PowerShellMafia-PowerSploit/Capstone/Capstone.psm1

#Requires -Modules Capstone

function Get-CSDisassembly
{
<#
.SYNOPSIS

    Disassembles a byte array using the Capstone Engine disassembly framework.

    PowerSploit Function: Get-CSDisassembly
    Author: Matthew Graeber (@mattifestation)
    License: See LICENSE.TXT
    Required Dependencies: lib\capstone.dll, lib\[x86|x64]\libcapstone.dll
    Optional Dependencies: None

.DESCRIPTION

    Get-CSDisassembly is compatible on 32 and 64-bit.

.PARAMETER Architecture

    Specifies the architecture of the code to be disassembled.

.PARAMETER Mode

    Specifies the mode in which to disassemble code. For example, to disassemble Amd64 code, architecture is set to 'X86' and Mode is set to 'MODE_64'.

.PARAMETER Code

    A byte array consisting of the code to be disassembled.

.PARAMETER Offset

    Specifies the starting address of the disassembly listing.

.PARAMETER Count

    Specifies the maximum number of instructions to disassemble.

.PARAMETER Syntax

    Specifies the syntax flavor to be used (INTEL vs. ATT).

.PARAMETER DetailOn

    Specifies that detailed parsing should be performed - i.e. provide detailed information for each disassembled instruction.

.PARAMETER Verstion

    Prints the running Capstone Framework version.
      
.EXAMPLE

    $Bytes = [Byte[]] @( 0x8D, 0x4C, 0x32, 0x08, 0x01, 0xD8, 0x81, 0xC6, 0x34, 0x12, 0x00, 0x00 )
    Get-CSDisassembly -Architecture X86 -Mode Mode16 -Code $Bytes -Offset 0x1000

    $Bytes = [Byte[]] @( 0x8D, 0x4C, 0x32, 0x08, 0x01, 0xD8, 0x81, 0xC6, 0x34, 0x12, 0x00, 0x00 )
    Get-CSDisassembly -Architecture X86 -Mode Mode32 -Code $Bytes

    $Bytes = [Byte[]] @( 0x8D, 0x4C, 0x32, 0x08, 0x01, 0xD8, 0x81, 0xC6, 0x34, 0x12, 0x00, 0x00 )
    Get-CSDisassembly -Architecture X86 -Mode Mode32 -Code $Bytes -Syntax ATT

    $Bytes = [Byte[]] @( 0x55, 0x48, 0x8b, 0x05, 0xb8, 0x13, 0x00, 0x00 )
    Get-CSDisassembly -Architecture X86 -Mode Mode64 -Code $Bytes -DetailOn

    $Bytes = [Byte[]] @( 0xED, 0xFF, 0xFF, 0xEB, 0x04, 0xe0, 0x2d, 0xe5, 0x00, 0x00, 0x00, 0x00, 0xe0, 0x83, 0x22, 0xe5, 0xf1, 0x02, 0x03, 0x0e, 0x00, 0x00, 0xa0, 0xe3, 0x02, 0x30, 0xc1, 0xe7, 0x00, 0x00, 0x53, 0xe3 )
    Get-CSDisassembly -Architecture Arm -Mode Arm -Code $Bytes

    $Bytes = [Byte[]] @( 0x4f, 0xf0, 0x00, 0x01, 0xbd, 0xe8, 0x00, 0x88, 0xd1, 0xe8, 0x00, 0xf0 )
    Get-CSDisassembly -Architecture Arm -Mode Thumb -Code $Bytes

    $Bytes = [Byte[]] @( 0x10, 0xf1, 0x10, 0xe7, 0x11, 0xf2, 0x31, 0xe7, 0xdc, 0xa1, 0x2e, 0xf3, 0xe8, 0x4e, 0x62, 0xf3 )
    Get-CSDisassembly -Architecture Arm -Mode Arm -Code $Bytes

    $Bytes = [Byte[]] @( 0x70, 0x47, 0xeb, 0x46, 0x83, 0xb0, 0xc9, 0x68 )
    Get-CSDisassembly -Architecture Arm -Mode Thumb -Code $Bytes -DetailOn

