Capstone Documentation Beta

Class Capstone 

public class Capstone

An instance of Capstone is used to disassemble code.

Initializers

init(arch:​mode:​) 

public init(arch: Architecture, mode: Mode = []) throws

Creates a new instance of Capstone for a given architecture and mode.

Parameters

arch Architecture

target architecture to disassemble
mode Mode

combination of modes - some are architecture-specific

Throws

  • CapstoneError.unsupportedArchitecture if capstone was built without support for the chosen architecture
  • CapstoneError.invalidMode if the given combination of modes is invalid for the target architecture
  • CapstoneError.unsupportedVersion if the installed version of capstone does not match the Swift bindings

Properties

version 

var version: (major: Int32, minor: Int32)

The linked version of Capstone.

Methods

supports(arch:​) 

public static func supports(arch: Architecture) -> Bool

Check if an architecture is supported.

By default, Capstone is built with support for all architectures, but some can be removed to reduce size.

Parameters

arch Architecture

architecture to check for

Returns

true if the architecture is supported, false otherwise

supports(build​Mode:​) 

public static func supports(buildMode: BuildMode) -> Bool

Check the build mode of the library.

Parameters

build​Mode Build​Mode

mode to check for

Returns

true if capstone was built in this mode

disassemble(code:​address:​count:​) 

public func disassemble<InsType: Instruction>(code: Data, address: UInt64, count: Int? = nil) throws -> [InsType]

Disassembles binary code.

Parameters

Ins​Type

instruction class to return. Must be Instruction, or the specific class for the target architecture
code Data

code to disassemble
address UInt64

address of the first instruction in given code
count Int?

number of instructions to disassemble; 0 or nil to get all of them

Throws

  • CapstoneError.unsupportedArchitecture if the return array is not of Instruction or the target architecture's instruction class
  • CapstoneError.outOfMemory if capstone runs out of memory during disassembly

Returns

disassembled instructions in the instruction class of the target architecture

name(of​Register:​) 

public func name<T: RawRepresentable>(ofRegister id: T) -> String? where T.RawValue == UInt16

Returns the name of a register in a string.

Parameters

id T

register to name. must match the register enum for the target architecture.

Returns

the name of the register, or nil if it's not a valid value.

set(option:​) 

public func set(option: DisassemblyOption) throws

Set options for disassembly.