Capstone: Next Generation Disassembly Framework
summary
An open source disassembly engine named Capstone implements eight architectures (x86, ARM, ARM64, MIPS, PowerPC, SPARC, SystemZ, XCore), ships bindings for nine languages (Python, Ruby, C#, Java, NodeJS, Go, OCaml, Vala, C++), and uses a BSD license. It forks the LLVM MC disassembler, rewrites tablegen to emit C, isolates globals to become thread‑safe, and adds operand breakdown plus semantic read/write sets. Project reaches v2.1.2 in ~7 months, plans v3.0, and powers tools like Sigma and a disassembly bot while handling tricky x86 injections others miss. BSD license
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:40Story behind Capstone
- 3:43Binary analysis & software exploit
- 4:54Disassemble machine code
- 8:31X86 instruction encoding
- 9:42Building disassembly frameworks is tedious
- 10:54Demanding for a good disassembly framework
- 12:11Available frameworks (2013)
- 15:31Capstone's goals
- 17:22Problems
- 19:48Capstone status at 7-month old
- 23:21Ambitions & ideas
- 23:46Introduction on LLVM
- 26:53LLVM's Machine Code (MC) layer
- 28:19Advantages
- 33:08Decide where to make the cut
- 38:17extend LLVM's MC
- 44:02Robustness of Capstone
- 45:00Tricky X86 instructions
related talks
24mKeystone Engine: Next Generation Assembler Framework
21mDemystify Today's Binary Disassembling and How Modern ABI Makes it Easier
23mAn In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries
19m"ClangBuiltLinux: What's Next?"
43mToolchains for the Future
48mHow to Build A Decompiler
22mPanopticon - A Libre Cross-Platform Disassembler in Rust
47mThe (Long) Journey to a Multi-Architecture Disassembler