FRESH

Hacker News

Capstone Disassembler Framework

102 points by xvilka

by woodruffw

3 subcomments

Capstone supports an impressive breadth of architectures. However, if all you need is x86/AMD64 decoding and disassembly, there are much higher quality (in terms of accurate decoding) libraries out there.
I wrote a differential fuzzer for x86 decoders a few years ago, and XED and Zydis generally performed far better (in terms of accuracy) than Capstone[1]. And on the Rust side, yaxpeax and iced-x86 perform very admirably.
[1]: https://blog.trailofbits.com/2019/10/31/destroying-x86_64-in...

by jstrieb

0 subcomment

Capstone is very useful!
Someone (not me) has also cross-compiled Capstone to WebAssembly so it can be used in client-side browser applications.
https://alexaltea.github.io/capstone.js/
I've used this in a couple of projects to support disassembly in static web apps with no back end.

by __alexander

2 subcomments

If you find Capstone interesting, check out the Unicorn Engine.
https://github.com/unicorn-engine/unicorn
Also, if anyone is interested in an example of using capstone for basic disassembly and analysis, here is a link to my capstool project.
https://github.com/alexander-hanel/capstool

by smolsky

1 subcomments

It's difficult to find a succinct overview. Here is a slide deck buried among links: http://www.capstone-engine.org/BHUSA2014-capstone.pdf

by post-factum

1 subcomments

It is also used in one of the Linux kernel debuggers: https://codeberg.org/pf-kernel/crush

by nicolodev

3 subcomments

Another good replacement for capstone/keystone based on LLVM is nyxstone https://github.com/emproof-com/nyxstone

by Cieric

0 subcomment

Haven't had a chance to use capstone yet, but a project I really like happens to use it.
https://github.com/xoreaxeaxeax/sandsifter

by deoxykev

0 subcomment

by stonethrowaway

1 subcomments