/* CAT(1) */
I've been having a lot of fun with Capstone, Keystone, and Unicorn lately. It's such a robust set of tools that's extremely easy to work with and yet super powerful - all the things you really want in tools. More importantly though, they are fantastic learning tools because they force you to think about and understand lower-level interactions more intimately! As such, anytime I run into an issue lately I try to think of whether or not I can write a quick a little program to utilize their Python bindings.
A quick recap but Capstone is a disasembler, Keystone is an assembler, and Unicorn is an emulation enginge. To that end, I wanted to post about two simple tools I've written this week for daily usage that highlight all three of the libraries. I've found myself already using these tools a lot since I wrote them and I feel they've already paid for themselves. Hopefully someone else gets some usage out of 'em!
The asm_buddy program is a small script using Capstone/Keystone to assemble/disassemble x86 and x64 instructions direction from the command line.
You can add the below functions into your .bashrc or .bash_profile for quick access to either.
Using the functions above, it's pretty straight forward.
For assembling -
For disassembling -
A couple of other options can be used directly for more control over architecture.
The shellbug program is a basic command-line, text-based, shellcode debugger using Capstone/Unicorn.
I wanted to put together a small tool for stepping forward and backward through basic shellcode interactively. It doesn't currently support external depedencies like API's but it's good for testing assembly you write for exploits or whatever.
The below ASM is a good example 'Hello World' that touches most aspects of the program.
The program takes shellcode from STDIN and then emulates it in a familiar debugging interface.
Currently it only supports four basic commands but it's a good start.
It's probably quite buggy as I wrote it over the course of a night but I haven't seen too many issues yet beyond typical emulation problems where the environment wasn't staged correctly.
Enjoy!