Python源码示例:capstone.CS_GRP_JUMP

示例1
def is_jump(i):
    return i.group(CS_GRP_JUMP) 
示例2
def is_cond_jump(i):
    return i.group(CS_GRP_JUMP) and i.id != X86_INS_JMP 
示例3
def instruction_from_cs_insn(csInsn, executable):
    groups = []

    if executable.architecture in (ARCHITECTURE.ARM, ARCHITECTURE.ARM_64):
        if csInsn.mnemonic.startswith('bl'):
            groups.append(Instruction.GRP_CALL)
        elif csInsn.mnemonic.startswith('b'):
            groups.append(Instruction.GRP_JUMP)
    else:
        if capstone.CS_GRP_JUMP in csInsn.groups:
            groups.append(Instruction.GRP_JUMP)
        if capstone.CS_GRP_CALL in csInsn.groups:
            groups.append(Instruction.GRP_CALL)

    instruction = Instruction(csInsn.address, csInsn.size, csInsn.bytes, csInsn.mnemonic, [], groups, csInsn, executable)

    # We manually pull out the instruction details here so that capstone doesn't deepcopy everything which burns time
    # and memory
    detail = ctypes.cast(csInsn._raw.detail, ctypes.POINTER(capstone._cs_detail)).contents

    if executable.architecture == ARCHITECTURE.X86 or executable.architecture == ARCHITECTURE.X86_64:
        detail = detail.arch.x86
    elif executable.architecture == ARCHITECTURE.ARM:
        detail = detail.arch.arm
    elif executable.architecture == ARCHITECTURE.ARM_64:
        detail = detail.arch.arm64

    operands = [operand_from_cs_op(detail.operands[i], instruction) for i in range(detail.op_count)]

    instruction.operands = operands

    return instruction 
示例4
def is_target_gotplt(self, target):
        assert self.gotplt_base and self.gotplt_sz

        if not (self.gotplt_base <= target <
                self.gotplt_base + self.gotplt_sz):
            return False

        for ent in self.gotplt_entries:
            if ent.address == target:
                if (CS_GRP_JUMP in ent.groups
                        and ent.operands[0].type == CS_OP_MEM):
                    return ent.operands[0].mem.disp + ent.address + ent.size

        return False