Open disconnect3d opened 1 year ago
>>> import capstone
>>> capstone.__version__
'5.0.0'
>>> from capstone import *
>>> md = Cs(CS_ARCH_X86, CS_MODE_64)
>>> data = asm('mov rbx, [rax+rcx*2+10]', arch='amd64', bits=64) # From Pwntools
>>> md.detail = True
>>> instruction = md.disasm(data, 100)
>>> instruction = list(md.disasm(data, 100))[0]
>>> instruction.regs_write
[]
>>> instruction.regs_read
[]
>>> regs_read, regs_write = instruction.regs_access()
>>> [md.reg_name(r) for r in regs_read]
['rax', 'rcx']
>>> [md.reg_name(r) for r in regs_write]
['rbx']
@wallds Yeah, the instruction.regs_access()
do return the read and write regs which can then be resolved through md.reg_name(reg_value)
but yeah, .regs_write
and .regs_read
are empty for some reason.
I'm not sure what does the second listing shows: is this what the .regs_access()
Python method calls here? If so, it must mean that the insn->detail->regs_{read,write}
had the proper values but for some reason the Python API does not return those values?
Because insn->detail->regs_{read,write}
contains only the list of implicitly accessed registers, such as:
mul rbx; .read=['rax'], .write=['rax', 'rdx', 'rflags']
cmp rax, rcx; .read=[] , .write=['rflags']
.regs_access
will then proceed to parse the .operands
based on this.
mul rbx; read=['rax', 'rbx'], write=['rax', 'rdx', 'rflags']
cmp rax, rcx; read=['rax', 'rcx'], write=['rflags']
Uh okay.
What is the purpose of this? Are there any use cases to get a list of only implicit read/written registers?
Perhaps it would be better to remove those attributes or to rename them to sth like regs_{read,write}_implicitly
though I guess you may not want to make such an API break?
If not that, then this should be documented better (also in the C comments above).
Hi,
It seems that the Python API is missing some details about instructions like
.reg_read
or.reg_write
values:While cstool shows those values ("Registers read", "Registers modified"):
PS: The cstool was compiled from tag
5.0-post1
(commitf2ffa75f787806e7fd986defb0dca0349ace6de2
) while the Python API I use comes frompip install capstone==5.0.0.post1
.