aquynh/capstone
Capstone
Capstone is a multi-architecture disassembly framework and binary translation system. It converts binary machine code into human-readable assembly instructions for a wide variety of hardware instruction set architectures and virtual machines.
The framework supports a diverse range of targets, including x86, ARM, RISC-V, and MIPS, as well as virtual machine environments like WebAssembly and the Ethereum Virtual Machine. It functions as an instruction analysis tool capable of extracting granular decomposition data and semantic information from disassembled code.
The engine is designed for low-level binary analysis and can be embedded within constrained environments such as operating system kernels or hardware firmware due to its minimal external dependencies.
Features
- Binary Disassembly - Converts binary machine code into human-readable assembly instructions for processor analysis.
- Multi-Architecture Engines - Supports multiple CPU instruction sets and virtual machines via a unified disassembly engine.
- Binary Analysis Tools - Provides a lightweight binary analysis engine designed for use in firmware or operating system kernels.
- Instruction Analysis Tools - Extracts granular decomposition data and semantic information from disassembled instructions.
- Instruction Semantic Extraction - Retrieves granular decomposition data and semantic information such as implicit register reads and writes for each instruction.
- Kernel and Firmware Embedding - Supports running inside firmware or operating system kernels through a lightweight design with minimal external dependencies.
- Low-Level Binary Analysis - Examines how a processor executes specific operations by extracting granular instruction details and semantic data from binaries.
- Bytecode Assemblers - Translates binary machine code into human-readable assembly for both hardware architectures and virtual machines.
- Disassembler Frameworks - Provides a consistent API for adding new processor supports without altering the primary processing loop.
- Zero-Dependency Libraries - Designed without external library links to enable execution within constrained environments like kernels and firmware.
- Virtual Machine - Supports disassembly for virtual machine architectures including WebAssembly and the Ethereum Virtual Machine.
- Firmware Analysis Tools - Enables disassembly logic to run inside firmware environments for security analysis.
- Reverse Engineering Tools - Analyzes binary files across multiple CPU architectures to understand software behavior and instruction-level logic.
- Dynamic Binary Translators - Translates machine code across diverse instruction set architectures from x86 and ARM to RISC-V and MIPS.
- Stateless Translators - Converts machine code to assembly without maintaining internal state between separate instruction sequences.
- Operand Decompositions - Breaks down complex instructions into individual components to expose implicit register usage and flags.
- Table-Driven Decoding - Uses predefined lookup tables to map binary opcodes to assembly mnemonics and operand formats.
- Architecture Isolation - Implements a modular architecture that isolates processor-specific decoding logic into dedicated modules.
- Binary Analysis Platforms - Multi-architecture disassembly framework for binary analysis.
- Binary Analysis Tools - Multi-architecture disassembly framework for binary analysis.
- Compiler Backends - Multi-platform disassembly framework.
- Development Tools - Framework for disassembly and reverse engineering.
- General Libraries - Framework for disassembly and binary analysis.
- Reverse Engineering Tools - Lightweight multi-platform, multi-architecture disassembly framework.
- Reverse Engineering - Disassembles binary code across multiple architectures.
- Reverse Engineering And Security - Disassembly and disassembler framework.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
