capstone-users — Capstone mailing list for users

[Capstone-users] Showcase for Capstone

[Nguyen A. Q. <aq...@gm...>]

hi,

1.5 month after first public release & we entered the first big project:
OpenBSD

       http://www.openbsd.org/cgi-bin/cvsweb/ports/devel/capstone/

this means Capstone will be packaged with the next OpenBSD 5.5


also, check out bunch of other projects already had our framework inside:

        http://capstone-engine.org/showcase.html


let us know if you are also using our framework.

cheers,
Q

[Capstone-users] Capstone is not just LLVM

[Nguyen A. Q. <aq...@gm...>]

Hi,

Capstone is based on the almighty LLVM, so some might think that we are
just like LLVM. However, Capstone is not just that, but offering a lot more
& do it better because it has been designed & implemented especially for
disassembling to answer the security community’s demand.

This is clarified here:

http://capstone-engine.org/beyond_llvm.html


Thanks,
Q

[Capstone-users] Capstone 2.0 is released!

[Nguyen A. Q. <aq...@gm...>]

Hi,

We are excited to announce version 2.0 of Capstone disassembly framework!!!

This new release brings a lot of important improvements. Notable changes
are:

- Library size is around 50% smaller.
- Much less memory usage.
- Framework is way faster. Especially, the Python binding is 3 ~ 4 times
faster than in 1.0.
- New architecture added: PowerPC
- Architectures updated with new instructions & hardware modes for Arm,
Arm64, Mips & X86.
- Flexibility of choosing which architectures to be compiled in, so you can
tailor library to your need.
- Support for embedding Capstone into restricted environments such as
kernel or firmware.
- Some critical bug fixes.

Further information is available at http://www.capstone-engine.org

Thanks,
Quynh

[Capstone-users] Capstone 2.-RC1 is out!

[Nguyen A. Q. <aq...@gm...>]

Hi,

We are pleased to announce the Release Candidate 1, version 2.0 of the
Capstone disassembly framework!

The source code tarball is available at:

http://capstone-engine.org/download/2.0/capstone-2.0-rc1.tar.gz

It is also tagged with tagname 2.0-rc1 in our Github at
https://github.com/aquynh/capstone

Please test and feed back.


Users are strongly recommended to move away from 1.0. Notable changes in
2.0 RC1 are:


- Library size is around 50% smaller.

- Framework is much faster now. For example, Python binding is 3 ~ 4 times
faster than in 1.0.

- New architecture:
PowerPC


- Update with new instructions & hardware mode for Arm, Arm64 &
Mips.


- Some critical bug fixes.

- Flexibility of choosing which architectures to be compiled in, so you can
tailor library to your need.

Note that this version has some important API changes, see:
https://github.com/aquynh/capstone/wiki/ChangeLog
Therefore, some (trivial) modification to your tools are needed to switch
from 1.0 to 2.0.

Thanks.
Quynh

Re: [Capstone-users] capstone pyew integration

[Joxean K. <jo...@co...>]

Hey Paolo!

It's cool! Could you send me the patch you wrote so I can test it out
and commit it to the public repo?

Thanks!

El jue, 16-01-2014 a las 03:03 +0800, Nguyen Anh Quynh escribió:
> hi Paolo,
> 
> 
> cool! i am forwarding this to Joxean, the Pyew's author, and let see
> what he has to say.
> 
> 
> cheers,
> Q
> 
> 
> 
> 
> 
> On Thu, Jan 16, 2014 at 1:35 AM, Paolo Di Prodi
> <Pao...@co...> wrote:
>         Hello there,
>         first of all I love capstone, well done guys!
>         I made a little patch for pyew that allows to use Capstone as
>         a disassembler.
>         In essence all it does is to get the entry point and
>         disassemble + function call "resolution" from IAT table.
>         If anybody is interested I can either put a patch somewhere or
>         submit to pyew?
>         
>         Regards.
>         ------------------------------------------------------------------------------
>         CenturyLink Cloud: The Leader in Enterprise Cloud Services.
>         Learn Why More Businesses Are Choosing CenturyLink Cloud For
>         Critical Workloads, Development Environments & Everything In
>         Between.
>         Get a Quote or Start a Free Trial Today.
>         http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
>         _______________________________________________
>         Capstone-users mailing list
>         Cap...@li...
>         https://lists.sourceforge.net/lists/listinfo/capstone-users
> 
> 

Re: [Capstone-users] capstone pyew integration

[Joxean K. <jox...@ya...>]

Hey Paolo!

