-
Notifications
You must be signed in to change notification settings - Fork 31
Home
Capstone.NET is a .NET Core and a .NET Framework binding for the Capstone disassembly framework. It is written in C#, supports Capstone 4, and has a friendly and simple type safe API that is ridiculously easy to learn and quick to pick up. This Wiki will help you get started with Capstone.NET:
Often, you might be interested in customizing disassembled instructions' mnemonic. Learn more by reading this topic.
Often, you might be interested in disassembling binary code in an iterative fashion, 1 instruction at a time. Iterative disassembling allows you to disassemble small ranges of binary code 1 instruction at a time, inspect the disassembled instruction, and make a decision to whether disassemble the next instruction or break out of the disassembly loop early without wasting resources. Learn more by reading this topic.
Deferred, or lazy, disassembling of binary code sounds great on paper, but it is not without its caveats. Learn more by reading this topic.
Internally, Capstone.NET uses Capstone's cs_disasm_iter() API to perform deferred disassembling of binary code. However, you won't gain all the benefits of Capstone's cs_disasm_iter() API due to Capstone.NET's managed nature. Learn more by reading this topic.
Capstone supports a build option called Diet Mode to minimize its size when it is build. If a Capstone library is build with Diet Mode enabled, some Capstone APIs and structure fields are unsupported and in some cases return undefined results if they are used. Learn more by reading this topic.
You can determine whether Diet Mode is enabled or not using the static property CapstoneDisassembler.IsDietModeEnabled. Some additional classes also define an instance property IsDietModeEnabled that can help you determine whether Diet Mode is enabled or not. Learn more by reading this topic.
Some operations are unsupported when Diet Mode is enabled. Learn more by reading this topic.
Often, you might be interested in detecting, and possibly handling, when an invalid, or broken, instruction is encountered. Most of the time, when an invalid instruction is encountered it is because data is mixed-in in the binary code that is being disassembled. Learn more by reading this topic.
Learn the effects of data when you disassemble with Skip Data Mode disabled by reading this topic.
Learn the effects of data when you disassemble with Skip Data Mode enabled by reading this topic.
Learn the effects of data when you disassemble with Skip Data Mode enabled and a custom callback by reading this topic.
When Skip Data Mode is enabled, a disassemble operation returns skipped data instructions along with valid instructions. A skipped data instruction's mnemonic is assigned a default value by Capstone. You can however override this value. Learn more by reading this topic.