Home

ChangeLog

• ChangeLog 3.0.5 - to be released

• ChangeLog 3.0.4

• ChangeLog 3.0.3

---

Next branch

Next major version 4.0 (under development, in the next branch)

• ChangeLog

• Capstone 4.0 - new API on explicit registers

---

Programming

After installation, find in tutorials below how to write your reverse & analysis tools based on Capstone using your favorite programming languages.

• Programming with C language.

• Programming with Python language.

• Programming with Java language.

• Retrieve access information of instruction operands.

• Customize instruction mnemonics at run-time.

---

Miscellaneous

• List of architectures supported by Capstone.

• Build a compact engine with only selected architectures

  This documentation explains how to build a more compact engine with only selected architectures. A smaller library is useful when we want to embed Capstone in special environments such as firmware or OS kernel driver.

• Build "diet" engine to further slim down its size

  To make an even smaller engine, version 2.1 presents a diet mode, in which non-critical data is removed. Combined with the method of building only selected architectures above, Capstone binary size can be reduced up to 50% in some cases, make it easier than ever for embedding purpose.

• Build embedded engine for firmware/OS kernel

  Embedding Capstone requires a special engine, built by special methods. This documentation introduces necessary steps to compile the engine & program your code towards this target.

• Build X86-reduce engine for firmware/OS kernel

  This introduces the compile-time option named X86-reduce to make X86 engine of Capstone to be ~60% smaller, to just around 100KB.

• SKIPDATA mode

  This introduces the SKIPDATA mode to let Capstone keeps disassembling even when it encounters broken instruction, which is most likely data mixed inside the input.

• Iteration disassembling

  This explains how to use the API cs_disasm_iter to quickly iterates all the instructions in the input buffer using a memory cache provided by user.

• Beyond LLVM

  A part of Capstone is built with LLVM code. However, Capstone is not just LLVM, but superior because it is designed & implemented towards disassembling for security purpose.