It's cool! Could you send me the patch you wrote so I can test it out
and commit it to the public repo?

Thanks!

El jue, 16-01-2014 a las 03:03 +0800, Nguyen Anh Quynh escribió:
> hi Paolo,
> 
> 
> cool! i am forwarding this to Joxean, the Pyew's author, and let see
> what he has to say.
> 
> 
> cheers,
> Q
> 
> 
> 
> 
> 
> On Thu, Jan 16, 2014 at 1:35 AM, Paolo Di Prodi
> <Pao...@co...> wrote:
>         Hello there,
>         first of all I love capstone, well done guys!
>         I made a little patch for pyew that allows to use Capstone as
>         a disassembler.
>         In essence all it does is to get the entry point and
>         disassemble + function call "resolution" from IAT table.
>         If anybody is interested I can either put a patch somewhere or
>         submit to pyew?
>         
>         Regards.
>         ------------------------------------------------------------------------------
>         CenturyLink Cloud: The Leader in Enterprise Cloud Services.
>         Learn Why More Businesses Are Choosing CenturyLink Cloud For
>         Critical Workloads, Development Environments & Everything In
>         Between.
>         Get a Quote or Start a Free Trial Today.
>         http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
>         _______________________________________________
>         Capstone-users mailing list
>         Cap...@li...
>         https://lists.sourceforge.net/lists/listinfo/capstone-users
> 
> 

Re: [Capstone-users] capstone pyew integration

[Nguyen A. Q. <aq...@gm...>]

hi Paolo,

cool! i am forwarding this to Joxean, the Pyew's author, and let see what
he has to say.

cheers,
Q




On Thu, Jan 16, 2014 at 1:35 AM, Paolo Di Prodi <
Pao...@co...> wrote:

> Hello there,
> first of all I love capstone, well done guys!
> I made a little patch for pyew that allows to use Capstone as a
> disassembler.
> In essence all it does is to get the entry point and disassemble +
> function call "resolution" from IAT table.
> If anybody is interested I can either put a patch somewhere or submit to
> pyew?
>
> Regards.
>
> ------------------------------------------------------------------------------
> CenturyLink Cloud: The Leader in Enterprise Cloud Services.
> Learn Why More Businesses Are Choosing CenturyLink Cloud For
> Critical Workloads, Development Environments & Everything In Between.
> Get a Quote or Start a Free Trial Today.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
> _______________________________________________
> Capstone-users mailing list
> Cap...@li...
> https://lists.sourceforge.net/lists/listinfo/capstone-users
>

[Capstone-users] capstone pyew integration

[Paolo Di P. <Pao...@co...>]

Hello there,
first of all I love capstone, well done guys!
I made a little patch for pyew that allows to use Capstone as a disassembler.
In essence all it does is to get the entry point and disassemble + function call "resolution" from IAT table.
If anybody is interested I can either put a patch somewhere or submit to pyew?

Regards.

Re: [Capstone-users] Towards 2.0

[Capstone E. <cap...@gm...>]

On Tue, Jan 14, 2014 at 8:27 AM, Capstone Engine
<cap...@gm...>wrote:

> Hi,
>
> We are going to release version 2.0 soon. please help to debug it by
> trying out the "next" branch of the Github repo.
>
> Just in case, you can get the latest "next" code at
> https://github.com/aquynh/capstone/archive/next.zip
>
>
> There a lots of reason to switch to 2.0 ASAP, see
> https://github.com/aquynh/capstone/wiki/ChangeLog
>
> And just for fun, you can give our Github repo a star: we are marching
> towards 100 stars, and hopefully be there before 2.0 :-)
>

Giving us a star is as simple as clicking here:

https://github.com/aquynh/capstone/star

(you need Github ID for this)

Cheers,
Capstone Team

[Capstone-users] Towards 2.0

[Capstone E. <cap...@gm...>]

Hi,

We are going to release version 2.0 soon. please help to debug it by trying
out the "next" branch of the Github repo.

