Capstone is a lightweight disassembly framework intended for embedding in binary analysis and reverse-engineering applications. It provides an architecture-neutral API over a very broad collection of instruction sets, allowing software to decode machine code without implementing separate disassemblers for each target.
Capstone is a framework rather than a complete interactive binary analyser. Its main role is to supply accurate instruction decoding and detailed metadata to security tools, debuggers, reverse-engineering applications and custom scripts. Its relatively small C core also makes it suitable for constrained environments.
This is free and open source software.
Key Features
- Support a large collection of processor architectures and virtual instruction sets.
- Decode x86 code in 16-bit, 32-bit and 64-bit modes.
- Support ARM, AArch64, MIPS, PowerPC, RISC-V, SPARC and SystemZ.
- Cover additional targets including Alpha, BPF, M68K, SH, TriCore, Xtensa and WebAssembly.
- Provide a consistent architecture-neutral programming interface.
- Return detailed information about decoded operands.
- Report implicit registers read and written by instructions.
- Expose instruction semantic information useful to higher-level analyses.
- Use a compact C implementation suitable for embedding.
- Be thread-safe by design.
- Support embedding in firmware and operating-system kernels.
- Offer reduced-footprint operation for constrained environments.
- Handle instruction patterns encountered during malware analysis.
- Provide bindings for Python, C#, Java, Go, Rust, Ruby, Lua and many other languages.
- Run natively on Linux and other major operating systems.
- Use extensive automated testing and fuzzing.
Website: github.com/capstone-engine/capstone
Support:
Developer: Nguyen Anh Quynh and contributors
License: BSD 3-Clause License
Capstone is written in C.
Related Software
| Binary Analysis Tools | |
|---|---|
| Ghidra | Software reverse engineering framework |
| Radare2 | Portable reversing framework |
| Cutter | Graphical reverse engineering platform |
| Capstone | Lightweight multi-architecture disassembly framework |
| Detect it Easy | File inspection utility |
| ImHex | Analyze binary data |
| Miasm | Reverse engineering framework for analysing and emulating binaries |
| Reko | General-purpose decompiler for machine-code binaries |
| capa | Command line malware analysis tool |
| binwalk | Search a given binary image for embedded files |
| FLOSS | FLARE Obfuscated String Solver |
| unblob | Extraction suite for working with unknown binary blobs |
| Rizin | UNIX-like reverse engineering framework |
| REDasm | Cross-platform disassembler with an extensible graphical interface |
| Pharos | Framework for automated static analysis of binary programs |
| LIEF | Work with executable and binary formats |
| RetDec | Retargetable machine-code decompiler |
| knife | Static binary triage, disassembly and vulnerability analysis toolkit |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.