16

One of the major hurdles of x86 disassembly is separating code from data. All available open-source disassembly library only perform a straight line disassembly (starts from the top and skips errors by 1 byte), compared with OllyDBG which apparently uses a control flow disassembly (using opcodes like CALL and JMP) or IDA using heuristics and emulation. However these two aren't open-source.

My question is, is there any open-source library or project that uses a better technique than simple straight line disassembly (control flow or heuristics based) ?

I stumbled upon a paper using a machine learning approach ? is there an open-source implementation of this approach ?

1

4 Answers 4

21

Radare 2 is a GPL software, with a good API, and is not using linear disassembling.

See visual mode (Vp command) example: example r2 x86 session

8
  • 2
    Thanks, do you happen to have a link or documentation on the disassembly appraoch they are using ?
    – 3asm_
    Jan 13, 2014 at 10:13
  • 1
    @3asm_ Pancake and the rest of the radare2 team. Has the philosophy 'writing-documention is overrated when you can read the source'. Thus, read the source ;)
    – Stolas
    Jan 13, 2014 at 14:30
  • 2
    @Stolas: well, that sounds similar to the big fat "f... you" the Git docs give users trying to merely make use of Git without studying ten semesters of Gitology first.
    – 0xC0000022L
    Jan 13, 2014 at 16:06
  • @0xC0000022L not sure if you are insulting me or not. But it is understandable that the radare2 team does it. As they want to spend there time write code instead of creating the documentation. Also because when they finished the documentation of radare1 the took got an overhaul... I once started with writing the documentation myself, in form of a book (like the animal books of O'Reilly) but it's just too much work.
    – Stolas
    Jan 13, 2014 at 16:19
  • 1
    @0xC0000022L In fact you can use internal help for radare2 commands - just type '?' and/or '<command name>?' Jan 14, 2014 at 11:27
6

I'm reposting my comment which I wrote for perror's question

Lida (a tool based on Bastard's libdisasm), distorm and beaengine are some open source disassembly engines that use recursive disassembly.

1
  • Distorm is a linear disassembler AFAIK (used if for several projects)
    – NirIzr
    Mar 9, 2017 at 8:03
5

Another option is (sorry for the spam!) http://pyew.googlecode.com. This is a static analyser written in Python that is used, mainly, for malware analysis. Depending on what you need, you may find it useful (it only supports yet 16, 32 and x64 Intel code). You can write your own scripts using Pyew's API (here you have a more complex example). I use (and used it) for masive malware analysis. Indeed, when I was working for them, Pyew was analysing all the VirusTotal traffic. We used it to discard some very similar looking samples from some expensive analysis.

Pyew does recursive traversal code analysis (explanation here). Pyew it's not going to be fooled like linear-sweeps disassemblers. Anyway, it isn't as smart as it's IDA. Pyew is Open Source (GPL) and depending on your needs I even give, sometimes, LGPL licenses for it.

PS: If you're looking for something that support anything which is not Intel based and you want something Open Source you really need to check out radare.

1
  • Thanks very insightful, the fact it is in Python will help a lot in my project, many thanks.
    – 3asm_
    Jan 16, 2014 at 8:47
0

Another OpenSource library that might of interest.

Capstone Engine

It supports several architectures, such as x86 (+AMD64), ARM, PowerPC and SPARC.

1
  • Doesn't capstone only use straight line disassembly and is more focused on supporting multiple architectures instead ?
    – 3asm_
    Mar 8, 2017 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.