Skip to content
Tech News
← Back to articles

Capstone – multi-platform, multi-architecture disassembly framework

read original get Radare2 Disassembly Framework → more articles
Why This Matters

Capstone is a versatile, multi-platform disassembly framework that supports numerous architectures, making it an essential tool for binary analysis and reverse engineering. Its lightweight, API-driven design and broad language bindings empower security researchers and developers to efficiently analyze complex binaries across various operating systems. This open-source project is poised to become the industry standard for disassembly engines, enhancing capabilities in malware analysis, firmware embedding, and more.

Key Takeaways

Welcome

Capstone is a lightweight multi-platform, multi-architecture disassembly framework.

Our target is to make Capstone the ultimate disassembly engine for binary analysis and reversing in the security community.

Highlight features

Multi-architectures: ARM, ARM64 (ARMv8), BPF, Ethereum VM, M68K, M680X, Mips, MOS65XX, PowerPC, RISC-V, SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86 (16, 32, 64).

Clean/simple/lightweight/intuitive architecture-neutral API.

Provide details on disassembled instruction (called “decomposer” by some others).

Provide some semantics of the disassembled instruction, such as list of implicit registers read & written.

Implemented in pure C language, with bindings for D, Clojure, F#, Common Lisp, Visual Basic, PHP, PowerShell, Haskell, Perl, Python, Ruby, C#, NodeJS, Java, GO, C++, OCaml, Lua, Rust, Delphi, Free Pascal & Vala available.

Native support for Windows & *nix (with Mac OSX, iOS, Android, Linux, *BSD & Solaris confirmed).

... continue reading