Skip to content

Instantly share code, notes, and snippets.

@jarkkojs
Created November 7, 2024 08:19
Show Gist options
  • Save jarkkojs/140c5f9e76c7cc5c30bb9b5a1514a546 to your computer and use it in GitHub Desktop.
Save jarkkojs/140c5f9e76c7cc5c30bb9b5a1514a546 to your computer and use it in GitHub Desktop.
raw = open('/home/jarkko/work/nnn/nnn', 'rb')
from elftools.elf.elffile import ELFFile
elf = ELFFile(raw)
symtab = {s.name: s for s in (elf.get_section_by_name('.symtab')).iter_symbols()}
sym = symtab.get('move_cursor')
addr = sym['st_value']
size = sym['st_size']
text = elf.get_section_by_name('.text')
offset = addr - text['sh_addr'] + text['sh_offset']
raw.seek(offset)
payload = raw.read(size)
from capstone import Cs, CS_ARCH_ARM64, CS_MODE_ARM)
disasm = Cs(CS_ARCH_ARM64, CS_MODE_ARM)
for opcode in disasm.disasm(payload, addr):
print(f"0x{opcode.address:x}:\t{opcode.mnemonic}\t{opcode.op_str}")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment