Search code examples
reverse-engineeringdisassemblycapstone

capstone disassembler - disassembling single function without knowing length

I am interested in using the capstone disassembler library.

https://github.com/aquynh/capstone

My motivation for using this is that I need to be able to disassemble functions at run-time while my program runs.

I have been able to integrate this into my c++ project successfully. However, I have been unable to figure out how to disassemble an entire function. I looked through all the examples in the following link.

https://github.com/aquynh/capstone/tree/master/tests

All the examples take some arbitrary length to disassemble. I do not know the size of the function that I want to disassemble before hand. All I know is the symbol name (e.g. "mkdir"). If someone can provide a link to some example that accomplishes what I need, that'd be greatly appreciated.

In case it matters, the architectures that I would like to disassemble for are x86, x86_64, arm and arm64.

Solution

  • I take it, there just no such thing as "function length" stored anywhere in executable file. I suggest disassembling by small chunks until you encounter a sort of terminator instruction (like "ret").