DDisasm: Reversible (bi-directional) Disassembler
DDisasm is a sophisticated, reversible disassembler designed for accuracy and speed, capable of producing assembly code that can be reassembled. It employs Datalog logic programming for deep binary analysis and integrates with the GTIRB intermediate representation for programmatic manipulation. This tool offers significant capabilities for reverse engineering and binary analysis, appealing to those who need precise control over compiled code.
The Lowdown
DDisasm is an open-source project by GrammaTech, presenting itself as a fast and accurate disassembler capable of generating reassemblable assembly code. This tool is built on a declarative logic programming language called Datalog (specifically using Souffle) to define its disassembly rules and heuristics, which is a novel approach for such a utility. Its primary goal is to aid in binary analysis and reverse engineering tasks by providing a robust and modifiable intermediate representation of binaries.
- Core Functionality: Disassembles ELF (Linux) and PE (Windows) binaries into a precise intermediate representation (GTIRB).
- Key Innovation: The assembly generated by DDisasm, via the GTIRB pretty printer, is accurate enough to be reassembled back into a functional binary, enabling a 'reversible' workflow.
- Technical Foundation: Utilizes Datalog to parse file information, decode instructions, and identify crucial elements like code locations, symbolization, and function boundaries.
- Supported Architectures: Covers a broad range including x86_32, x86_64, ARM32, ARM64, and MIPS32.
- Workflow Integration: After disassembling to GTIRB, users can programmatically modify the binary's structure or content using GTIRB libraries, then use
gtirb-pprinterto generate new assembly files or recompile directly into an altered binary. - Accessibility: A Docker image is provided for easy setup and execution, allowing users to quickly get started with disassembling and experimenting.
Ultimately, DDisasm offers a powerful, research-backed solution for those in binary analysis and reverse engineering, bridging the gap between low-level machine code and a manipulable, reassemblable assembly form through an innovative Datalog-driven approach.