capstone

Capstone Engine is an open-source disassembly framework written in pure C, designed for binary analysis and reverse engineering in the security community. Created by Nguyen Anh Quynh and maintained by a small community of developers, it is distributed under the permissive BSD license. Architecture coverage is one of Capstone's defining characteristics. It handles machine code across a wide range of hardware and virtual architectures: ARM, AArch64 (ARMv8), Alpha, ARC, BPF, Ethereum Virtual Machine, LoongArch, HPPA (PA-RISC), M68K, M680X, MIPS, MOS65XX, PowerPC, RISC-V (rv32G/rv64G), SH, SPARC, SystemZ, TMS320C64X, TriCore, WebAssembly, XCore, Xtensa, and x86 in 16-, 32-, and 64-bit modes. Beyond converting machine code into assembly text, Capstone exposes detailed information about each disassembled instruction — a capability sometimes called 'decomposition' by other tools — including instruction semantics such as which implicit registers are read and written. The API is designed to be clean, lightweight, and architecture-neutral, so the same interface works across all supported targets. Capstone is thread-safe by design and includes special support for embedding into firmware or operating system kernels, making it suitable for low-level and constrained environments. The project describes itself as high performance and capable of handling various x86 malware tricks, positioning it for malware analysis use cases. While the core is implemented in C, bindings are available — either in the main codebase or provided externally by the community — for a long list of languages: Python, C++, C#, Java, Go, Rust, NodeJS, Ruby, Perl, PHP, Lua, Haskell, OCaml, Clojure, F#, Common Lisp, Swift, D, Visual Basic, PowerShell, Emacs Lisp, Delphi, Free Pascal, and Vala. The Python package is published on PyPI. Native builds are supported on Windows, macOS, iOS, Android, Linux, *BSD, and Solaris. The project participates in Google's OSS-Fuzz continuous fuzzing program, and its documentation covers building and installation, software architecture, testing, and an auto-sync updater component. Community discussion takes place in a Telegram group, and contribution guidelines are included in the repository. Typical users include security researchers, malware analysts, and developers building debuggers, tracers, or other tools that need to interpret machine code programmatically. Note that Capstone is a library and framework rather than a standalone GUI application: users integrate it through its C API or one of the many language bindings.