# Ddisasm

> GrammaTech's Datalog disassembler, which turns ELF and PE binaries for x86-32, x86-64, ARM32, ARM64 and MIPS32 into the GTIRB intermediate representation. It decodes a superset of possible instructions, then applies Soufflé Datalog rules and weighted heuristics to infer code locations, symbolization and function boundaries; gtirb-pprinter turns the result into reassemblable assembly or a rebuilt binary, and the GTIRB APIs or gtirb-rewriting can modify it in between. User hint files add Datalog facts or change heuristic weights where inference goes wrong.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-19
- Original resource: <https://github.com/GrammaTech/ddisasm>
- Primary source: <https://github.com/GrammaTech/ddisasm/blob/1d17f292e3672078eeb753473847306ca3f0f1ff/README.md>
- Catalog page: <https://awesomerea.org/resources/ddisasm/>
- Record JSON: <https://awesomerea.org/resources/ddisasm/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/ddisasm/index.md)

## Requirements & limits

- Latest GitHub release at review: v1.8.0, published 2023-12-14 without attached files. Later versions are distributed elsewhere: PyPI lists ddisasm 1.9.5, uploaded 2026-07-06 as a single manylinux x86_64 wheel. The reviewed main commit, from 2026-10-13, declares version 1.9.6, which its changelog marks unreleased.
- Prebuilt options are the grammatech/ddisasm Docker image (stable or unstable tags), Ubuntu 20 (focal) apt packages and Windows .zip builds on GrammaTech's servers; the docs warn against mixing stable and unstable tools. Source builds need a C++17 compiler, GTIRB 1.12.1+, gtirb-pprinter 2.0.0+, Capstone 5.0.1+ (GrammaTech tests with its fork), Soufflé 2.4 built with 64-bit numbers, libehp 1.0.0+ and LIEF 0.13.2+.
- Input is an ELF or PE binary; rebuilding through gtirb-pprinter invokes a compiler or assembler such as gcc. Code inference and symbolization are heuristic: --self-diagnose checks symbolization only for binaries linked with complete relocation information, and the docs call the option that replaces CFI directives with .eh_frame symbolic expressions experimental and unreliable.
- AGPL-3.0; contributions require GrammaTech's contributor license agreement. GTIRB, gtirb-pprinter and gtirb-rewriting are separate projects. The README cites a USENIX Security 2020 paper and an IEEE S&P 2025 paper on the approach.

## Primary sources

1. <https://github.com/GrammaTech/ddisasm/blob/1d17f292e3672078eeb753473847306ca3f0f1ff/README.md>
2. <https://github.com/GrammaTech/ddisasm/blob/1d17f292e3672078eeb753473847306ca3f0f1ff/doc/source/GENERAL/1-Installation.md>
3. <https://github.com/GrammaTech/ddisasm/blob/1d17f292e3672078eeb753473847306ca3f0f1ff/doc/source/GENERAL/2-Building-Ddisasm.md>
4. <https://github.com/GrammaTech/ddisasm/blob/1d17f292e3672078eeb753473847306ca3f0f1ff/doc/source/GENERAL/3-Command-line-options.md#L38-L53>
5. <https://github.com/GrammaTech/ddisasm/blob/1d17f292e3672078eeb753473847306ca3f0f1ff/doc/source/GENERAL/5-AdvancedUsage.md>
6. <https://github.com/GrammaTech/ddisasm/blob/1d17f292e3672078eeb753473847306ca3f0f1ff/CHANGELOG.md>
7. <https://github.com/GrammaTech/ddisasm/blob/1d17f292e3672078eeb753473847306ca3f0f1ff/version.txt>
8. <https://github.com/GrammaTech/ddisasm/blob/1d17f292e3672078eeb753473847306ca3f0f1ff/CONTRIBUTING.md>
9. <https://github.com/GrammaTech/ddisasm/blob/1d17f292e3672078eeb753473847306ca3f0f1ff/LICENSE.txt>
10. <https://github.com/GrammaTech/ddisasm/releases/tag/v1.8.0>
11. <https://pypi.org/project/ddisasm/1.9.5/>
12. <https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya>

## More in Native binaries

- [PINCE](https://awesomerea.org/resources/pince/index.md) · Tool
- [uncompyle6](https://awesomerea.org/resources/uncompyle6/index.md) · Tool
- [ret-sync](https://awesomerea.org/resources/ret-sync/index.md) · Tool
- [PyInstaller Extractor (pyinstxtractor)](https://awesomerea.org/resources/pyinstxtractor/index.md) · Tool
- [Binary Analysis Platform (BAP)](https://awesomerea.org/resources/bap/index.md) · Tool
- [Reko](https://awesomerea.org/resources/reko/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.