Capstone is a disassembly framework with the target of becoming the ultimate
disasm engine for binary analysis and reversing in the security community.
Created by Nguyen Anh Quynh, then developed and maintained by a small community,
Capstone offers some unparalleled features:
- Support multiple hardware architectures: ARM, ARM64 (ARMv8), Mips, PPC, Sparc,
SystemZ and X86.
- Having clean/simple/lightweight/intuitive architecture-neutral API.
- Provide details on disassembled instruction (called “decomposer” by others).
- Provide semantics of the disassembled instruction, such as list of implicit
registers read & written.
- Implemented in pure C language, with lightweight wrappers for C++, C#, Go,
Java, Ocaml, Python, Ruby & Vala ready (either available in main code,
or provided externally by community).
- Native support for Windows & *nix platforms (with OSX, Linux, *BSD & Solaris
have been confirmed).
- Thread-safe by design.
- Special support for embedding into firmware or OS kernel.
- Distributed under the open source BSD license.
Further information is available at http://www.capstone-engine.org
[Compile]
See COMPILE.TXT file for how to compile and install Capstone
[Status]
- Capstone can only compile to Windows via Cygwin, or cross-compile using
MingW. Visual Studio support will be done in the future.
- X86 engine cannot handle many malware tricks yet. Please report all the raw
binary code that Capstone cannot disassemble, or does that wrongly, so we can
fix that in the next version
- This package only contains Java & Python bindings. For C#, Go, Ocaml & Ruby,
refer to the corresponding git repositories.
[Hack]
See HACK.TXT file for the structuture of the source code.
[License]
This project is released under the BSD license. If you redistribute the binary
or source code of Capstone, please attach file LICENSE.TXT with your products.
81a6df4d00