b227acc29c
* Basic changes of new arch - BPF * Define some constants * defined some API methods * Able to print MISC instruction * Follow Linux coding style * Ability to show ALU insn names * decode return * Add suite/MC/BPF * decode jump * decode store * decode load * print instruction done * try to implement BPF_reg_access * Implements explicit accessed registers and fix some tiny bugs * Fix unhandled ja case * Added BPF_REG_OFF do fix wrong display in jump class * Great I'm able to decode cBPF with eyes * Fix: misunderstood the 16-byte instruction's imm * Add ldxdw * Add extended-all.cs * Implements cstest/bpf_getdetail.c * Fix memory leak * Add BPF to fuzz * Implemented regs_read and regs_write * Fix missing write-access on ALU's dst * Updated cstool/, test_basic.c, test_detail.c, and test_iter.c * Updated docs * Fix type of cs_bpf#operands * Implements python bindings * Fix some bugs found by self code review * Remove dummy tests * remove typeof * Address comments * Fix MSVC's warnings and add test_bpf.py to bindings/python/Makefile * Fix: call is not offset |
||
|---|---|---|
| arch | ||
| bindings | ||
| contrib | ||
| cstool | ||
| docs | ||
| include | ||
| msvc | ||
| packages | ||
| suite | ||
| tests | ||
| windows | ||
| windowsce | ||
| xcode | ||
| .appveyor.yml | ||
| .gitattributes | ||
| .gitignore | ||
| .travis.yml | ||
| capstone.pc.in | ||
| ChangeLog | ||
| cmake-x86.sh | ||
| cmake.sh | ||
| CMakeLists.txt | ||
| COMPILE_CMAKE.TXT | ||
| COMPILE_MSVC.TXT | ||
| COMPILE.TXT | ||
| config.mk | ||
| CREDITS.TXT | ||
| cs_priv.h | ||
| cs.c | ||
| functions.mk | ||
| HACK.TXT | ||
| LEB128.h | ||
| LICENSE_LLVM.TXT | ||
| LICENSE.TXT | ||
| make.sh | ||
| Makefile | ||
| MathExtras.h | ||
| MCDisassembler.h | ||
| MCFixedLenDisassembler.h | ||
| MCInst.c | ||
| MCInst.h | ||
| MCInstrDesc.c | ||
| MCInstrDesc.h | ||
| MCRegisterInfo.c | ||
| MCRegisterInfo.h | ||
| nmake-x86.bat | ||
| nmake.bat | ||
| pkgconfig.mk | ||
| README.md | ||
| RELEASE_NOTES | ||
| SPONSORS.TXT | ||
| SStream.c | ||
| SStream.h | ||
| TODO | ||
| utils.c | ||
| utils.h | ||
Capstone Engine
Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community.
Created by Nguyen Anh Quynh, then developed and maintained by a small community, Capstone offers some unparalleled features:
-
Support multiple hardware architectures: ARM, ARM64 (ARMv8), BPF, Ethereum VM, Webassembly, M68K, Mips, MOS65XX, PPC, Sparc, SystemZ, TMS320C64X, M680X, XCore and X86 (including X86_64).
-
Having clean/simple/lightweight/intuitive architecture-neutral API.
-
Provide details on disassembled instruction (called “decomposer” by others).
-
Provide semantics of the disassembled instruction, such as list of implicit registers read & written.
-
Implemented in pure C language, with lightweight bindings for D, Clojure, F#, Common Lisp, Visual Basic, PHP, PowerShell, Emacs, Haskell, Perl, Python, Ruby, C#, NodeJS, Java, GO, C++, OCaml, Lua, Rust, Delphi, Free Pascal & Vala ready either in main code, or provided externally by the community).
-
Native support for all popular platforms: Windows, Mac OSX, iOS, Android, Linux, *BSD, Solaris, etc.
-
Thread-safe by design.
-
Special support for embedding into firmware or OS kernel.
-
High performance & suitable for malware analysis (capable of handling various X86 malware tricks).
-
Distributed under the open source BSD license.
Further information is available at http://www.capstone-engine.org
Compile
See COMPILE.TXT file for how to compile and install Capstone.
Documentation
See docs/README for how to customize & program your own tools with Capstone.
Hack
See HACK.TXT file for the structure of the source code.
License
This project is released under the BSD license. If you redistribute the binary or source code of Capstone, please attach file LICENSE.TXT with your products.