Just in case, you can get the latest "next" code at
https://github.com/aquynh/capstone/archive/next.zip


There a lots of reason to switch to 2.0 ASAP, see
https://github.com/aquynh/capstone/wiki/ChangeLog

And just for fun, you can give our Github repo a star: we are marching
towards 100 stars, and hopefully be there before 2.0 :-)

Thanks,
Capstone Team

[Capstone-users] Capstone on diet

[Nguyen A. Q. <aq...@gm...>]

hi,

towards a diet Capstone, i made some simple changes to mapping code, but
this has good effect: the lib size is now 40% smaller; it went down from
5.6MB to 3.2MB now.

i updated that in https://github.com/aquynh/capstone/wiki/ChangeLog

more optimization will come later to optimize the binary size.

thanks,
Q

[Capstone-users] CS_OPT_MODE

[Nguyen A. Q. <aq...@gm...>]

hi,

i have just added new CS_OPT_MODE option, so we can change engine's mode at
run-time. this is now available in "next" branch.

see https://github.com/aquynh/capstone/wiki/ChangeLog for more information.

cheers,
Q

[Capstone-users] "next" branch

[Nguyen A. Q. <aq...@gm...>]

hi,

i opened a new branch named "next". from now on new features will go there,
and will be gradually merged to master branch when they are stable enough.
simply put, next version will go to "next" branch.

i committed 2 changes into "next": support alias registers for Mips & Arm.
please find more details here:

https://github.com/aquynh/capstone/wiki/ChangeLog

so from now on, to keep track of new features we will detail all the major
changes into this ChangeLog wiki


just in case, if you dont know how to get "next" with git, do this (for
*nix):

$ git pull; git checkout next


Then make sure to compile and install new code:

$ make clean; make; sudo make install


later, to get back to master branch, do:

$ git checkout master


thanks,
Q

Re: [Capstone-users] Capstone Listing

[Capstone E. <cap...@gm...>]

On Thu, Dec 19, 2013 at 2:46 AM, <ric...@ma...>wrote:

> ALCON,
>
>     I just wanted to let you know that I posted the 1.0v of Capstone on my
> web site here:
> http://www.malware-analyzer.com/malware-analysis-tools/malware-analysis-tools-disassembler/#Capstone
> .
>
>

This is cool, thanks!

[Capstone-users] Capstone Listing

[<ric...@ma...>]

ALCON,
 
    I just wanted to let you know that I posted the 1.0v of Capstone on my web site here: http://www.malware-analyzer.com/malware-analysis-tools/malware-analysis-tools-disassembler/#Capstone.
 
Regards,
Richard Hummel, Owner

 
 
 
Phone: 501-515-4909
Blog: https://malware-analyzer.squarespace.com
Twitter: @MalwareAnalyzer

[Capstone-users] Capstone 1.0 disassembly framework release!

[Nguyen A. Q. <aq...@gm...>]

Hi,

We are excited to announce the 1.0 version for Capstone, the multi-arch,
multi-platform disassembly framework you are longing for!

Why this engine is unique? Capstone offers some unparalleled features:

- Support all important hardware architectures: ARM, ARM64 (aka ARMv8),
Mips & X86.
- Clean/simple/lightweight/intuitive architecture-neutral API.
- Provide details on disassembled instruction (called “decomposer” by
others).
- Provide some semantics of the disassembled instruction, such as list of
implicit registers read & written.
- Implemented in pure C language, with bindings for Python, Ruby, OCaml,
C#, Java and GO available.
- Native support for Windows & *nix (including MacOSX, Linux, *BSD
platforms).
- Thread-safe by design.
- Distributed under the open source BSD license.

For further information, see our website at http://www.capstone-engine.org

Being infant 1.0, Capstone might be still buggy or cannot handle many
malware tricks yet. But give it a chance and report your findings, so we
can fix the issues in the next versions.

Capstone is a very young project: the first line was written just 4 months
ago. But we do hope that it will live a long life. The community support is
critical for this little open source project!

We would like show our gratitude to the beta testers for bug reports & code
contributions during the beta phase! Their invaluable helps have been
tremendous for us to keep this far.

We would like to thank LLVM project, which Capstone is based on. Without
the almighty LLVM, Capstone would not be existent!

Last but not least, big thanks go to Coseinc for the generous sponsor for
our project!


