capstone-engine/capstone
Capstone
Capstone is a multi-architecture disassembly framework and binary analysis engine. It translates raw machine code from various CPU architectures, such as x86, ARM, and RISC-V, into human-readable assembly instructions.
The engine distinguishes itself by providing instruction semantic decomposition, which lists implicit registers read and written, and the ability to customize instruction mnemonics to meet specific technical analysis standards. It also features resilient stream disassembly, allowing the process to resynchronize and continue after encountering invalid instructions or embedded data.
The framework covers a broad range of binary analysis capabilities, including detailed operand extraction and multi-architecture machine code conversion. To support constrained environments, it allows for the pruning of unused architecture definitions to reduce the final binary memory footprint.
Features
- Binary Disassembly - Translates raw binary data into readable assembly instructions to analyze program functionality at the lowest level.
- Disassembler Frameworks - Provides a comprehensive framework for translating raw binary machine code from multiple CPU architectures into human-readable assembly.
- Multi-Architecture Engines - Supports a wide range of processor architectures in a single framework for analyzing different hardware binaries.
- Compiled Code Analysis - Translates raw machine code from various hardware architectures into readable assembly to understand program functions.
- Binary Analysis Tools - Decomposes machine instructions into granular semantics and extracts detailed operand and register access information.
- Resilient Disassembly - Continues processing binary data after skipping invalid instructions or embedded data to recover subsequent code blocks.
- Stream Resynchronization - Allows the disassembly engine to resume processing a binary stream after encountering invalid instructions or embedded data.
- Cross-Architecture Binary Analysis - Transforms binary machine code from various hardware architectures into human-readable assembly instructions.
- Instruction Semantic Extraction - Decomposes instructions into granular semantics and lists implicit registers read and written for deep analysis.
- Machine Code Converters - Transforms binary data from various CPU architectures including x86, ARM, and RISC-V into assembly.
- Operand Decompositions - Analyzes machine code fields to determine specific memory addresses or registers targeted by instructions.
- Binary and Reverse Engineering - Facilitates reverse engineering by decomposing instructions into granular semantics and extracting operand details.
- Firmware Analysis Tools - Processes binary streams containing mixed data and invalid instructions to recover code from firmware dumps.
- Mnemonic Mappings - Implements dynamic mapping of internal opcode identifiers to customizable human-readable assembly strings.
- Mnemonic Customization - Allows the modification of assembly instruction names to match specific technical requirements or analysis standards.
- Hardware Dispatchers - Maps raw binary streams to specific hardware instruction decoders based on the selected target.
- Architecture Pruning - Provides a mechanism to exclude unused architecture definitions to reduce the engine's memory footprint.
- Binary Footprint Optimizers - Supports the removal of unused architectures and non-critical data to reduce the memory footprint.
