Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

Ddisasm

GrammaTech's Datalog disassembler, which turns ELF and PE binaries for x86-32, x86-64, ARM32, ARM64 and MIPS32 into the GTIRB intermediate representation. It decodes a superset of possible instructions, then applies Soufflé Datalog rules and weighted heuristics to infer code locations, symbolization and function boundaries; gtirb-pprinter turns the result into reassemblable assembly or a rebuilt binary, and the GTIRB APIs or gtirb-rewriting can modify it in between. User hint files add Datalog facts or change heuristic weights where inference goes wrong.

Targets
Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest GitHub release at review: v1.8.0, published 2023-12-14 without attached files. Later versions are distributed elsewhere: PyPI lists ddisasm 1.9.5, uploaded 2026-07-06 as a single manylinux x86_64 wheel. The reviewed main commit, from 2026-10-13, declares version 1.9.6, which its changelog marks unreleased.
  • Prebuilt options are the grammatech/ddisasm Docker image (stable or unstable tags), Ubuntu 20 (focal) apt packages and Windows .zip builds on GrammaTech's servers; the docs warn against mixing stable and unstable tools. Source builds need a C++17 compiler, GTIRB 1.12.1+, gtirb-pprinter 2.0.0+, Capstone 5.0.1+ (GrammaTech tests with its fork), Soufflé 2.4 built with 64-bit numbers, libehp 1.0.0+ and LIEF 0.13.2+.
  • Input is an ELF or PE binary; rebuilding through gtirb-pprinter invokes a compiler or assembler such as gcc. Code inference and symbolization are heuristic: --self-diagnose checks symbolization only for binaries linked with complete relocation information, and the docs call the option that replaces CFI directives with .eh_frame symbolic expressions experimental and unreliable.
  • AGPL-3.0; contributions require GrammaTech's contributor license agreement. GTIRB, gtirb-pprinter and gtirb-rewriting are separate projects. The README cites a USENIX Security 2020 paper and an IEEE S&P 2025 paper on the approach.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · GrammaTech/ddisasm · Revision 1d17f29
  2. doc/source/GENERAL/1-Installation.md GitHub · GrammaTech/ddisasm · Revision 1d17f29
  3. doc/source/GENERAL/2-Building-Ddisasm.md GitHub · GrammaTech/ddisasm · Revision 1d17f29
  4. doc/source/GENERAL/3-Command-line-options.md#L38-L53 GitHub · GrammaTech/ddisasm · Revision 1d17f29
  5. doc/source/GENERAL/5-AdvancedUsage.md GitHub · GrammaTech/ddisasm · Revision 1d17f29
  6. CHANGELOG.md GitHub · GrammaTech/ddisasm · Revision 1d17f29
  7. version.txt GitHub · GrammaTech/ddisasm · Revision 1d17f29
  8. CONTRIBUTING.md GitHub · GrammaTech/ddisasm · Revision 1d17f29
  9. LICENSE.txt GitHub · GrammaTech/ddisasm · Revision 1d17f29
  10. https://github.com/GrammaTech/ddisasm/releases/tag/v1.8.0
  11. https://pypi.org/project/ddisasm/1.9.5/
  12. https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya

More in Native binaries

All 269 entries in Native binaries

↑↓ move↵ open⌘↵ new tab