capstone

Capstone Engine is an open‑source disassembly framework written in pure C, designed for binary analysis and reverse engineering in the security community. It was created by Nguyen Anh Quynh and is maintained by a small community of developers, released under the permissive BSD license. A defining feature is its extensive architecture coverage: it handles machine code for ARM, AArch64 (ARMv8), Alpha, ARC, BPF, Ethereum Virtual Machine, LoongArch, HPPA (PA‑RISC), M68K, M680X, MIPS, MOS65XX, PowerPC, RISC‑V (rv32G/rv64G), SH, SPARC, SystemZ, TMS320C64X, TriCore, WebAssembly, XCore, Xtensa, and x86 in 16‑, 32‑ and 64‑bit modes. Beyond converting machine code to assembly text, Capstone exposes detailed instruction information—sometimes called “decomposition”—including semantics such as which implicit registers are read or written. Its API is clean, lightweight, and architecture‑neutral, so the same interface works across all supported targets. The engine is thread‑safe by design and includes special support for embedding into firmware or operating‑system kernels, making it suitable for low‑level and constrained environments. It is described as high‑performance and capable of handling various x86 malware tricks, positioning it for malware‑analysis use cases. While the core is implemented in C, bindings are available (in the main codebase or contributed externally) for many languages: Python, C++, C#, Java, Go, Rust, NodeJS, Ruby, Perl, PHP, Lua, Haskell, OCaml, Clojure, F#, Common Lisp, Swift, D, Visual Basic, PowerShell, Emacs Lisp, Delphi, Free Pascal, and Vala. The Python package is published on PyPI, and native builds are supported on Windows, macOS, iOS, Android, Linux, *BSD, and Solaris. The project participates in Google’s OSS‑Fuzz continuous fuzzing program. Its documentation covers building and installation, software architecture, testing, and an auto‑sync updater component. Community discussion occurs in a Telegram group, and contribution guidelines are included in the repository. Typical users include security researchers, malware analysts, and developers building debuggers, tracers, or other tools that need to interpret machine code programmatically. Capstone is a library and framework rather than a standalone GUI application; users integrate it through its C API or one of the many language bindings.