Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Next major version 4.0 (under development, in the next branch)
After installation, find in tutorials below how to write your reverse & analysis tools based on Capstone using your favorite programming languages.
This documentation explains how to build a more compact engine with only selected architectures. A smaller library is useful when we want to embed Capstone in special environments such as firmware or OS kernel driver.
To make an even smaller engine, version 2.1 presents a diet mode, in which non-critical data is removed. Combined with the method of building only selected architectures above, Capstone binary size can be reduced up to 50% in some cases, make it easier than ever for embedding purpose.
Embedding Capstone requires a special engine, built by special methods. This documentation introduces necessary steps to compile the engine & program your code towards this target.
This introduces the compile-time option named X86-reduce to make X86 engine of Capstone to be ~60% smaller, to just around 100KB.
This introduces the SKIPDATA mode to let Capstone keeps disassembling even when it encounters broken instruction, which is most likely data mixed inside the input.
This explains how to use the API cs_disasm_iter to quickly iterates all the instructions in the input buffer using a memory cache provided by user.
A part of Capstone is built with LLVM code. However, Capstone is not just LLVM, but superior because it is designed & implemented towards disassembling for security purpose.