What type of disassembler is distorm?

Question

In Alam you can find the classical differentiation between disassemblers. The author explains in general the two well known types of disassemblers:

1. The Linear Sweep technique starts from the first byte of the code and disassembles one instruction at a time until the end. [...]

2. The Recursive Traversal technique relies on the control flow of the program and decodes the bytes by following the control flow of the program. [...]

Afterwards, the author introduces distorm and he makes the following statement:

Both techniques have some deficiencies. To overcome these deficiencies a good disassembler would combine both techniques. One such open source disassembler, for non-commercial use, is distorm.

After reading the docs of distorm, I'm not able to confirm this last statement. In my opinion, distorm seems to work like a classic Linear-Sweep version, and also will struggle with fake instructions and obfuscation (see 1). It calls itself "stream disassembler", where I was not able to fully clarify this expression.

With these facts, I have two questions:

1. Is distorm really a combination of linear sweep and recursive traversal as mentioned by the author?

2. What is your formal understanding of a "stream disassembler"?

---

0 Page 47 in Alam, Shahid, et al. "A framework for metamorphic malware analysis and real-time detection." computers & security 48 (2015): 212-233.

1 https://github.com/gdabah/distorm/wiki/StreamDisassembler

Answer 1

DiStorm does not implement recursive traversal, however you can use distorm (or others, e.g. capstone) to implement your own recursive traversal algortihm.

There are a range of tools available doing something like this for you: IDA, BinaryNinja, JakStab (claims 'Iterative Disassembly') etc.

Since retrieving the ControlFlowGraph is a hard problem, people tend to separate between the translation from machine code to assembler and the useage of those frameworks to retrieve the actual control flow.

Cite from diStorms Github:

This is the time to say that diStorm, as a stream disassembler, doesn't do the flow control analysis work for you, but it will help you do that more easily.

Disassemblers try to help by indicating which instructions may change the control flow and supplying direct targets, but implementing control flow recovery is non-trivial due to indriect jumps and anti-disassembler techniques.

Regarding the second part of the question: It disassembles a given stream of bytes (buffer object). That doesn't seem any different from any disassembler out there.