15

One of the major hurdles of x86 disassembly is separating code from data. All available open-source disassembly library only perform a straight line disassembly (starts from the top and skips errors by 1 byte), compared with OllyDBG which apparently uses a control flow disassembly (using opcodes like CALL and JMP) or IDA using heuristics and emulation. However these two aren't open-source.

My question is, is there any open-source library or project that uses a better technique than simple straight line disassembly (control flow or heuristics based) ?

I stumbled upon a paper using a machine learning approach ? is there an open-source implementation of this approach ?

20

Radare 2 is a GPL software, with a good API, and is not using linear disassembling.

See visual mode (Vp command) example: example r2 x86 session

  • 2
    Thanks, do you happen to have a link or documentation on the disassembly appraoch they are using ? – 3asm_ Jan 13 '14 at 10:13
  • 1
    @3asm_ Pancake and the rest of the radare2 team. Has the philosophy 'writing-documention is overrated when you can read the source'. Thus, read the source ;) – Stolas Jan 13 '14 at 14:30
  • 2
    @Stolas: well, that sounds similar to the big fat "f... you" the Git docs give users trying to merely make use of Git without studying ten semesters of Gitology first. – 0xC0000022L Jan 13 '14 at 16:06
  • @0xC0000022L not sure if you are insulting me or not. But it is understandable that the radare2 team does it. As they want to spend there time write code instead of creating the documentation. Also because when they finished the documentation of radare1 the took got an overhaul... I once started with writing the documentation myself, in form of a book (like the animal books of O'Reilly) but it's just too much work. – Stolas Jan 13 '14 at 16:19
  • 1
    @0xC0000022L In fact you can use internal help for radare2 commands - just type '?' and/or '<command name>?' – Anton Kochkov Jan 14 '14 at 11:27
6

I'm reposting my comment which I wrote for perror's question

Lida (a tool based on Bastard's libdisasm), distorm and beaengine are some open source disassembly engines that use recursive disassembly.

  • Distorm is a linear disassembler AFAIK (used if for several projects) – NirIzr Mar 9 '17 at 8:03
5

Another option is (sorry for the spam!) http://pyew.googlecode.com. This is a static analyser written in Python that is used, mainly, for malware analysis. Depending on what you need, you may find it useful (it only supports yet 16, 32 and x64 Intel code). You can write your own scripts using Pyew's API (here you have a more complex example). I use (and used it) for masive malware analysis. Indeed, when I was working for them, Pyew was analysing all the VirusTotal traffic. We used it to discard some very similar looking samples from some expensive analysis.

Pyew does recursive traversal code analysis (explanation here). Pyew it's not going to be fooled like linear-sweeps disassemblers. Anyway, it isn't as smart as it's IDA. Pyew is Open Source (GPL) and depending on your needs I even give, sometimes, LGPL licenses for it.

PS: If you're looking for something that support anything which is not Intel based and you want something Open Source you really need to check out radare.

  • Thanks very insightful, the fact it is in Python will help a lot in my project, many thanks. – 3asm_ Jan 16 '14 at 8:47
0

Another OpenSource library that might of interest.

Capstone Engine

It supports several architectures, such as x86 (+AMD64), ARM, PowerPC and SPARC.

  • Doesn't capstone only use straight line disassembly and is more focused on supporting multiple architectures instead ? – 3asm_ Mar 8 '17 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.