ddisasm: A fast and accurate disassembler

DDisasm is a fast and precise disassembler designed to produce reassemblable assembly code. It operates using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics.

Upon launching, DDisasm parses ELF/PE file data and decodes a wide range of potential instructions, constructing an initial set of datalog facts. These facts are then analyzed to determine code location, symbolization, and function boundaries. The refined set of facts derived from this analysis is subsequently translated into the GTIRB intermediate representation for further binary analysis and reverse engineering.

The GTIRB pretty printer can subsequently be employed to present the GTIRB in a format suitable for reassembling the binary. DDisasm can be executed within a Docker environment, allowing users to disassemble a binary into the GTIRB format. Within this container, one can build an example binary provided in the repository.

Once the binary has been disassembled into GTIRB format, users can programmatically modify the binary using GTIRB or gtirb-rewriting. They can then utilize gtirb-pprinter, included in the Docker image, to generate a new version of the binary. This process involves generating an assembly file and invoking the compiler/assembler (e.g. gcc) to produce the revised binary. gtirb-pprinter takes care of generating all the necessary command line options, including compilation options, library dependencies, and version linker scripts.

Alternatively, gtirb-pprinter can be used to generate an assembly listing for manual modification. This listing can then be manually recompiled into a new binary. For comprehensive details, users are encouraged to consult the provided documentation.