Lilu Documentation

This project provides a shim (vbCapstone.dll) that allows Visual Basic 6 (VB6) to access the Capstone disassembly engine via a stdcall API.

Key Capabilities

• Supports basic disassembly for all processor architectures implemented by Capstone.
• Provides full instruction details specifically for the x86 processor family within the VB code.

Implementation Details

• The vbCapstone.dll is written in C and acts as a bridge to the Capstone API.
• The sample was originally built against Capstone 3.0 rc4. If the underlying Capstone structures change, the bindings may require adjustment.
• The C project expects the <capstone.h> header to be located in ./../../include/ relative to the binding directory.

Lilu is a kernel extension that provides a platform for patching kexts, libraries, and programs. To use it, you must install the Lilu.kext along with any plugin kexts that depend on it.

• Prebuilt Binaries: Available on the releases page.
• Plugin Development: To compile a plugin, copy the debug version of Lilu.kext into the plugin's directory.

The easiest way to install the Capstone Python bindings is using pip, which will automatically attempt to obtain an appropriate precompiled binary distribution for your system.

pip install capstone

To make the Capstone module available in PowerShell, the entire Capstone folder must be added to one of the following PowerShell module directories:

• Global path: %Windir%\System32\WindowsPowerShell\v1.0\Modules
• User path: %UserProfile%\Documents\WindowsPowerShell\Modules

To install the PowerShell binding, you must provide the capstone.dll file for your architecture (x86 or x64).

1. Compile the relevant version of capstone.dll and place it in ./Capstone/Lib/Capstone/.
2. Alternatively, download pre-compiled DLLs from the official Capstone homepage at http://capstone-engine.org/download.

The Capstone.xcodeproj project provides targets for building Capstone for macOS/iOS environments. The two primary targets for integration are:

• CapstoneStatic: Produces libcapstone.a (a static library).
• CapstoneDynamic: Produces libcapstone.dylib (a shared library).

By default, the project is configured to use system implementations of malloc, calloc, realloc, free, and vsnprintf. To change this behavior, modify the Preprocessor Macros build setting at the specific target level (either CapstoneStatic or CapstoneDynamic) that you intend to use.

By default, installing the Python bindings triggers a build of the Capstone native core. If you already have a globally installed copy of libcapstone and wish to prevent a new build, set the LIBCAPSTONE_PATH environment variable.

Setting this variable to any value (including the path to a directory containing a specific version of libcapstone) will inhibit the build process.

To install Capstone directly from the source distribution without using pip, run the setup script from the directory containing setup.py.

Requirements:

• An environment capable of compiling C code.
• Windows users: You must install Visual Studio and use the "Developer Command Prompt" to perform the installation.

python setup.py install

Capstone is a high-performance disassembly engine designed for binary analysis and reversing. It provides an architecture-neutral API and detailed instruction decomposition, including semantics like implicit register reads and writes.

Key features include:

• Multi-architecture support: ARM, ARM64 (ARMv8), Mips, PPC, Sparc, SystemZ, XCore, and X86 (including X86_64).
• Platform support: Windows, Mac OSX, iOS, Android, Linux, *BSD, Solaris, etc.
• Design: Thread-safe, implemented in pure C, and suitable for embedding into firmware or OS kernels.
• Security focus: Capstone is capable of handling various X86 malware tricks, making it suitable for malware analysis.

The capstone/bindings/java directory contains reference implementations for using the Capstone API via Java:

• Test.java: Demonstrates the basic API usage for extracting fundamental instruction information, including the address, mnemonic, and operand string.
• Test_<arch>.java: Demonstrates how to retrieve architecture-specific information for various supported architectures.

To compile and run the Capstone Java test code, you must install OpenJDK and Java Native Access (JNA). On Ubuntu-based systems, use the following commands:

1. Install OpenJDK (e.g., version 6): sudo apt-get install openjdk-6-jre-headless openjdk-6-jdk

2. Install Java Native Access: sudo apt-get install libjna-java