Search the Community

Welcome Capstone is a lightweight multi-platform, multi-architecture disassembly framework. Our target is to make Capstone the ultimate disassembly engine for binary analysis and reversing in the security community. Highlight features Multi-architectures: Arm, Arm64 (Armv8), BPF, Ethereum Virtual Machine, M68K, M680X, Mips, MOS65XX, PowerPC, RISCV, Sparc, SystemZ, TMS320C64X, Web Assembly, XCore & X86 (include X86_64) (details). Clean/simple/lightweight/intuitive architecture-neutral API. Provide details on disassembled instruction (called “decomposer” by some others). Provide some semantics of the disassembled instruction, such as list of implicit registers read & written. Implemented in pure C language, with bindings for D, Clojure, F#, Common Lisp, Visual Basic, PHP, PowerShell, Haskell, Perl, Python, Ruby, C#, NodeJS, Java, GO, C++, OCaml, Lua, Rust, Delphi, Free Pascal & Vala available. Native support for Windows & *nix (with Mac OSX, iOS, Android, Linux, *BSD & Solaris confirmed). Thread-safe by design. Special support for embedding into firmware or OS kernel. High performance & suitable for malware analysis (capable of handling various X86 malware tricks). Distributed under the open source BSD license. [hide][Hidden Content]]