ks.asm(CODE)
output_encoding(encoding)
#print("%s = %s (number of statements: %u)" %(CODE, encoding, count))
except KsError as e:
print("ERROR: %s" %e)
The output of the script:
mov edx, 0x16
mov edx, 16
mov eax, 0x4020a1
mov eax, 4202657
Without setting syntax:
\xba\x16\x00\x00\x00\xba\x10\x00\x00\x00\xb8\xa1\x20\x40\x00\xb8\xa1\x20\x40\x00
Setting syntax:
\xba\x16\x00\x00\x00\xba\x16\x00\x00\x00\xb8\xa1\x20\x40\x00\xb8\x57\x26\x20\x04
As you can see, the first run is correct, after setting ks.syntax to the same value, the generated asm is wrong.
mov edx, 16
should be: \xba\x10\x00\x00\x00 not \xba\x16\x00\x00\x00
mov eax, 4202657
should be: \xb8\xa1\x20\x40\x00 not \xb8\x57\x26\x20\x04
It seem like everything is interpreted as hex even when it's clearly not.