I have an ARM64 instruction trace captured from a process I'm interested in. I'm wondering if there are any open source utilities for converting the textual assembly into a C-like format.

I've already reverse engineered the binary using tools such as Ghidra. However, this particular binary is heavily obfuscated and the assembly as-is throws off the disassembler and thus the decompiler. Having the instruction trace reveals the true sequence of instructions executed at runtime. My hope is that the actual sequence of instructions is more straightforward for a decompiler than the obfuscated version. I understand certain control flow constructs may be lost during such a conversion.

Here is an example of the instruction trace format:

0x517994 add x11, sp, #0x48
0x517998 ldrb w11, [x11, x8]
0x51799c eor w10, w11, w10

I would like something like this:

lVar1 = lVar2 + uVar5;
bVar4 = local_b8[lVar2] ^ *(byte *)(param_2 + lVar1);

Alternatively, if there was a way to re-assemble code based on my instruction trace, then load it into a tool such as Ghidra and decompile from there, that could work too.

  • 2
    you can probably assemble the trace back to a binary using keystone assembler framework obviously some things wont pan out and may need intervention
    – blabb
    Aug 18 at 4:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.