Skip to main content
Tweeted twitter.com/StackReverseEng/status/832790879005970432
edited tags
Link
NirIzr
  • 11.8k
  • 1
  • 38
  • 87

Difference between What type of disassembler is distorm and other disassemblers?

Source Link
knx
  • 1.3k
  • 1
  • 10
  • 26

Difference between distorm and other disassemblers

In Alam you can find the classical differentiation between disassemblers. The author explains in general the two well known types of disassemblers:

  1. The Linear Sweep technique starts from the first byte of the code and disassembles one instruction at a time until the end. [...]

  2. The Recursive Traversal technique relies on the control flow of the program and decodes the bytes by following the control flow of the program. [...]

Afterwards, the author introduces distorm and he makes the following statement:

Both techniques have some deficiencies. To overcome these deficiencies a good disassembler would combine both techniques. One such open source disassembler, for non-commercial use, is distorm.

After reading the docs of distorm, I'm not able to confirm this last statement. In my opinion, distorm seems to work like a classic Linear-Sweep version, and also will struggle with fake instructions and obfuscation (see 1). It calls itself "stream disassembler", where I was not able to fully clarify this expression.

With these facts, I have two questions:

  1. Is distorm really a combination of linear sweep and recursive traversal as mentioned by the author?

  2. What is your formal understanding of a "stream disassembler"?


0 Page 47 in Alam, Shahid, et al. "A framework for metamorphic malware analysis and real-time detection." computers & security 48 (2015): 212-233.

1 https://github.com/gdabah/distorm/wiki/StreamDisassembler