Capstone

Capstone is a small-sized, free and open-source disassembly framework that supports multiple platforms and architectures, such as ARM, ARM64, SystemZ, XCore, Sparc, PowerPC, and X64. It delivers an architecture-neutral API, providing useful information on disassembled instructions.

The tool requires no type of installation and can be called from a Command Prompt window. The syntax is [-d] <arch+mode> <assembly-hexstring> [start-address-in-hex-format]. All arch modes are displayed in the console panel. Since it's available in portable format, the software utility can be stored on USB flash drives and effortlessly launched on any machine without any kind of setup.

Some semantics of the disassembled instruction is shown by the application, like the list of implicit registers (read and written). Thread-safe by design, the disassembly engine is implemented in pure C, having bindings ready for Delphi, Free Pascal, Perl, Haskell, Ruby, C#, Lua, Rust, and others.

Distributed under the BSD license, Capstone enables users to embed in the firmware and OS kernel. It can also be used for malware analysis, thanks to the fact that it emphasizes performance. Separate links for x86 and x64 Windows can be downloaded from this page. Users interested in Python development files can get them straight from the developer's website.