1*9a0e4156SSadaf EbrahimiThis documentation explains how to compile Capstone on Windows using 2*9a0e4156SSadaf EbrahimiMicrosoft Visual Studio version 2010 or newer. 3*9a0e4156SSadaf Ebrahimi 4*9a0e4156SSadaf EbrahimiTo compile Capstone on *nix, see COMPILE.TXT 5*9a0e4156SSadaf Ebrahimi 6*9a0e4156SSadaf EbrahimiTo compile Capstone with CMake, see COMPILE_CMAKE.TXT 7*9a0e4156SSadaf Ebrahimi 8*9a0e4156SSadaf Ebrahimi *-*-*-*-*-* 9*9a0e4156SSadaf Ebrahimi 10*9a0e4156SSadaf EbrahimiCapstone requires no prerequisite packages with default configurations, so it is 11*9a0e4156SSadaf Ebrahimieasy to compile & install. Open the Visual Studio solution "msvc/capstone.sln" 12*9a0e4156SSadaf Ebrahimiand follow the instructions below. 13*9a0e4156SSadaf Ebrahimi 14*9a0e4156SSadaf EbrahimiNOTE: This requires Visual Studio 2010 or newer versions. 15*9a0e4156SSadaf Ebrahimi 16*9a0e4156SSadaf EbrahimiIf you wish to embed Capstone in a kernel driver, Visual Studio 2013 or newer 17*9a0e4156SSadaf Ebrahimiversions, and Windows Driver Kit 8.1 Update 1 or newer versions are required. 18*9a0e4156SSadaf Ebrahimi 19*9a0e4156SSadaf Ebrahimi 20*9a0e4156SSadaf Ebrahimi(0) Tailor Capstone to your need. 21*9a0e4156SSadaf Ebrahimi 22*9a0e4156SSadaf Ebrahimi Out of 9 archtitectures supported by Capstone (Arm, Arm64, M68K, Mips, PPC, 23*9a0e4156SSadaf Ebrahimi Sparc, SystemZ, X86 & XCore), if you just need several selected archs, choose 24*9a0e4156SSadaf Ebrahimi the ones you want to compile in by opening Visual Studio solution "msvc\capstone.sln", 25*9a0e4156SSadaf Ebrahimi then directly editing the projects "capstone_static" & "capstone_dll" for static 26*9a0e4156SSadaf Ebrahimi and dynamic libraries, respectively. This must be done before going to the next 27*9a0e4156SSadaf Ebrahimi steps. 28*9a0e4156SSadaf Ebrahimi 29*9a0e4156SSadaf Ebrahimi In VisualStudio interface, modify the preprocessor definitions via 30*9a0e4156SSadaf Ebrahimi "Project Properties" -> "Configuration Properties" -> "C/C++" -> "Preprocessor" 31*9a0e4156SSadaf Ebrahimi to customize Capstone library, as followings. 32*9a0e4156SSadaf Ebrahimi 33*9a0e4156SSadaf Ebrahimi - CAPSTONE_HAS_ARM: support ARM. Delete this to remove ARM support. 34*9a0e4156SSadaf Ebrahimi - CAPSTONE_HAS_ARM64: support ARM64. Delete this to remove ARM64 support. 35*9a0e4156SSadaf Ebrahimi - CAPSTONE_HAS_M68K: support M68K. Delete this to remove M68K support. 36*9a0e4156SSadaf Ebrahimi - CAPSTONE_HAS_MIPS: support Mips. Delete this to remove Mips support. 37*9a0e4156SSadaf Ebrahimi - CAPSTONE_HAS_POWERPC: support PPC. Delete this to remove PPC support. 38*9a0e4156SSadaf Ebrahimi - CAPSTONE_HAS_SPARC: support Sparc. Delete this to remove Sparc support. 39*9a0e4156SSadaf Ebrahimi - CAPSTONE_HAS_SYSZ: support SystemZ. Delete this to remove SystemZ support. 40*9a0e4156SSadaf Ebrahimi - CAPSTONE_HAS_X86: support X86. Delete this to remove X86 support. 41*9a0e4156SSadaf Ebrahimi - CAPSTONE_HAS_XCORE: support XCore. Delete this to remove XCore support. 42*9a0e4156SSadaf Ebrahimi 43*9a0e4156SSadaf Ebrahimi By default, all 9 architectures are compiled in. 44*9a0e4156SSadaf Ebrahimi 45*9a0e4156SSadaf Ebrahimi 46*9a0e4156SSadaf Ebrahimi Besides, Capstone also allows some more customization via following macros. 47*9a0e4156SSadaf Ebrahimi 48*9a0e4156SSadaf Ebrahimi - CAPSTONE_USE_SYS_DYN_MEM: delete this to use your own dynamic memory management. 49*9a0e4156SSadaf Ebrahimi - CAPSTONE_DIET_NO: rename this to "CAPSTONE_DIET" to make the binaries more compact. 50*9a0e4156SSadaf Ebrahimi - CAPSTONE_X86_REDUCE_NO: rename this to "CAPSTONE_X86_REDUCE" to make X86 binary smaller. 51*9a0e4156SSadaf Ebrahimi - CAPSTONE_X86_ATT_DISABLE_NO: rename this to "CAPSTONE_X86_ATT_DISABLE" to disable 52*9a0e4156SSadaf Ebrahimi AT&T syntax on x86. 53*9a0e4156SSadaf Ebrahimi 54*9a0e4156SSadaf Ebrahimi By default, Capstone use system dynamic memory management, and both DIET and X86_REDUCE 55*9a0e4156SSadaf Ebrahimi modes are disable. 56*9a0e4156SSadaf Ebrahimi 57*9a0e4156SSadaf Ebrahimi 58*9a0e4156SSadaf Ebrahimi For each option, refer to docs/README for more details. 