3

I was wondering if there are any limitations of capstone's disassembling capabilities when compared to IDA.

If yes, are those limitations inherent, i.e. a result of the different design/techniques that capstone and ida use? Or are they rather due to "not yet implemented" features, e.g. capstone's fewer supported CPUs?

If there are inherent limitations, could you give an example?

I am talking about the disassembling only, i.e., I am not interested in things like available APIs, commercial support, license models, plug-in systems, debugging support etc. Just the pure disassembly.

Capstone is mentioned as one answer to the post "Is there any disassembler to rival IDA Pro?", but it seems to be a copied/pasted text from the capstone website.

PS: The working of IDA is explained/discussed here.

  • There is no point in comparing between the two. IDA is more than a disassembler. – 0xec Nov 17 '15 at 9:13
  • I would like to compare the disassembly capabilities, not the two tools. I tried to clarify this in my question. – langlauf.io Nov 17 '15 at 9:21
3

There is no point in comparing between the two. IDA is more than a disassembler, it is a reversing tool which implements(or could be implemented via plugins) almost every feature you can think of.

Capstone on the other hand, is a simple disassembler engine. It by alone cannot generate the same quality of output as IDA.

For instance, IDA has cross-referencing capability. Cross-refs are generated by a dedicated analysis engine which uses input from the disassembly engine. A disassembly engine, by its own can neither find cross-refs, nor can it recursively disassemble like IDA.

You are comparing a disassembly framework to a tool with a myriad of features. They are not comparable with each other.

If you are talking about just the textual disassembler output, then there is not much of a difference per se.

  • I see. I mixed up cross-referencing (and probably more stuff such as stack frame reconstruction etc.) with disassembly capabilities. But nevertheless this is a valuable insight for me that capstone alone is not able to generate the same "quality output" which I understand as disassembled instructions + refs + stack frame info + .... – langlauf.io Nov 17 '15 at 10:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.