Capstone Disassembly Framework

Capstone is a high-performance disassembly framework designed for binary analysis and reversing.

Key Features:

• Multi-Architecture Support: ARM, ARM64 (ARMv8), Mips, PPC, Sparc, SystemZ, XCore, and X86 (including X86_64).
• Detailed Instruction Analysis: Provides details on disassembled instructions and instruction semantics (e.g., lists of implicit registers read and written).
• Cross-Platform: Native support for Windows, Mac OSX, iOS, Android, Linux, *BSD, Solaris, etc.
• Design: Thread-safe, lightweight, and implemented in pure C with wrappers for multiple languages (Python, C++, C#, Go, Java, NodeJS, etc.).
• Security Focused: High performance and capable of handling various X86 malware tricks.

Capstone is a high-performance disassembly framework designed for binary analysis and reverse engineering. It provides a clean, architecture-neutral API and is thread-safe by design.

Key features include:

• Multi-architecture support: ARM, ARM64 (ARMv8), BPF, Ethereum VM, M68K, M680X, Mips, MOS65XX, PPC, RISC-V (rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore, and X86 (16, 32, 64).
• Instruction Details: Provides deep details on disassembled instructions and instruction semantics (e.g., lists of implicit registers read and written).
• Platform Support: Native support for Windows, Mac OSX, iOS, Android, Linux, *BSD, and Solaris.
• Specialized Use Cases: High performance suitable for malware analysis and special support for embedding into firmware or OS kernels.

This project provides VB6 bindings for the Capstone disassembly engine via a C-based shim (vbCapstone.dll). It allows VB6 applications to perform basic disassembly across all processor architectures supported by Capstone.

Limitations:

• Full instruction details are currently only supported for the x86 processor family.
• The shim is written in C and provides a stdcall API to bridge VB6 to the Capstone engine.

Compatibility Note: This sample was built against Capstone 3.0 rc4. If the underlying Capstone structures change, the VB6 code must be adjusted to match the new definitions.

Once Capstone is built, navigate to the suite/benchmark directory and use make to compile the benchmark tools.

cd suite/benchmark
make

The Capstone.xcodeproj project allows you to build Capstone within an Xcode workspace. The project contains 13 targets, with the two primary targets for library generation being:

• CapstoneStatic: Produces libcapstone.a (a static library).
• CapstoneDynamic: Produces libcapstone.dylib (a shared library).

Other targets include various test suites (e.g., test, test_arm, test_arm64, test_mips, etc.) for verifying different architectures and configurations.

After placing the Capstone folder in a valid module directory, initialize the module in a new PowerShell terminal using Import-Module Capstone.

To explore the available functions and detailed documentation for disassembly, use the Get-Help command on the disassembly function.

Import-Module Capstone
Get-Help Get-CapstoneDisassembly -Full

The cstest regression testing tool requires cmocka.

MacOS users: Install via Homebrew:

brew install cmocka

Other users (Build from source):

1. Download and extract the Cmocka source code.
2. Build and install using CMake:

cd cmocka_dir
mkdir build
cd build
cmake ..
make
sudo make isntall

To use capstone-rs, ensure you meet the following requirements:

• Rust Version: Minimum 1.81.0.
• Low-level Bindings: The crate relies on capstone-sys for low-level C bindings. Check the capstone-sys documentation for specific platform requirements and supported operating systems.