capstone-engine/capstone
FreeCapstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
About capstone-engine/capstone
Capstone is an open-source disassembly framework designed for binary analysis and reverse engineering. It supports a wide range of hardware architectures including ARM, AArch64, Alpha, ARC, BPF, Ethereum VM, LoongArch, HPPA, M68K, M680X, MIPS, MOS65XX, PPC, RISC-V, SH, Sparc, SystemZ, TMS320C64X, TriCore, WebAssembly, XCore, x86 (16/32/64), and Xtensa. The framework provides a clean, lightweight, and architecture-neutral API, detailed decomposed instruction information, and semantics (e.g., implicit register reads/writes). It is implemented in pure C with bindings for many languages (Python, Ruby, C#, Java, Go, Rust, etc.) and runs natively on Windows, macOS, iOS, Android, Linux, *BSD, and Solaris. Capstone is thread-safe, suitable for kernel embedding, and optimized for high-performance malware analysis. It is distributed under the BSD open-source license.
Key Features
Pros & Cons
- Supports an exceptionally wide range of CPU architectures (over 20)
- Clean and consistent API across all architectures – easy to learn and use
- Provides detailed instruction semantics (register usage, etc.) beyond simple disassembly
- Lightweight and high-performance, suitable for production tools and malware analysis
- Portable across major operating systems and can be embedded in kernels
- Open source (BSD license) with permissive terms for commercial use
- Documentation for specific architecture nuances can be sparse
- Community maintained – updates and new architecture support may lag behind LLVM or other alternatives
- Some bindings (e.g., for less common languages) are community-contributed and may have varying quality