# Install capstone with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, scoop, zypper Multi-platform, multi-architecture disassembly framework. Version 5.0.9 via Homebrew; verified 2026-05-28. ## Install ```sh sudo av install brew:capstone ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install capstone ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install capstone ``` Evidence: MacPorts ports tree: devel/capstone/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add capstone ``` Evidence: Alpine Linux edge package indexes: capstone from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install capstone-tool ``` Evidence: Debian stable package indexes: capstone-tool from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install capstone ``` Evidence: Fedora Rawhide package metadata: capstone from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#capstone ``` Evidence: nixpkgs package indexes: pkgs/by-name/ca/capstone/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S capstone ``` Evidence: Arch Linux sync databases: capstone from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install capstone ``` Evidence: openSUSE Tumbleweed package metadata: capstone from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ### Windows - Scoop (92%): ```sh scoop install main/capstone ``` Evidence: Scoop official bucket manifest trees: bucket/capstone.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:capstone - **Package manager:** Homebrew - **Package manager page:** - **Version:** 5.0.9 - **Source summary:** Multi-platform, multi-architecture disassembly framework - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** BSD-3-Clause - **Source archive:** - **Last updated:** 2026-05-28T18:49:05Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - cstool (cli) - cstool (alias) ## Dependencies - gettext ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 5.0.9 - Package-manager updated: 2026-05-28 - Local data: ok - Upstream repository: https://github.com/capstone-engine/capstone - Upstream latest detected: 5.0.9 (current) ## Project history and usage Capstone is a lightweight, multi-platform, multi-architecture disassembly framework used in binary analysis, malware analysis, reverse engineering, and security tooling. ### Project history The official README says Capstone was created by Nguyen Anh Quynh and then developed and maintained by a small community. Its goal is to be an architecture-neutral disassembly engine for binary analysis and reversing in the security community. Capstone's official site emphasizes a pure-C core, a simple API, detailed instruction decomposition, implicit register semantics, thread safety, embedding support for firmware or kernels, and native support across Windows, macOS, iOS, Android, Linux, BSD, Solaris, and other Unix-like systems. The project appeared publicly on GitHub in 2013 and was presented in technical form at Black Hat USA 2014. By 2026 the official download page listed 6.0.0-Alpha9 as the current version, while GitHub releases showed active 5.x maintenance and 6.x alpha development. ### Adoption history Capstone became widely adopted because reverse-engineering tools needed a reusable disassembler library rather than every project owning architecture-specific decode code. The official site collects testimonials from reverse engineers and tool authors calling it a standard or gold standard disassembly engine. The official documentation documents repository installation across Homebrew, MacPorts, Debian, Ubuntu, FreeBSD, OpenBSD, NetBSD, and Python packaging. The batch package metadata adds Alpine, Fedora, Nix, Arch, Scoop, and openSUSE, which reflects broad cross-platform packaging. ### How it is used Developers embed Capstone as a library to disassemble bytes for many CPU architectures and retrieve instruction details. The Homebrew package also provides cstool, a command-line utility for quick disassembly tasks. Capstone is used in reverse-engineering frameworks, malware-analysis tools, debuggers, firmware analysis, exploit research, and educational tooling. Bindings listed by the official site and README cover many languages, making the C engine available beyond C and C++ applications. ### Why package nerds care Capstone is package-nerd significant because it is a foundational native library with many downstream language bindings. A system package can satisfy C/C++ consumers, Python users, command-line users, and reverse-engineering tools that dynamically link against the same engine. It also illustrates a common packaging headache: a security-oriented C library with fast-moving architecture support, multiple major branches, Python wheels, bindings outside the main tree, and tools that expect the CLI, headers, and shared library to line up. ### Timeline - 2013: capstone-engine/capstone repository is created on GitHub. - 2014: Capstone technical details are presented in Black Hat USA slides linked from the official site. - 2015: Official docs record Capstone availability in several Unix package repositories. - 2025: Capstone 6.0.0 alpha releases begin appearing in the GitHub release feed. - 2026-05-29: Official download page lists Capstone 6.0.0-Alpha9 as the current release. ### Related projects - Keystone is a related assembler framework from the same authorial ecosystem, often paired conceptually with Capstone for assembly and disassembly workflows. - Unicorn is a related CPU emulator framework commonly used with Capstone in binary-analysis stacks. - Rizin and radare2 are reverse-engineering frameworks in Capstone's wider ecosystem; Rizin is also shown as a release sponsor on the official site. - Language bindings such as capstone-rs, Node-Capstone, LuaCapstone, Capstone.NET, and Java bindings are listed by the official download page. ### Sources - - - - - - - input.json source_facts.package-manager ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** capstone - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - capstone-tool - 5.0.7-1~deb13u1: normalized package name match | Debian stable package indexes: capstone-tool from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | lightweight multi-architecture disassembly framework - command line tool | https://www.capstone-engine.org/ - Debian apt - libcapstone-dev - 5.0.7-1~deb13u1: normalized package name match | Debian stable package indexes: libcapstone-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | lightweight