title: Capstone cs_disasm disassembly only small portion of code
body: <p>I'm experimenting with <a href="http://www.capstone-engine.org" rel="nofollow noreferrer">http://www.capstone-engine.org</a> on MacOS and MacOS x86_64 binary. It more or less does work, however i do have 2 concerns.</p>
  
  <p>I'm loading test dylib</p>
  
  <pre><code>[self custom_logging:[NSString stringWithFormat:@"Module Path:%@",clientPath]];
  NSMutableData *ModuleNSDATA = [NSMutableData dataWithContentsOfFile:clientPath];
  [self custom_logging:[NSString stringWithFormat:@"Client Module Size: %lu MB",(ModuleNSDATA.length/1024/1024)]];
  [ModuleNSDATA replaceBytesInRange:NSMakeRange(0, 20752) withBytes:NULL length:0];
  uint8_t *bytes = (uint8_t*)[ModuleNSDATA bytes];
  long size = [ModuleNSDATA length]/sizeof(uint8_t);
  [self custom_logging:[NSString stringWithFormat:@"UInt8_t array size: %lu",size]];
  ModuleASM = [NSString stringWithCString:disassembly(bytes,size,0x5110).c_str() encoding:[NSString defaultCStringEncoding]];
  </code></pre>
  
  <ol>
  <li>As far i did my research it seems i need to trim "first" bytes from binary code to remove header and metadata until it encounters real instructions. However i'm not really sure if capstone do provide any api for this or that i need to scan by byte patterns and locate first instruction address.</li>
  </ol>
  
  <p>In fact i've applied simple workaround, i did found safe address which for sure will have instructions on most modules i will load, however i would like to apply proper solution.</p>
  
  <ol start="2">
  <li>I've successfully loaded and disassembled part of module code using workaround i've described. However, sadly, <strong>cs_disasm</strong> returns mostly no more than 5000-6000 instructions, which is confusing, it seems it breaks on regular instructions which it shouldn't broke on to. I'm not really sure what i'm doing wrong. Module is more than 15mb of code, so there is a lot more than 5k instructions to disassembly. </li>
  </ol>
  
  <p>Below is function i've based on Capstone Docs example</p>
  
  <pre><code>string disassembly(uint8_t *bytearray, long size, uint64_t startAddress){
      csh handle;
      cs_insn *insn;
      size_t count;
      string output;
      if (cs_open(CS_ARCH_X86, CS_MODE_64, &amp;handle) == CS_ERR_OK){
      count = cs_disasm(handle, bytearray, size, startAddress, 0, &amp;insn);
             printf("\nCOUNT:%lu",count);
          if (count &gt; 0) {
              size_t j;
              for (j = 0; j &lt; count; j++) {
                  char buffer[512];
                  int i=0;
                  i = sprintf(buffer, "0x%" PRIx64":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic,insn[j].op_str);
                  output += buffer;
              }
              cs_free(insn, count);
          } else {
              output = "ERROR: Failed to disassemble given code!\n";
          }
      }
      cs_close(&amp;handle);
      return output;
  }
  </code></pre>
  
  <p>I will really appreciate any help on this.<br>
  Warmly,<br>
  David</p>