Are there ANY supported Fermi Disassemblers out there?

Question

I've recently started exploring the world of GPU-based malware. Academia doesn't have a ton of papers here, but there's some powerful ones. I'm looking at trying to improve the communities tools in terms of NVIDIA's fermi ISA, (since AMD published theirs!)

To date, I've not found any fermi disassemblers, but one ONE fermi assembler:

asfermi

Are their any plugins/disassemblers that this community is aware of, that my google searches have apparently turned up zilch? NVIDIA's supplied tools don't work for binaries compiled with vs2010.

=============[Updated Context]===================

Appears that to a certain extent, my assumptions were wrong. NVIDIA's disassembly tools (nvobjdump, nvdisasm) are designed only to work with their *.cubin (maybe *.ptx) intermediate assemblies. Which is bad, from a malware analysis perspective.

After searching extensively I found a dead project called decuda. (I say dead because it hasn't had a commit in years.) AND it doesn't seem to be able to handle disassembling *.cubin binaries from the latest releases, 5.5 and 6.0.

Answer 1

Well, after spending lots of time in NVIDIA's documentation, and the recent update to 6.0, they added the ability for their program cuobjdump to extract *.cubin files from any given target executable. So you can extract *.cubin files from PE or ELF files like this:

C:\ProgramData\NVIDIA Corporation\CUDA Samples\v6.0\Bin\win32\Debug>cuobjdump -xelf all simpleAtomicIntrinsics.exe

Then use nvdisasm on your target *.cubin file:

C:\ProgramData\NVIDIA Corporation\CUDA Samples\v6.0\Bin\win32\Debug>nvdisasm NVIDIA-CUDA-simpleAtomicIntrinsics.sm_50.cubin

Oh, by the way, nvdisasm does actually use control-flow disassembly. cuobjdump uses linear.

By playing with the provided tools you can extract opcodes, but unfortunately there's snakey instructions like S2R which according to NVIDIA's documentation does this:

S2R Special Register to Register

With no documentation I've seen yet as to what the special registers even ARE on this architecture. The best documentation on this so far is here.