multi-architecture disassembly framework - devel files | https://www.capstone-engine.org/ - Debian apt - libcapstone5 - 5.0.7-1~deb13u1: normalized package name match | Debian stable package indexes: libcapstone5 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | lightweight multi-architecture disassembly framework - library | https://www.capstone-engine.org/ - Debian apt - python3-capstone - 5.0.7-1~deb13u1: normalized package name match | Debian stable package indexes: python3-capstone from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | lightweight multi-architecture disassembly framework - Python bindings | https://www.capstone-engine.org/ - Nix - capstone: normalized package name match | nixpkgs package indexes: pkgs/by-name/ca/capstone/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - capstone-tool - 4.0.2-5.1build1: normalized package name match | Ubuntu 24.04 LTS package indexes: capstone-tool from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | lightweight multi-architecture disassembly framework - command line tool | https://www.capstone-engine.org/ - Ubuntu apt - libcapstone-dev - 4.0.2-5.1build1: normalized package name match | Ubuntu 24.04 LTS package indexes: libcapstone-dev from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | lightweight multi-architecture disassembly framework - devel files | https://www.capstone-engine.org/ - Ubuntu apt - libcapstone4 - 4.0.2-5.1build1: normalized package name match | Ubuntu 24.04 LTS package indexes: libcapstone4 from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | lightweight multi-architecture disassembly framework - library | https://www.capstone-engine.org/ - Ubuntu apt - python3-capstone - 4.0.2-5.1build1: normalized package name match | Ubuntu 24.04 LTS package indexes: python3-capstone from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | lightweight multi-architecture disassembly framework - Python bindings | https://www.capstone-engine.org/ - apk - capstone - 5.0.9-r0: normalized package name match | Alpine Linux edge package indexes: capstone from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | The Ultimate Disassembler | https://www.capstone-engine.org - apk - capstone-dev - 5.0.9-r0: normalized package name match | Alpine Linux edge package indexes: capstone-dev from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | The Ultimate Disassembler (development files) | https://www.capstone-engine.org - apk - capstone-static - 5.0.9-r0: normalized package name match | Alpine Linux edge package indexes: capstone-static from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | The Ultimate Disassembler (static library) | https://www.capstone-engine.org - apk - cstool - 5.0.9-r0: normalized package name match | Alpine Linux edge package indexes: cstool from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | cstool for capstone disassembler | https://www.capstone-engine.org - apk - py3-capstone - 5.0.9-r0: normalized package name match | Alpine Linux edge package indexes: py3-capstone from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | The Ultimate Disassembler (for python3) | https://www.capstone-engine.org - apk - py3-capstone-pyc - 5.0.9-r0: normalized package name match | Alpine Linux edge package indexes: py3-capstone-pyc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Precompiled Python bytecode for py3-capstone | https://www.capstone-engine.org - dnf - capstone - 5.0.6-5.fc45: normalized package name match | Fedora Rawhide package metadata: capstone from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | A lightweight multi-platform, multi-architecture disassembly framework | http://www.capstone-engine.org/ ## Related links - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Text processing packages](https://www.automicvault.com/pkg/text-processing-tools/) - Matched text, document, or structured-data processing metadata. - [Developer build packages](https://www.automicvault.com/pkg/developer-build-tools/) - Matched build, compiler, generator, or developer workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [gettext](https://www.automicvault.com/pkg/brew/gettext/) - Runtime dependency declared by Homebrew. - [bloaty](https://www.automicvault.com/pkg/brew/bloaty/) - Popular package that depends on this formula. - [elfx86exts](https://www.automicvault.com/pkg/brew/elfx86exts/) - Popular package that depends on this formula. - [open-ocd](https://www.automicvault.com/pkg/brew/open-ocd/) - Popular package that depends on this formula. - [orbuculum](https://www.automicvault.com/pkg/brew/orbuculum/) - Popular package that depends on this formula. - [pwntools](https://www.automicvault.com/pkg/brew/pwntools/) - Popular package that depends on this formula. - [qemu](https://www.automicvault.com/pkg/brew/qemu/) - Popular package that depends on this formula. - [rizin](https://www.automicvault.com/pkg/brew/rizin/) - Popular package that depends on this formula. - [uftrace](https://www.automicvault.com/pkg/brew/uftrace/) - Popular package that depends on this formula. - [dex2jar](https://www.automicvault.com/pkg/brew/dex2jar/) - Shares av.db curated category or tags: cli, developer-tools, reverse-engineering. - [fernflower](https://www.automicvault.com/pkg/brew/fernflower/) - Shares av.db curated category or tags: cli, developer-tools, reverse-engineering. - [keystone](https://www.automicvault.com/pkg/brew/keystone/) - Shares av.db curated category or tags: cli, developer-tools, multi-architecture, reverse-engineering. - [readpe](https://www.automicvault.com/pkg/brew/readpe/) - Shares av.db curated category or tags: binary-analysis, cli, developer-tools, reverse-engineering. - [swift-section](https://www.automicvault.com/pkg/brew/swift-section/) - Shares av.db curated category or tags: binary-analysis, cli, developer-tools, reverse-engineering. - [udis86](https://www.automicvault.com/pkg/brew/udis86/) - Shares av.db curated category or tags: cli, developer-tools, disassembly, library, reverse-engineering. - [z80dasm](https://www.automicvault.com/pkg/brew/z80dasm/) - Shares av.db curated category or tags: binary-analysis, cli, developer-tools, reverse-engineering. ## Combined YAML source View the package source record on GitHub. [combined/capstone.yml](https://github.com/automic-vault/db/blob/main/combined/capstone.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph