capstone

capstone-engine活跃维护

轻量级多架构反汇编框架,支持 ARM、x86、RISC-V、MIPS 等二十多种指令集,常用于逆向工程、二进制分析和安全工具开发。

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.

6.0.0-Alpha11发布于 2026-09-21 17:53 UTC9,178star +7 / 7 天1,742fork同步于 2026-11-10 05:30 UTC

怎么上手

README 里没有找到可直接复制的安装命令

README 里没有找到可直接复制的安装命令,请到 README 或官方文档查看安装方式。

硬件要求

README 没有说明硬件要求。

下载:源码 zip·GitHub Releases(安装包)本站不镜像安装包

项目说明

这个项目的说明还在生成中,先参考下面「最近发版」和 README。

最近发版

5 个版本6.0.0-Alpha11
  1. 6.0.0-Alpha11最新正式版2026-09-21 · 2026-09-21 17:53 UTC

    Highlights

    This is another patch release with multiple instruction fixes and bug fixes.

    This release adds an AGENTS.md file and developer AI guidelines.

    API changes/additions

    • x86: Support alternative disassembly for JO/JNO operands in 64-bit mode. This adds two modes for x86: CS_MODE_X86_AMD and CS_MODE_X86_INTEL. Setting either of these flags will currently only affect the JO/JNO instructions. Please check the release guide for more details. The default behavior of the x86 module did not change.
    • Xtensa: Gate ESP32-S3 and HIFI3 instructions behind CS_MODE_XTENSA_ESP32S3

    New instruction

    • PowerPC: add mcrxr instruction support

    Instruction fixes

    • AArch64: report NZCV access for MRS/MSR of NZCV
    • HHPA: Correct name of r0 register - flags -> r0
    • x86: use effective address size for the loop counter register
    • x86: fix VMOVUPS memory operand access
    • PowerPC: Keep BI out of the CTR-only branch predicate
    • x86: fix EVEX writemask access in AT&T syntax

    What's Changed

  2. 6.0.0-Alpha102026-07-21 · 2026-07-21 17:12 UTC
    查看更新说明

    API changes and additions

    • Enum names of the Alpha architecture are now correctly all upper case. Because of an old Auto-Sync bug all the enum names were prefixed with Alpha instead of ALPHA and some contained lower case letters. Sadly, I just recently recognized that Alpha was effected by that bug.

      While this change is very annoying for everybody using the Alpha module, it must be done before the Beta release. Please excuse the inconvenience!

      A simple command to replace almost all of these occurrences in your code base is:

      find . -type f -regex ".*\.\(c\|h\)$" -exec sed -i -E "s|Alpha_([A-Z0-9_]+)|ALPHA_\1|g" {} +
      

      Author: @Rot127

    • RISC-V got a v5 compatibility macro for its header. With its recent module update CS_MODE_RISCVC was renamed to CS_MODE_RISCV_C to be more consistent with the other CS_MODE_ enums. This could break builds against a v5 code base which only has CS_MODE_RISCVC.

      Now you can simply define CAPSTONE_RISCV_COMPAT_HEADER before including capstone.h and CS_MODE_RISCVC will be defined as alias for CS_MODE_RISCV_C

      #define CAPSTONE_RISCV_COMPAT_HEADER
      #include <capstone/capstone.h>
      

      Author: @moste00

    • Prevent literal displacement truncation for AArch64 memory operands. There are AArch64 displacements which are 64bit in size. But aarch64_op_mem.disp was an int32_t. It was promoted to an int64_t. Author: @amaanmujawar

    • Fixed several decoding bugs in the Alpha module. See https://github.com/capstone-engine/capstone/pull/2967 for details. Author: @mattst88

    • The RISC-V details now also include the FP rounding mode cs_riscv.rounding_mode. Author: @moste00

    • AArch64: Add CS_OPT_SYNTAX_AARCH64_EXPLICIT_WIDE_IMM flag to print shifted MOVN and MOVZ instructions in their explicit forms instead of using the equivalent MOV aliases.

