Capstone
Capstone is a lightweight multi-platform, multi-architecture disassembly framework.
Multiple architectures
Capstone is one of a very few disassembly frameworks that can support multi-architectures. So far, it can handle 4 most important architectures: ARM, ARM64 (aka ARMv8/AArch64), Mips & X86. More will be added in the future when possible.
Updated
As far as we are aware, in all 4 architectures, Capstone can handle more instructions than other frameworks. Especially, it even supports most modern CPU extensions & is guaranteed to remain updated in the future.
Clean, simple & intuitive architecture-neutral API
Clean & intuitive is the key principle in designing the API for Capstone. The interface has always been as simple as possible. It would take a new user just few minutes to understand & start writing his own tool based on available samples accompanying Capstone source code.
Even better, the API is independent of the hardwares, so your analysis tool can work in the same way across all the architectures.
Detailed instruction information
Capstone breaks down instruction information, making it straightforward to access to instruction operands & other internal instruction data.
This feature is called “decomposer” by some alternatives, but Capstone is the only framework having this across all the architectures, in seamless way.
Instruction semantics
Capstone provides some important semantics of the disassembled instruction, such as list of implicit registers read & written, or if this instruction belongs to a group of instructions (such as ARM Neon group, or Intel SSE4.2 group). Now writing your own machine code normalization becomes easier than ever.
Zero barrier
Implemented in pure C language, Capstone is easy to be adopted for your low-level tool. Furthermore, lightweight & efficient bindings for popular languages such as Python, Ruby, OCaml, C#, Java & Go are also available.
Note that all of our the bindings are all manually coded, since we do not want to rely on bloated SWIG for wrapping.
Multiple platforms
With native support for Windows & *nix (confirmed to work on OSX, Linux, FreeBSD & OpenBSD), Capstone is available for your tools regardless of the platform.
Thread-safe
Thread-safe is the first priority when designing & implementing Capstone. Thanks to this feature, your tools can disassemble binary code in multiple threads without any issue.