Home page logo

dailydave logo Dailydave mailing list archives

Re: Capstone disassembly framework: looking for Beta-testers
From: Nguyen Anh Quynh <aquynh () gmail com>
Date: Thu, 21 Nov 2013 23:07:06 +0800

On Thu, Nov 21, 2013 at 10:40 PM, Nguyen Anh Quynh <aquynh () gmail com> wrote:

On Thu, Nov 21, 2013 at 9:32 PM, Albert López <newbiesworld () hotmail com>wrote:

Mmmm, I haven't played a lot with Radare, but I think that it already has
all (or almost all) your "unique features" ;)

http://radare.org/ <http://radare.org/y/>

Moreover, they have a great documentation:

Just in case you don't know the tool :)

cool, your observation is really interesting! yes, i am well aware of
Radare, which is an excellent tool in my opinion. however, with all due
respect, there are some differences that i want to elaborate here:

- first of all, Radare is not really a "lightweight" disasm framework. in
fact it is more like a tool set that includes a lot of small libs and tools
inside. you can do, but i think it is not very trivial to use Radare as
disasm framework, which is not its main task.

- on supporting hardware architectures (X86 + ARM + ARM-64 + Mips): Radare
relies on a bunch of disasm engines, but most of them are really outdated,
with no support for newer instructions & CPU extensions. that is true on
all above archs, with no exception i guess. on the other hand, we believe
Capstone has better support for these archs. (of course Radare works for a
lot other archs, but that is not what we focus on so far)

- on decomposition functionality, as said above, Radare doesn't seem to do
that itself, but relies on other frameworks (correct me if i am wrong
here). and even Radare can do that, i doubt that it supports all above

- on instruction semantics, i am not sure if Radare give us the list of
implicit registers read/written for disasm instructions, or if it can do
that for all above archs. somebody can enlighten me here, if i am wrong.

- on API, i am quite confident that Capstone API is as
simple/clean/lightweight/intuitive as anything else, or even more. this is
the key when we designed the API. lets see if this is true when the
framework is released - soon after testing phase.

- on bindings: i am not sure if Radare has a list of bindings like
Capstone, which includes Python, Ruby, Ocaml, Java, C# & Go. and these
bindings are all manually written to be lightweight and efficient, as we
dont like bloated SWIG.

well, just found from the doc that Radare has a lot more bindings. thanks
to SWIG, i guess?

still i am not sure if the bindings can be used for disasm purpose,
however. soon enough, somebody will come here to enlighten me, i guess :-)

Dailydave mailing list
Dailydave () lists immunityinc com

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]