Capstone 2.0 RC1 Disassembly Framework Arrives

Last month on Phoronix I wrote about libbeauty as an open-source decompiler and in the past for similar decompile purposes there's been Dagger. Along the same theme, another LLVM tool that's now almost up to version 2.0 is Capstone.

Capstone is a disassembly framework based upon LLVM that is multi-platform and multi-architecture. Capstone's goal is advertised as "[making it] the ultimate disassembly engine for binary analysis and reversing in the security community."

Capstone is implemented in pure C with bindings for various languages from Python to Java to Go to C#, has native support for Windows and Linux among other platforms, is thread-safe, and is BSD licensed.

This LLVM disassembly framework is almost up to version 2.0 per the 2.0 RC1 announcement from a few days ago. Highlights over the original Capstone include a 50% smaller library size, much less memory usage, performance improvements to the framework, PowerPC architecture support, new instruction support for ARM/ARM64/MIPS, critical bug-fixes, and architecture flexibility improvements.