59*9a0e4156SSadaf Ebrahimi 60*9a0e4156SSadaf Ebrahimi 61*9a0e4156SSadaf Ebrahimi 62*9a0e4156SSadaf Ebrahimi(1) Compile from source on Windows with Visual Studio 63*9a0e4156SSadaf Ebrahimi 64*9a0e4156SSadaf Ebrahimi - Choose the configuration and the platform you want: Release/Debug & Win32/Win64. 65*9a0e4156SSadaf Ebrahimi - Build only the libraries, or the libraries along with all the tests. 66*9a0e4156SSadaf Ebrahimi - "capstone_static_winkernel" is for compiling Capstone for a driver and 67*9a0e4156SSadaf Ebrahimi "test_winkernel" is a test for a driver, and those are excluded from build by 68*9a0e4156SSadaf Ebrahimi default. To compile them, open the Configuration Manager through the [Build] 69*9a0e4156SSadaf Ebrahimi menu and check "Build" check boxes for those project. 70*9a0e4156SSadaf Ebrahimi 71*9a0e4156SSadaf Ebrahimi 72*9a0e4156SSadaf Ebrahimi 73*9a0e4156SSadaf Ebrahimi(2) You can make sure the prior steps successfully worked by launching one of the 74*9a0e4156SSadaf Ebrahimi testing binary (test*.exe). 75*9a0e4156SSadaf Ebrahimi 76*9a0e4156SSadaf Ebrahimi The testing binary for a driver "test_winkernel.sys" is made up of all tests for 77*9a0e4156SSadaf Ebrahimi supported architectures configured with the step (0) along side its own tests. 78*9a0e4156SSadaf Ebrahimi Below explains a procedure to run the test driver and check test results. 79*9a0e4156SSadaf Ebrahimi 80*9a0e4156SSadaf Ebrahimi On the x64 platform, the test signing mode has to be enabled to install the test 81*9a0e4156SSadaf Ebrahimi driver. To do it, open the command prompt with the administrator privileges and 82*9a0e4156SSadaf Ebrahimi type the following command, and then restart the system to activate the change: 83*9a0e4156SSadaf Ebrahimi 84*9a0e4156SSadaf Ebrahimi >bcdedit /set testsigning on 85*9a0e4156SSadaf Ebrahimi 86*9a0e4156SSadaf Ebrahimi Test results from the test driver is sent to kernel debug buffer. In order to 87*9a0e4156SSadaf Ebrahimi see those results, download DebugView and run it with the administrator 88*9a0e4156SSadaf Ebrahimi privileges, then check [Capture Kernel] through the [Capture] menu. 89*9a0e4156SSadaf Ebrahimi 90*9a0e4156SSadaf Ebrahimi DebugView: https://technet.microsoft.com/en-us/sysinternals/debugview.aspx 91*9a0e4156SSadaf Ebrahimi 92*9a0e4156SSadaf Ebrahimi To install and uninstall the driver, use the 'sc' command. For installing and 93*9a0e4156SSadaf Ebrahimi executing test_winkernel.sys, execute the following commands with the 94*9a0e4156SSadaf Ebrahimi administrator privileges: 95*9a0e4156SSadaf Ebrahimi 96*9a0e4156SSadaf Ebrahimi >sc create test_winkernel type= kernel binPath= <full path to test_winkernel.sys> 97*9a0e4156SSadaf Ebrahimi [SC] CreateService SUCCESS 98*9a0e4156SSadaf Ebrahimi 99*9a0e4156SSadaf Ebrahimi >sc start test_winkernel 100*9a0e4156SSadaf Ebrahimi [SC] StartService FAILED 995: 101*9a0e4156SSadaf Ebrahimi 102*9a0e4156SSadaf Ebrahimi The I/O operation has been aborted because of either a thread exit or an application request. 103*9a0e4156SSadaf Ebrahimi 104*9a0e4156SSadaf Ebrahimi To uninstall the driver, execute the following commands with the administrator 105*9a0e4156SSadaf Ebrahimi privileges: 106*9a0e4156SSadaf Ebrahimi 107*9a0e4156SSadaf Ebrahimi >sc delete test_winkernel 108*9a0e4156SSadaf Ebrahimi >bcdedit /deletevalue testsigning 109*9a0e4156SSadaf Ebrahimi 110*9a0e4156SSadaf Ebrahimi 111*9a0e4156SSadaf Ebrahimi 112*9a0e4156SSadaf Ebrahimi(3) Installing and building capstone via vcpkg 113*9a0e4156SSadaf Ebrahimi 114*9a0e4156SSadaf Ebrahimi You can download and install capstone using the vcpkg(https://github.com/Microsoft/vcpkg) dependency manager: 115*9a0e4156SSadaf Ebrahimi 116*9a0e4156SSadaf Ebrahimi git clone https://github.com/Microsoft/vcpkg.git 117*9a0e4156SSadaf Ebrahimi cd vcpkg 118*9a0e4156SSadaf Ebrahimi ./bootstrap-vcpkg.sh 119*9a0e4156SSadaf Ebrahimi ./vcpkg integrate install 120*9a0e4156SSadaf Ebrahimi vcpkg install capstone 121*9a0e4156SSadaf Ebrahimi 122*9a0e4156SSadaf Ebrahimi The capstone port in vcpkg is kept up to date by Microsoft team members and community contributors. If the version is out of date, please create an issue or pull request on the vcpkg repository(https://github.com/Microsoft/vcpkg).