      Example output from cstool:

      > cstool aarch64 0xe402a012
      mov w4, #-0x170001
      
      > cstool aarch64+explicitwideimm 0xe402a012
      movn w4, #0x17, lsl #16
      
      > cstool aarch64+explicitwideimm 0xe402a052
      movz w4, #0x17, lsl #16
      

      Author: @amaanmujawar

    • M68K: Fixed EA decoding error and added ColdFire EMAC_B dual-acc MAC. Author: @b1llow

    Switch from v5 to v6

    Please check out our release guide to get an overview what changed, improved, and how the transition can be made as painless as possible: https://github.com/capstone-engine/capstone/blob/next/docs/cs_v6_release_guide.md

    What's Changed

  3. 6.0.0-Alpha92026-05-29 · 2026-05-29 14:54 UTC
    查看更新说明

    What's Changed

    • Fix GHSA-5m9f-vqcm-g5pr and GHSA-jrw4-wj52-2vw8 found by @sondt99
    • Add pre-release version to capstone.h

    Full Changelog: https://github.com/capstone-engine/capstone/compare/6.0.0-Alpha8...6.0.0-Alpha9

  4. 5.0.92026-05-28 · 2026-05-28 15:50 UTC
    查看更新说明

    What's Changed

    Full Changelog: https://github.com/capstone-engine/capstone/compare/5.0.8...5.0.9

  5. 6.0.0-Alpha82026-05-23 · 2026-05-23 19:23 UTC
    查看更新说明

    Highlights

    This is a patch release with bug fixes and a few new additions.

    Thanks a lot to all the new contributors helping with this release!

    Python Bindings

    • Python bindings on Linux load libcapstone.so now with the RTLD_DEEPBIND flag set. On some Linux systems this should limit the symbols' scopes to the library, instead of global ones. Useful for tools which have two different Capstone versions in their dependency tree.

    Architectures

    • Update M68k and add support for ColdFire ISA (Sponsored by RizinOrg)
    • Extend M680X support to RS08 and HCS12X.
    • RISC-V: Add reg_access to details.
    • Add support for x86 MOVSXD instructions.
    • x86 decoding uses lookup tables now to increase the overall speed.

    What's Changed

用户点评

登录用户的真实使用记录,可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译

    Capstone Engine

    Build status pypi package pypi downloads oss-fuzz Status

    [!TIP] Welcome to join our community group!  

    Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community.

    Created by Nguyen Anh Quynh, then developed and maintained by a small community, Capstone offers some unparalleled features:

    • Support multiple hardware architectures: ARM, AArch64, Alpha, ARC, BPF, Ethereum VM, LoongArch, HP PA-RISC (HPPA), M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86 (16, 32, 64), Xtensa.

    • Having clean/simple/lightweight/intuitive architecture-neutral API.

    • Provide details on disassembled instruction (called “decomposer” by others).

    • Provide semantics of the disassembled instruction, such as list of implicit registers read & written.

    • Implemented in pure C language, with lightweight bindings for Swift, D, Clojure, F#, Common Lisp, Visual Basic, PHP, PowerShell, Emacs, Haskell, Perl, Python, Ruby, C#, NodeJS, Java, GO, C++, OCaml, Lua, Rust, Delphi, Free Pascal & Vala ready either in main code, or provided externally by the community).

    • Native support for all popular platforms: Windows, Mac OSX, iOS, Android, Linux, *BSD, Solaris, etc.

    • Thread-safe by design.

    • Special support for embedding into firmware or OS kernel.

    • High performance & suitable for malware analysis (capable of handling various X86 malware tricks).

    • Distributed under the open source BSD license.

    Further information is available at https://www.capstone-engine.org

    Compile

    See BUILDING.md file for how to compile and install Capstone.

    Documentation

    Contributing

    See CONTRIBUTING.md for an intro.

    Fuzz

    See suite/fuzz/README.md for more information.

    License

    This project is released under the BSD license. If you redistribute the binary or source code of Capstone, please attach file LICENSE.TXT with your products.