Capstone is a lightweight disassembly framework intended for embedding in binary analysis and reverse-engineering applications. It provides an architecture-neutral API over a very broad collection of instruction sets, allowing software to decode machine code without implementing separate disassemblers for each target.
Capstone is a framework rather than a complete interactive binary analyser. Its main role is to supply accurate instruction decoding and detailed metadata to security tools, debuggers, reverse-engineering applications and custom scripts. Its relatively small C core also makes it suitable for constrained environments.
This is free and open source software.
Key Features
- Support a large collection of processor architectures and virtual instruction sets.
- Decode x86 code in 16-bit, 32-bit and 64-bit modes.
- Support ARM, AArch64, MIPS, PowerPC, RISC-V, SPARC and SystemZ.
- Cover additional targets including Alpha, BPF, M68K, SH, TriCore, Xtensa and WebAssembly.
- Provide a consistent architecture-neutral programming interface.
- Return detailed information about decoded operands.
- Report implicit registers read and written by instructions.
- Expose instruction semantic information useful to higher-level analyses.
- Use a compact C implementation suitable for embedding.
- Be thread-safe by design.
- Support embedding in firmware and operating-system kernels.
- Offer reduced-footprint operation for constrained environments.
- Handle instruction patterns encountered during malware analysis.
- Provide bindings for Python, C#, Java, Go, Rust, Ruby, Lua and many other languages.
- Run natively on Linux and other major operating systems.
- Use extensive automated testing and fuzzing.
Website: github.com/capstone-engine/capstone
Support:
Developer: Nguyen Anh Quynh and contributors
License: BSD 3-Clause License
Capstone is written in C.
Related Software
| Binary Analysis Tools | |
|---|---|
| Ghidra | Software reverse engineering framework |
| Radare2 | Portable reversing framework |
| Cutter | Graphical reverse engineering platform |
| Detect it Easy | File inspection utility |
| ImHex | Analyze binary data |
| capa | Command line malware analysis tool |
| binwalk | Search a given binary image for embedded files |
| FLOSS | FLARE Obfuscated String Solver |
| unblob | Extraction suite for working with unknown binary blobs |
| Rizin | UNIX-like reverse engineering framework |
| LIEF | Work with executable and binary formats |
| RetDec | Retargetable machine-code decompiler |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.