capstone-engine

capstone

C2015–2025

capstone-engine / capstone

capstone

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.

Explore on GitHub Read Hacker News discussions

8Distinct people

11Mentions

0Explicit recommenders

9.2KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year11 dated mentions

Observed mentions: 2015-09-12 22:14:54 UTC to 2025-06-04 10:35:07 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2015	2015-01-01 00:00:00 UTC	2016-01-01 00:00:00 UTC	1	0	1
2016	2016-01-01 00:00:00 UTC	2017-01-01 00:00:00 UTC	0	0	0
2017	2017-01-01 00:00:00 UTC	2018-01-01 00:00:00 UTC	1	0	1
2018	2018-01-01 00:00:00 UTC	2019-01-01 00:00:00 UTC	0	0	0
2019	2019-01-01 00:00:00 UTC	2020-01-01 00:00:00 UTC	0	0	0
2020	2020-01-01 00:00:00 UTC	2021-01-01 00:00:00 UTC	2	0	2
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	1	1	0
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	0	0	0
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	2	0	2
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	3	1	2
2025	2025-01-01 00:00:00 UTC	2026-01-01 00:00:00 UTC	1	0	1

What Hacker News says

11 sources

davemp·Jun 4, 2025

When I was last working with machine code, I found capstone to be very useful. Even just reading the source was helpful for some of the conditionally present amd64 fields. https://github.com/capstone-engine/capstone

In Machine Code Isn't Scary

xvilka·Sep 26, 2024

It just updated to the nearly latest LLVM, so that argument is void: https://github.com/capstone-engine/capstone/blob/next/docs/c...

In Capstone Disassembler Framework

xvilka·Sep 25, 2024

It uses semi-automatic mechanism[1][2] of generating C code from the LLVM sources (TableGen files). [1] https://github.com/capstone-engine/capstone/blob/next/suite/... [2] https://github.com/capstone-engine/capstone/blob/next/docs/A...

In Capstone Disassembler Framework

xvilka·Sep 25, 2024Submission

Capstone Disassembler Framework

103 points · Open discussion

peter_d_sherman·Aug 8, 2023

>"MISHEGOS is a differential fuzzer for x86-64 instruction decoders. Instead of relying on a “golden” decoder or hardware decoder for ground truth within its difference oracle, MISHEGOS runs multiple unreliable decoders in parallel on an instruction candidate and uses their consensus or disagreement to mark the input as likely erroneous. As of writing, nine x86-64 instruction decoders written in a variety of languages can be fuzzed by MISHEGOS: • GNU libopcodes (C) [21] (https://www.gnu.org/software/binutils/) • Capstone (C++) [22] (https://github.com/capstone-engine/capstone) • DynamoRIO (C and C++) [2] (https://github.com/DynamoRIO/dynamorio) • fadec (C) [23] (https://github.com/aengelke/fadec) • Udis86 (C) [24] (https://github.com/vmt/udis86) • Intel XED (C) [25] (https://github.com/intelxed/xed) • Zydis (C) [26] (https://github.com/z

Read the rest

yantific/zydis) • bddisasm (C) [27] (https://github.com/bitdefender/bddisasm) • Iced (Rust) [28] (https://github.com/icedland/iced)" (Related software that contains x86[-64] assemblers and/or disassemblers: gas, masm, dumpbin, nasm, ndisasm, fasm, tasm, yasm, etc.)

In Differential analysis of x86-64 instruction decoders (2021) [pdf]

xvilka·May 31, 2023

Maybe then they can help us with the Capstone[1][2] disassembly engine auto-sync (automatic synchronization from the LLVM TableGen files) effort[3]. ARMv7, ARMv8/9, PowerPC are nearly finished, and MIPS is in near-term plans. Nobody stepped in for RISC-V yet. [1] http://www.capstone-engine.org/ [2] https://github.com/capstone-engine/capstone [3] https://github.com/capstone-engine/capstone/issues/2015

In RISE: Accelerate the development of open source software for RISC-V

jmacjmac·Mar 5, 2021Submission

Capstone Disassembler Framework

40 points · Open discussion

monocasa·Apr 26, 2020

A lot of the capstone archs are tablegenned from LLVM MC tables, and they didn't open source their mods to tablegen for whatever reason. It's a lot harder to add stuff like that to capstone on most of their archs, unfortunately. : \ https://github.com/aquynh/capstone/blob/master/arch/PowerPC/...

In Keystone: A lightweight multi-architecture assembler framework

saagarjha·Apr 26, 2020

Perhaps Capstone might serve your fuzzing needs better, as it can represent instructions symbolically. For example: https://github.com/aquynh/capstone/blob/master/arch/X86/X86M...

In Keystone: A lightweight multi-architecture assembler framework

ktta·Sep 14, 2017

There's also Capstone, which is open source http://www.capstone-engine.org/ https://github.com/aquynh/capstone

In IDA: What's new in 7.00

iheartmemcache·Sep 12, 2015

SoftICE was one of the most amazing utilities out there both for debugging as well as reverse engineering. The Wikipedia page is spot on about WinDbg/KD, but pretty out of date re: modern tools. Ollydbg2 came out more than half a decade ago and supports all the 64 bit registers and x86-64 instruction set. Immunity Debugger took the place as the defacto standard, and most modern scripts and tooling are built around Immunity for dynamic analysis and IDA Pro for static analysis. IDA Pro adopted QT natively, so the plugin communities are extending the hell out of what was already a great tool, and there are good plugins that export annotations/symbols that Immunity can consume so the union between static and dynamic analysis has never been smaller. If you don't have an IDA license, Immunity combined with Radare (read down) is still pretty pow

Read the rest

erful to play around with. Either way, the reverse engineering stuff out there is quite simply amazing. https://github.com/aquynh/capstone https://github.com/REhints/HexRaysCodeXplorer (this is CRAZY useful if you bought the Hex Rays license with IDA) https://github.com/ynvb/DIE - makes IDA even better ("DIE is an IDA python plugin designed to enrich IDA`s static analysis with dynamic data) https://portal.cert.org/web/mc-portal/pharos-static-analysis... - I haven't used this yet but Pharos is a static analysis tool out of Carnegie Melon that's particularly useful for C++ gen'd code. https://insights.sei.cmu.edu/sei_blog/2015/08/the-pharos-fra... Walks through some feature set. HexRays is great for somethings but when you F5 some block, you really are left wanting. This looks like it fills the gap quite nicely. http://www.radare.org/r/cmp.html - Comparison beween IDA and Radare (admittedly unfair, even titled so, ha) There are dozens of plugins I use which are just python scripts mapped to keyboard shortcuts so I don't even remember what they're called. Someone else is going to have to jump in because I'm not on my work machine and can't look it up. You lost Ring0 with the demise of SoftICE, but the RE community is more active than ever. Just watch a few CCC talks if you're not convinced. Just a note guys: I know you can pirate IDA but some companies just "do it right" and should be supported. I buy from Adafruit even though they're more expensive because I support them. IDA is one dude, who's responsive within the community, who goes out of his way to be nice and implement bug fixes and feature enhancements. I try not to get all preachy, but pirating IDA isn't stealing Visual Studio from Microsoft- you're ripping a dude who's contributed a lot to the community and even offers a free (granted less featureful) version.

In SoftICE: a kernel mode debugger for Windows