Capstone is an open source lightweight multi-platform, multi-architecture disassembly framework.

Features:

• Multi-architectures: Arm, Arm64 (Armv8), M68K, Mips, PowerPC, Sparc, SystemZ, TMS320C64X, XCore & X86 (include X86_64).

• Clean/simple/lightweight/intuitive architecture-neutral API.

• Provide details on disassembled instruction (called "decomposer" by some others).

• Provide some semantics of the disassembled instruction, such as list of implicit registers read & written.

• Implemented in pure C language, with bindings for Clojure, F#, Common Lisp, Visual Basic, PHP, PowerShell, Haskell, Perl, Python, Ruby, C#, NodeJS, Java, GO, C++, OCaml, Lua, Rust, Delphi, Free Pascal & Vala available.

• Native support for Windows & *nix (with Mac OSX, iOS, Android, Linux, *BSD & Solaris confirmed).

• Thread-safe by design.

• Special support for embedding into firmware or OS kernel.

• High performance & suitable for malware analysis (capable of handling various X86 malware tricks).

• Distributed under the open source BSD license.