Capstone supports an impressive breadth of architectures. However, if all you need is x86/AMD64 decoding and disassembly, there are much higher quality (in terms of accurate decoding) libraries out there.
I wrote a differential fuzzer for x86 decoders a few years ago, and XED and Zydis generally performed far better (in terms of accuracy) than Capstone[1]. And on the Rust side, yaxpeax and iced-x86 perform very admirably.
In my previous job, I've worked on a project that requires disassembling large amounts of x86/amd64 instructions (several billion instructions each running is very common). I've found also that Zydis is much faster than Capstone.
The spec is very large, not particularly well written, and is not “total” (in the sense that AMD64 and IA32e and other x86-64 flavors are all subtly different). There are a lot of ways to get it wrong; even XED (the reference decoder from Intel) has bugs.
If I remember correct, the Intel SDM alone is over 3000 pages long.
lol, no. For one Capstone has a lot of bugs (it uses some old version of LLVM as its base) but the whole question of how to decode things is complicated because there are a lot of pitfalls and inconsistencies that different disassemblers handle differently. And what the hardware does is a different question entirely: it may not match the spec, or even other processors with the same ISA.
It's just a wrapper around LLVM. So any project would be forced to ship also the corresponding LLVM version, if it's not present on the system - e.g. for Windows or embedded applications. A bit too much for a simple disassembler. So it's not a direct replacement for Capstone.
Full disclosure, I'm one of the nyxstone developers - so I might be biased.
In comparison to capstone, nyxstone lacks the features of instruction decomposition and providing read/written registers.
In addition, nyxstone directly interfaces with LLVM and thus is expected to be a lot slower than capstone, which uses
instruction tables generated by a modified LLVM.
I want to note here that Nyxstone is intended more as a replacement for Keystone than Capstone. We added the disassembler
mainly because we could. Compared to Keystone, nyxstone allows precise definition of target triple and ISA extensions,
allows definition of external labels, supports structured output with instruction details (address, bytes, assembly),
rejects partial and invalid inputs and rejects instructions not supported by the specific core
(for example UMAAL is supported by Cortex-M4, but not by Cortex-M3), and is more up to date.
Nyxstone does not require patches in the LLVM source tree, and thus is (I'd argue) more maintainable and easier to keep
up to date.
Capstone doesn't vendor LLVM either. It just contains some pieces of the LLVM-ish infrastructure that were converted from C++ to the pure C and are pretty lean, without any external dependency.
I wrote a differential fuzzer for x86 decoders a few years ago, and XED and Zydis generally performed far better (in terms of accuracy) than Capstone[1]. And on the Rust side, yaxpeax and iced-x86 perform very admirably.
[1]: https://blog.trailofbits.com/2019/10/31/destroying-x86_64-in...