Skip to main content

What is it:

Simple Python3 based interactive assembly/disassembly shell for various architectures powered by Keystone/Capstone.

I simply got tired of using metasm_shell and nasm_shell to assemble and disassemble code. Keystone and Capstone are awesome and… I like Python.

How to install it:

pip3 install kcshell

OR (assuming you have Keystone and Capstone build toolchains installed)

git clone https://github.com/fdiskyou/kcshell
cd kcshell
python setup.py install

Usage

By default ‘kcshell’ starts in ‘assembler’ mode (x86 32 bits). You can change modes with ‘setmode’, and you can also change the default architecture for both the ‘assembler’ and ‘disassembler’ with ‘setarch’.

$ kcshell
-=[ kcshell v0.0.3 ]=-
Default Assembler architecture is x86 (32 bits)
asm> lsmodes
disasm, asm
asm> setmode disasm
Default Disassembler architecture is x86 (32 bits)
disasm> lsarchs
x86, mips32, arm_t, x64, arm, x16, arm64, mips64
disasm> setarch x64
Disassembler architecture is now x64
disasm>

To assemble instructions just type the instructions in the command line.

asm> jmp esp
"\xff\xe4"
asm> xor eax, eax
"\x31\xc0"
asm> setarch x64
Assembler architecture is now x64
asm> inc rax
"\x48\xff\xc0"
asm>

To go from opcodes to instructions just type them in the command line.

disasm> \xff\xe4
0x00400000:     jmp     esp
disasm> \x31\xc0
0x00400000:     xor     eax, eax
disasm> setarch x64
Disassembler architecture is now x64
disasm> \x48\xff\xc0
0x00400000:     inc     rax
disasm>

For help just use ‘?’ or ‘help <command>’.

asm> ?

Documented commands (type help <topic>):
========================================
EOF  exit  help  lsarchs  lsmodes  quit  setarch  setmode

asm> setmode disasm
Default Disassembler architecture is x86 (32 bits)
disasm> ?

Documented commands (type help <topic>):
========================================
EOF  exit  help  lsarchs  lsmodes  quit  setarch  setmode

disasm>

To list all the supported architectures just go to the desired mode and use ‘lsarchs’.

asm> lsarchs
mips64, sparc64, sparc, arm_t, x64, x16, arm64, hexagon, systemz, mips32, ppc64, x86, arm, ppc32
asm> lsmodes
asm, disasm
asm> setmode disasm
Default Disassembler architecture is x86 (32 bits)
disasm> lsarchs
mips64, x16, arm64, mips32, arm_t, x86, arm, x64
disasm>

TODO

  • Read input from files

  • Set a proper base address for 64 bits architectures

Metadata

Release files for kcshell 0.0.4

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for kcshell 0.0.4
File Size Uploaded Provenance Actions
kcshell-0.0.4.tar.gz 4.1 kB Without provenance Details for kcshell-0.0.4.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for kcshell 0.0.4
File Interpreter ABI Platform Actions
kcshell-0.0.4-py2-none-any.whl Python 2 none any Details for kcshell-0.0.4-py2-none-any.whl

Total release size: 10.0 kB

Release files / kcshell-0.0.4.tar.gz

Download URL kcshell-0.0.4.tar.gz
Size 4.1 kB
Tags Source
SHA-256 checksum
How to use checksums
1af6035db817c954dc7a2d728afc24a1114f19fe36b50f92f253217d48947b37
BLAKE2b-256 checksum
How to use checksums
61ac5dea167e8b627caa2b62c0028af8516b7608bf05de8358e3036f17e48558
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No

Release files / kcshell-0.0.4-py2-none-any.whl

Download URL kcshell-0.0.4-py2-none-any.whl
Size 5.9 kB
Tags Python 2
SHA-256 checksum
How to use checksums
2cd8b4fa0cf7daa4dab98fac1b49014b46459cadf155068b19d481eabb2c3220
BLAKE2b-256 checksum
How to use checksums
07ea556a96d7a732ecdbe5822ee082b74fb05d1a64896a2f7010dff0200a70ee
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No

Security for kcshell 0.0.4

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

This release

0.0.4 This release

2 release files No provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page