1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
|
VERSION 5.00
Object = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}#2.0#0"; "MSCOMCTL.OCX"
Begin VB.Form Form1
Caption = "VB6 Bindings for Capstone Disassembly Engine - Contributed by FireEye FLARE Team"
ClientHeight = 7290
ClientLeft = 60
ClientTop = 345
ClientWidth = 10275
LinkTopic = "Form1"
ScaleHeight = 7290
ScaleWidth = 10275
StartUpPosition = 2 'CenterScreen
Begin VB.CommandButton Command2
Caption = "Save"
Height = 375
Left = 8760
TabIndex = 8
Top = 120
Width = 1455
End
Begin VB.CommandButton Command1
Caption = " Arm 64"
Height = 375
Index = 4
Left = 6840
TabIndex = 7
Top = 120
Width = 1455
End
Begin VB.CommandButton Command1
Caption = "Arm"
Height = 375
Index = 3
Left = 5160
TabIndex = 6
Top = 120
Width = 1455
End
Begin VB.CommandButton Command1
Caption = "x86 64bit"
Height = 375
Index = 2
Left = 3480
TabIndex = 5
Top = 120
Width = 1455
End
Begin VB.CommandButton Command1
Caption = "x86 16bit"
Height = 375
Index = 0
Left = 120
TabIndex = 4
Top = 120
Width = 1455
End
Begin VB.CommandButton Command1
Caption = "x86 32bit"
Height = 375
Index = 1
Left = 1800
TabIndex = 3
Top = 120
Width = 1455
End
Begin MSComctlLib.ListView lv
Height = 2415
Left = 120
TabIndex = 2
Top = 1440
Width = 10095
_ExtentX = 17806
_ExtentY = 4260
View = 3
LabelEdit = 1
LabelWrap = -1 'True
HideSelection = 0 'False
FullRowSelect = -1 'True
_Version = 393217
ForeColor = -2147483640
BackColor = -2147483643
BorderStyle = 1
Appearance = 1
BeginProperty Font {0BE35203-8F91-11CE-9DE3-00AA004BB851}
Name = "Courier"
Size = 9.75
Charset = 0
Weight = 400
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
NumItems = 1
BeginProperty ColumnHeader(1) {BDD1F052-858B-11D1-B16A-00C0F0283628}
Object.Width = 2540
EndProperty
End
Begin VB.ListBox List1
BeginProperty Font
Name = "Courier"
Size = 9.75
Charset = 0
Weight = 400
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
Height = 840
Left = 120
TabIndex = 1
Top = 600
Width = 10095
End
Begin VB.TextBox Text1
BeginProperty Font
Name = "Courier"
Size = 9.75
Charset = 0
Weight = 400
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
Height = 3375
Left = 120
MultiLine = -1 'True
ScrollBars = 3 'Both
TabIndex = 0
Text = "Form1.frx":0000
Top = 3840
Width = 10095
End
End
Attribute VB_Name = "Form1"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Option Explicit
'Capstone Disassembly Engine bindings for VB6
'Contributed by FireEye FLARE Team
'Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
'License: Apache 2.0
'Copyright: FireEye 2017
Dim cap As CDisassembler
Dim lastSample As Long
Private Sub Command1_Click(index As Integer)
Dim code() As Byte, arch As cs_arch, mode As cs_mode
lastSample = index
Const x86_code32 As String = "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x05\x23\x01\x00\x00\x36\x8b\x84\x91\x23\x01\x00\x00\x41\x8d\x84\x39\x89\x67\x00\x00\x8d\x87\x89\x67\x00\x00\xb4\xc6"