Thanks,
Quynh

Re: [Capstone-users] test 3

[Nguyen A. Q. <aq...@ya...>]

test 4





On Saturday, December 14, 2013 3:05 PM, Nguyen Anh Quynh <aq...@gm...> wrote:
 
test 3

------------------------------------------------------------------------------
Rapidly troubleshoot problems before they affect your business. Most IT 
organizations don't have a clear picture of how application performance 
affects their revenue. With AppDynamics, you get 100% visibility into your 
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
_______________________________________________
Capstone-users mailing list
Cap...@li...
https://lists.sourceforge.net/lists/listinfo/capstone-users

[Capstone-users] test 3

[Nguyen A. Q. <aq...@gm...>]

test 3

Re: [Capstone-users] test 01

[Capstone E. <cap...@gm...>]

test 2


On Sat, Dec 14, 2013 at 2:52 PM, Capstone Engine
<cap...@gm...>wrote:

> test
>
>
> ------------------------------------------------------------------------------
> Rapidly troubleshoot problems before they affect your business. Most IT
> organizations don't have a clear picture of how application performance
> affects their revenue. With AppDynamics, you get 100% visibility into your
> Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics
> Pro!
> http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
> _______________________________________________
> Capstone-users mailing list
> Cap...@li...
> https://lists.sourceforge.net/lists/listinfo/capstone-users
>
>

[Capstone-users] test 01

[Capstone E. <cap...@gm...>]

test

[Capstone-users] test

[Nguyen A. Q. <aq...@ya...>]

test email

Re: [Capstone-users] Beta testing

[<rmu...@gm...>]

Spike <sp...@di...> wrote:
>Me interested to.
>
>------------------------------------------------------------------------------
>Shape the Mobile Experience: Free Subscription
>Software experts and developers: Be at the forefront of tech
>innovation.
>Intel(R) Software Adrenaline delivers strategic insight and
>game-changing 
>conversations that shape the rapidly evolving mobile landscape. Sign up
>now. 
>http://pubads.g.doubleclick.net/gampad/clk?id=63431311&iu=/4140/ostg.clktrk
>_______________________________________________
>Capstone-users mailing list
>Cap...@li...
>https://lists.sourceforge.net/lists/listinfo/capstone-users

I am interested as well. 
-- 
Sent from my Android phone with K-9 Mail. Please excuse my brevity.

[Capstone-users] Beta testing

[Spike <sp...@di...>]

Me interested to.

[Capstone-users] Fwd: Beta testing the disassembly engine

[Mikhail K. <mmk...@gm...>]

---------- Forwarded message ----------
From: Mikhail Kazlouski <mmk...@gm...>
Date: Fri, Nov 22, 2013 at 11:17 PM
Subject: Re: [Capstone-users] Beta testing the disassembly engine
To: Nicholas Nam <nic...@gm...>


Interested as well.


On Fri, Nov 22, 2013 at 6:03 PM, Nicholas Nam <nic...@gm...> wrote:

> Interested also
>
>
> On Fri, Nov 22, 2013 at 6:31 AM, Borja <bo...@li...> wrote:
>
>>
>> Hi reversers! :-)
>>
>> Also do I! Let's beta-test it!
>>
>> Cheers!
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Shape the Mobile Experience: Free Subscription
>> Software experts and developers: Be at the forefront of tech innovation.
>> Intel(R) Software Adrenaline delivers strategic insight and game-changing
>> conversations that shape the rapidly evolving mobile landscape. Sign up
>> now.
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=63431311&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Capstone-users mailing list
>> Cap...@li...
>> https://lists.sourceforge.net/lists/listinfo/capstone-users
>>
>
>
>
> ------------------------------------------------------------------------------
> Shape the Mobile Experience: Free Subscription
> Software experts and developers: Be at the forefront of tech innovation.
> Intel(R) Software Adrenaline delivers strategic insight and game-changing
> conversations that shape the rapidly evolving mobile landscape. Sign up
> now.
> http://pubads.g.doubleclick.net/gampad/clk?id=63431311&iu=/4140/ostg.clktrk
> _______________________________________________
> Capstone-users mailing list
> Cap...@li...
> https://lists.sourceforge.net/lists/listinfo/capstone-users
>
>

[Capstone-users] Beta Test Request

[Silent J. <th3...@gm...>]

I would like to beta test capstone as well.

Thanks.