Welcome

Capstone is a lightweight multi-platform, multi-architecture disassembly framework.

Our target is to make Capstone the ultimate disassembly engine for binary analysis and reversing in the security community.

Highlight features


Some of the reasons making Capstone unique are elaborated here.

Find in this Blackhat USA 2014 slides more technical details behind our disassembly engine.

Testimonials

“Capstone is something people have wanted for years; the value is apparent in the implementation, and it’s nice to finally have an industry standard for this”. – George “Geohot” Hotz.

“Capstone has changed the Reverse Engineering landscape: We finally have a solid, independent, and free disassembler engine”. – Felix “FX” Lindner.

“Capstone will soon be the standard disassembly engine”. – Bruce Dang.

“Capstone solves a well known issue in the reversing community by a well tested and maintained library for most common architectures using a generic API”. – Pancake.

“And, nowadays, Capstone is the best embeddable disassembler out there”. – Joxean Koret.

“I must have mentioned it at least 25 times today with our client. Not sure yet, but this engine might just be the gold standard”. – Stephen Ridley.

“Developers of Capstone provide great support. Its small size and high modularity makes it perfectly working in kernel as well!”. – Peter Hlavaty.

“Love at first sight! Beautiful API, support latest instructions, Capstone truly is the ultimate disassembly framework!”. – Ole André Vadla Ravnås.

“Simply the best - recommended to anyone asking which disassembler to use!”. – Jurriaan Bremer.

“The most complete disassembler library available for the reverse engineering and information security communities”. – Pedro “osxreverser” Vilaça.

“The API is straightforward and easy to work with, and on the few occasions we have run into issues the Capstone developers have provided bug fixes, new features, and support in a matter of hours”. – Sean Heelan.

“I expect Capstone to become the standard, a stepping stone for all projects everywhere”. – Ange Albertini.

See complete testimonials for Capstone here.


Version 6.0.0-Alpha11

September 21, 2026

We are happy to announce Capstone 6.0.0-Alpha11.

Highlights

This is another patch release with multiple instruction fixes and bug fixes.

This release adds an AGENTS.md file and developer AI guidelines.

API changes/additions

  • x86: Support alternative disassembly for JO/JNO operands in 64-bit mode. This adds two modes for x86: CS_MODE_X86_AMD and CS_MODE_X86_INTEL. Setting either of these flags will currently only affect the JO/JNO instructions. Please check the release guide for more details. The default behavior of the x86 module did not change.
  • Xtensa: Gate ESP32-S3 and HIFI3 instructions behind CS_MODE_XTENSA_ESP32S3

New instruction

  • PowerPC: add mcrxr instruction support

Instruction fixes

  • AArch64: report NZCV access for MRS/MSR of NZCV
  • HHPA: Correct name of r0 register - flags -> r0
  • x86: use effective address size for the loop counter register
  • x86: fix VMOVUPS memory operand access
  • PowerPC: Keep BI out of the CTR-only branch predicate
  • x86: fix EVEX writemask access in AT&T syntax

Version 6.0.0-Alpha10

August 21, 2026

We are happy to announce Capstone 6.0.0-Alpha10.

API changes and additions

  • Enum names of the Alpha architecture are now correctly all upper case. Because of an old Auto-Sync bug all the enum names were prefixed with Alpha instead of ALPHA and some contained lower case letters. Sadly, I just recently recognized that Alpha was effected by that bug.

    While this change is very annoying for everybody using the Alpha module, it must be done before the Beta release. Please excuse the inconvenience!

    A simple command to replace almost all of these occurrences in your code base is:

    find . -type f -regex ".*\.\(c\|h\)$" -exec sed -i -E "s|Alpha_([A-Z0-9_]+)|ALPHA_\1|g" {} +
    

    Author: @Rot127

  • RISC-V got a v5 compatibility macro for its header. With its recent module update CS_MODE_RISCVC was renamed to CS_MODE_RISCV_C to be more consistent with the other CS_MODE_ enums. This could break builds against a v5 code base which only has CS_MODE_RISCVC.

    Now you can simply define CAPSTONE_RISCV_COMPAT_HEADER before including capstone.h and CS_MODE_RISCVC will be defined as alias for CS_MODE_RISCV_C

    #define CAPSTONE_RISCV_COMPAT_HEADER
    #include <capstone/capstone.h>
    

    Author: @moste00

  • Prevent literal displacement truncation for AArch64 memory operands. There are AArch64 displacements which are 64bit in size. But aarch64_op_mem.disp was an int32_t. It was promoted to an int64_t. Author: @amaanmujawar

  • Fixed several decoding bugs in the Alpha module. See https://github.com/capstone-engine/capstone/pull/2967 for details. Author: @mattst88

  • The RISC-V details now also include the FP rounding mode cs_riscv.rounding_mode. Author: @moste00

  • AArch64: Add CS_OPT_SYNTAX_AARCH64_EXPLICIT_WIDE_IMM flag to print shifted MOVN and MOVZ instructions in their explicit forms instead of using the equivalent MOV aliases.

    Example output from cstool:

    > cstool aarch64 0xe402a012
    mov w4, #-0x170001
    
    > cstool aarch64+explicitwideimm 0xe402a012
    movn w4, #0x17, lsl #16
    
    > cstool aarch64+explicitwideimm 0xe402a052
    movz w4, #0x17, lsl #16
    

    Author: @amaanmujawar

  • M68K: Fixed EA decoding error and added ColdFire EMAC_B dual-acc MAC. Author: @b1llow

See the full release notes at https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10

Version 6.0.0-Alpha9

May 29, 2026

We are happy to announce Capstone 6.0.0-Alpha9.

This release fixes the security advisories GHSA-5m9f-vqcm-g5pr and GHSA-jrw4-wj52-2vw8, and adds the pre-release version to capstone.h.

See the full release notes at https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha9

Version 5.0.9

May 28, 2026

We are happy to announce Capstone 5.0.9.

This stable patch release sets the correct version number in CS_VERSION_EXTRA and includes backports of CVE fixes and #2935.

See the full release notes at https://github.com/capstone-engine/capstone/releases/tag/5.0.9

Version 6.0.0-Alpha8

May 23, 2026

We are happy to announce Capstone 6.0.0-Alpha8.

This patch alpha release adds ColdFire ISA support, expands M680X support, improves RISC-V details, speeds up x86 decoding, and adds x86 MOVSXD.

See the full release notes at https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha8

Version 5.0.8

May 23, 2026

We are happy to announce Capstone 5.0.8.

This patch release adds x86 decoding speedups, RTLD_DEEPBIND loading for Python on Linux, and support for x86 MOVSXD instructions.

See the full release notes at https://github.com/capstone-engine/capstone/releases/tag/5.0.8

Version 6.0.0-Alpha7

February 16, 2026

We are happy to announce Capstone 6.0.0-Alpha7.

This alpha release delivers the major RISC-V module update, 32-bit build coverage, consistent CS_ERR_MEM reporting, and x86-64 segment override behavior fixes.

See the full release notes at https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha7

Version 5.0.7

February 9, 2026

We are happy to announce Capstone 5.0.7.

This security release fixes CMake 4 build issues and backports fixes for CVE-2025-68114 and CVE-2025-67873.

See the full release notes at https://github.com/capstone-engine/capstone/releases/tag/5.0.7

See the news archive for older posts.