Capstone

Welcome

Capstone is a lightweight multi-platform, multi-architecture disassembly framework.

Our target is to make Capstone the ultimate disassembly engine for binary analysis and reversing in the security community.

Highlight features


Some of the reasons make Capstone unique are elaborated here.


Version 2.1.2

3
Apr
2014

We are happy to announce the stable version 2.1.2 of Capstone disassembly framework!

This fixes some bugs deep inside the core. There is no update to the API interface, so bindings of older version 2.1 are compatible, thus can still be used with this release.

Find the source code & precompiled binaries in the download section. See documentation for how to compile and install Capstone.

Highlights of the changes:

  • Support cross-compilation for all iDevices (iPhone/iPad/iPod).

  • X86: do not print memory offset in negative form.

  • Fix a bug in X86 when Capstone cannot handle short instruction.

  • Print negative numbers in range [-9, -1] without prefix 0x (arm64, mips, arm).

  • Correct the SONAME setup for library versioning on Linux, *BSD & Solaris.

  • Set library versioning for dylib of OSX.

  • Remove the redundant include/diet.h


NOTE

  • This release fixes the library versioning for Mac OSX, Linux, *BSD & Solaris. This might require recompiling tools compiled with prior Capstone - but there is no need to modify tools’ source whatsoever.

  • This version made no API change, so old bindings of release 2.1 still work just fine. The only exception is Python binding package for Windows in Download section: users still need to upgrade this as this package actually includes the new core engine 2.1.2 inside.


submit to reddit

CEbot - reverse binary code using just Twitter

24
Mar
2014

We running a CEbot, a tool help you disassemble binary code right from your Twitter account.

To use CEbot, follow these 2 simple steps:

  • Tweet your hex string with hashtag #2ce (”To-Capstone-Engine”), or send it directly to @ceb0t.

  • Wait 1 ~ 2 seconds, the reversed assembly code will be sent back, also via Twitter. Be sure to check the Notifications tab if you do not see it soon enough.


Further information is available here


submit to reddit

Version 2.1.1

13
Mar
2014

We are glad to announce a stable version 2.1.1 of Capstone disassembly framework!

This is a stable release to fix some bugs deep in the core. There is no new update to any architectures or bindings, so programs written with version 2.1 still work without having to recompile. Besides, bindings of older version 2.1 are compatible, thus can still be used this release.

The source code & precompiled binaries are in the download section. See documentation for how to compile and install Capstone.

Highlights of the changes:

  • Fix a buffer overflow bug in Thumb mode (ARM). For this reason, all ARM users should upgrade.

  • Fix a crash issue when embedding Capstone into Mac OSX kernel by reducing the stack memory usage. This should also enable Capstone to be embedded into other systems with limited stack memory size such as Linux kernel or some firmwares.

  • Use a proper SONAME for library versioning (Linux).

  • See changelog for more details.


NOTE

  • This version made no API change, so old bindings of release 2.1 still work just fine. The only exception is Python binding package for Windows in Download section: users still need to upgrade this as this package actually includes the new core engine 2.1.1 inside.

submit to reddit

Version 2.1!

5
Mar
2014

We are happy to announce version 2.1 of Capstone disassembly framework!

The source code & precompiled binaries are in the download section. See documentation for how to compile and install Capstone.

Highlights of some important changes:

  • Library size is around 40% smaller, but framework is faster. Especially, X86-only binary is about 3 times smaller than in version 2.0: only 780 KB now.

  • Support diet compilation option to minimize the framework, making Capstone more suitable for embedding into OS kernel or firmware. Example: X86-only engine is only 480 KB with this customization.

  • Consume less memory: around 40% less than version 2.0.

  • Python binding offers some new lighter APIs that can improve performance up to 30%.

  • Fixed some memory leaking issues of Java & Cython bindings.

  • Lots of bugfixes.

  • API version bumped to 2.1.

  • See changelog for more details.


NOTE

  • This version made an API change, so some (trivial) modifications to 2.0-based tools are needed to switch to 2.1.

  • Make sure to install the Python/Java bindings coming with this version, as the old bindings from version 2.0 are incompatible with the new core.



Version 2.0!

22
Jan
2014

We are happy to announce version 2.0 of Capstone disassembly framework!

The source code & precompiled binaries are in the download section. See documentation for how to compile and install Capstone.

Version 2.0 brings a lot of important changes:

  • Library size is around 50% smaller.

  • Much less memory usage.

  • Framework is way faster. Especially, the Python binding is 3 ~ 4 times faster than in 1.0.

  • New architecture added: PowerPC

  • Architectures updated with new instructions & hardware modes for Arm, Arm64 & Mips.

  • Flexibility of choosing which architectures to be compiled in, so you can tailor library to your need.

  • Support for embedding Capstone into special environments such as kernel or firmware.

  • Some critical bug fixes.


NOTE

  • Version 1.0 is now considered obsolete and we no longer support it.

  • Version 2.0 made few API changes, so some (trivial) modifications to 1.0-based tools are needed to switch to 2.0.


Version 2.0-RC1

16
Jan
2014

We are pleased to announce the Release Candidate 1 of version 2.0 of Capstone!

The source code tarball is available here, or at tagname 2.0-rc1 in our Github repo.

Please test and feed back via our contact.


Version 1.0!

18
Dec
2013

We are excited to announce the 1.0 version of Capstone disassembly framework!

The source code & precompiled binaries are available in the download section. See documentation for how to compile and install Capstone.

Please contact us for any question.


See the news archive for older posts.