Const X86_CODE16 As String = "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x05\x23\x01\x00\x00\x36\x8b\x84\x91\x23\x01\x00\x00\x41\x8d\x84\x39\x89\x67\x00\x00\x8d\x87\x89\x67\x00\x00\xb4\xc6"
Const X86_CODE64 As String = "\x55\x48\x8b\x05\xb8\x13\x00\x00"
Const ARM_CODE As String = "\xED\xFF\xFF\xEB\x04\xe0\x2d\xe5\x00\x00\x00\x00\xe0\x83\x22\xe5\xf1\x02\x03\x0e\x00\x00\xa0\xe3\x02\x30\xc1\xe7\x00\x00\x53\xe3\x00\x02\x01\xf1\x05\x40\xd0\xe8\xf4\x80\x00\x00"
Const ARM64_CODE As String = "\x09\x00\x38\xd5\xbf\x40\x00\xd5\x0c\x05\x13\xd5\x20\x50\x02\x0e\x20\xe4\x3d\x0f\x00\x18\xa0\x5f\xa2\x00\xae\x9e\x9f\x37\x03\xd5\xbf\x33\x03\xd5\xdf\x3f\x03\xd5\x21\x7c\x02\x9b\x21\x7c\x00\x53\x00\x40\x21\x4b\xe1\x0b\x40\xb9\x20\x04\x81\xda\x20\x08\x02\x8b\x10\x5b\xe8\x3c"
Select Case index
Case 0:
arch = CS_ARCH_X86
mode = CS_MODE_16
code = toBytes(X86_CODE16)
Case 1:
arch = CS_ARCH_X86
mode = CS_MODE_32
code = toBytes(x86_code32)
Case 2:
arch = CS_ARCH_X86
mode = CS_MODE_64
code = toBytes(X86_CODE64)
Case 3:
arch = CS_ARCH_ARM
mode = CS_MODE_ARM
code = toBytes(ARM_CODE)
Case 4:
arch = CS_ARCH_ARM64
mode = CS_MODE_ARM
code = toBytes(ARM64_CODE)
End Select
test code, arch, mode
End Sub
Private Sub test(code() As Byte, arch As cs_arch, mode As cs_mode)
Dim ret As Collection
Dim ci As CInstruction
Dim li As ListItem
clearForm
If Not cap Is Nothing Then Set cap = Nothing
Set cap = New CDisassembler
If Not cap.init(arch, mode, True) Then
List1.AddItem "Failed to init engine: " & cap.errMsg
Exit Sub
End If
List1.AddItem "Capstone loaded @ 0x" & Hex(cap.hLib)
List1.AddItem "hEngine: 0x" & Hex(cap.hCapstone)
List1.AddItem "Version: " & cap.version
If cap.vMajor < 3 Then
List1.AddItem "Sample requires Capstone v3+"
Exit Sub
End If
Set ret = cap.disasm(&H1000, code)
For Each ci In ret
Set li = lv.ListItems.Add(, , ci.text)
Set li.Tag = ci
Next
End Sub
Private Sub Command2_Click()
Dim fName() As String
Dim fPath As String
Dim t() As String
Dim li As ListItem
Dim ci As CInstruction
On Error Resume Next
If lastSample = -1 Then
MsgBox "Run a test first..."
Exit Sub
End If
fName = Split("16b,32b,64b,Arm,Arm64", ",")
fPath = App.path & "\vb" & fName(lastSample) & "Test.txt"
If FileExists(fPath) Then Kill fPath
For Each li In lv.ListItems
push t, li.text
Set ci = li.Tag
push t, ci.toString()
push t, String(60, "-")
Next
WriteFile fPath, Join(t, vbCrLf)
MsgBox FileLen(fPath) & " bytes saved to: " & vbCrLf & vbCrLf & fPath
End Sub
Private Sub lv_ItemClick(ByVal Item As MSComctlLib.ListItem)
Dim ci As CInstruction
Set ci = Item.Tag
Text1 = ci.toString()
End Sub
Function clearForm()
List1.Clear
lv.ListItems.Clear
Text1 = Empty
End Function
Private Sub Form_Load()
lv.ColumnHeaders(1).Width = lv.Width
clearForm
lastSample = -1
End Sub
|