    $Bytes = [Byte[]] @( 0x21, 0x7c, 0x02, 0x9b, 0x21, 0x7c, 0x00, 0x53, 0x00, 0x40, 0x21, 0x4b, 0xe1, 0x0b, 0x40, 0xb9 )
    Get-CSDisassembly -Architecture Arm64 -Mode Arm -Code $Bytes

    $Bytes = [Byte[]] @( 0x0C, 0x10, 0x00, 0x97, 0x00, 0x00, 0x00, 0x00, 0x24, 0x02, 0x00, 0x0c, 0x8f, 0xa2, 0x00, 0x00, 0x34, 0x21, 0x34, 0x56 )
    Get-CSDisassembly -Architecture Mips -Mode 'Mode32, BigEndian' -Code $Bytes

    $Bytes = [Byte[]] @( 0x56, 0x34, 0x21, 0x34, 0xc2, 0x17, 0x01, 0x00 )
    Get-CSDisassembly -Architecture Mips -Mode 'Mode64, LittleEndian' -Code $Bytes

    $Bytes = [Byte[]] @( 0x80, 0x20, 0x00, 0x00, 0x80, 0x3f, 0x00, 0x00, 0x10, 0x43, 0x23, 0x0e, 0xd0, 0x44, 0x00, 0x80, 0x4c, 0x43, 0x22, 0x02, 0x2d, 0x03, 0x00, 0x80, 0x7c, 0x43, 0x20, 0x14, 0x7c, 0x43, 0x20, 0x93, 0x4f, 0x20, 0x00, 0x21, 0x4c, 0xc8, 0x00, 0x21 )
    Get-CSDisassembly -Architecture PPC -Mode BigEndian -Code $Bytes

.INPUTS

    None

    You cannot pipe objects to Get-CSDisassembly.

.OUTPUTS

    Capstone.Instruction[]

    Get-CSDisassembly returns an array of Instruction objects.
#>

    [OutputType([Capstone.Instruction])]
    [CmdletBinding(DefaultParameterSetName = 'Disassemble')]
    Param (
        [Parameter(Mandatory, ParameterSetName = 'Disassemble')]
        [Capstone.Architecture]
        $Architecture,

        [Parameter(Mandatory, ParameterSetName = 'Disassemble')]
        [Capstone.Mode]
        $Mode,

        [Parameter(Mandatory, ParameterSetName = 'Disassemble')]
        [ValidateNotNullOrEmpty()]
        [Byte[]]
        $Code,

        [Parameter( ParameterSetName = 'Disassemble' )]
        [UInt64]
        $Offset = 0,

        [Parameter( ParameterSetName = 'Disassemble' )]
        [UInt32]
        $Count = 0,

        [Parameter( ParameterSetName = 'Disassemble' )]
        [ValidateSet('Intel', 'ATT')]
        [String]
        $Syntax,

        [Parameter( ParameterSetName = 'Disassemble' )]
        [Switch]
        $DetailOn,

        [Parameter( ParameterSetName = 'Version' )]
        [Switch]
        $Version
    )

    if ($PsCmdlet.ParameterSetName -eq 'Version')
    {
        $Disassembly = New-Object Capstone.Capstone([Capstone.Architecture]::X86, [Capstone.Mode]::Mode16)
        $Disassembly.Version

        return
    }

    $Disassembly = New-Object Capstone.Capstone($Architecture, $Mode)

    if ($Disassembly.Version -ne [Capstone.Capstone]::BindingVersion)
    {
        Write-Error "capstone.dll version ($([Capstone.Capstone]::BindingVersion.ToString())) should be the same as libcapstone.dll version. Otherwise, undefined behavior is likely."
    }

    if ($Syntax)
    {
        switch ($Syntax)
        {
            'Intel' { $SyntaxMode = [Capstone.OptionValue]::SyntaxIntel }
            'ATT'   { $SyntaxMode = [Capstone.OptionValue]::SyntaxATT }
        }

        $Disassembly.SetSyntax($SyntaxMode)
    }

    if ($DetailOn)
    {
        $Disassembly.SetDetail($True)
    }

    $Disassembly.Disassemble($Code, $Offset, $Count)
}