{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/HexHive/retrowrite/blob/3b1e366ff8d2449a4f4c3157dd95c6f39c0a310b/retrowrite#L160-L200",
    "https://github.com/HexHive/retrowrite/blob/3b1e366ff8d2449a4f4c3157dd95c6f39c0a310b/requirements.txt",
    "https://github.com/HexHive/retrowrite/blob/3b1e366ff8d2449a4f4c3157dd95c6f39c0a310b/setup.py",
    "https://github.com/HexHive/retrowrite/blob/3b1e366ff8d2449a4f4c3157dd95c6f39c0a310b/.github/workflows/action.yml",
    "https://github.com/HexHive/retrowrite/blob/3b1e366ff8d2449a4f4c3157dd95c6f39c0a310b/demos/fuzzing/README.md",
    "https://github.com/HexHive/retrowrite/blob/3b1e366ff8d2449a4f4c3157dd95c6f39c0a310b/demos/fuzzing/docker/README.md",
    "https://github.com/HexHive/retrowrite/blob/3b1e366ff8d2449a4f4c3157dd95c6f39c0a310b/demos/kernel_demo/README.md",
    "https://github.com/HexHive/retrowrite/blob/3b1e366ff8d2449a4f4c3157dd95c6f39c0a310b/LICENSE",
    "https://doi.org/10.1109/SP40000.2020.00009",
    "https://hexhive.epfl.ch/theses/20-dibartolomeo-thesis.pdf"
  ],
  "category": "native-analysis",
  "description_en": "HexHive's static binary rewriter for x64 and aarch64 Linux ELF binaries, which turns a binary into symbolized, reassemblable assembly so instrumentation can be inserted without source code and without heuristics. Bundled passes add a binary-only AddressSanitizer and AFL coverage instrumentation, plus a coarse-grained control-flow-integrity pass on aarch64, and the symbolized assembly can also be edited by hand or by other tools before reassembly. The KRetrowrite variant of the x64 rewriter instruments Linux kernel modules with BASan or kcov for kernel fuzzing.",
  "description_zh": "HexHive 开发的静态二进制改写工具，面向 x64 与 aarch64 的 Linux ELF 二进制：将二进制转换为符号化、可重新汇编的汇编代码，从而无需源码、也不依赖启发式规则即可插入插桩。附带的改写模块可添加仅针对二进制的 AddressSanitizer 和 AFL 覆盖率插桩，aarch64 上另有函数入口粗粒度控制流完整性模块；符号化的汇编也可在重新汇编前手工或用其他工具修改。x64 改写器的 KRetrowrite 变体可用 BASan 或 kcov 为 Linux 内核模块插桩，用于内核模糊测试。",
  "entry_url": "https://awesomerea.org/resources/retrowrite/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/retrowrite/",
  "evidence_url": "https://github.com/HexHive/retrowrite/blob/3b1e366ff8d2449a4f4c3157dd95c6f39c0a310b/README.md",
  "group": "tools",
  "id": "retrowrite",
  "json_url": "https://awesomerea.org/resources/retrowrite/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/retrowrite/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/retrowrite/index.md",
  "name": "RetroWrite",
  "name_zh": "RetroWrite 静态二进制改写框架",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "There are no releases or tags, and setup.py says 1.0.0. The reviewed master commit, from 2025-04-26, adjusts an x64 pass added four days earlier that randomizes instruction order within functions; before that, the latest commits, from 2023 and 2024, fixed capstone options and executable stacks on older kernels.",
    "Written in Python 3 (the README names 3.6) with pyelftools, capstone 4.0.2 or later, intervaltree and archinfo pinned to 9.1.11752, which the README says to install with pip rather than from distribution packages. x64 output is reassembled with an ordinary compiler such as gcc, linking -lasan for BASan, or with afl-gcc or afl-clang for AFL coverage; on aarch64, retrowrite -a assembles and links. The README's KRetrowrite setup calls a setup.sh that sits in the demo folders rather than at the repository root.",
    "Inputs are the user's own binaries or kernel modules. Per the README feature table, the x64 rewriter needs position-independent, unstripped binaries from standard compilers and has no C++ support, while the aarch64 rewriter also takes stripped and non-PIE binaries but not kernel modules or C++; --ignore-no-pie and --ignore-stripped skip the checks, to be used with caution. The two architectures use different rewriting algorithms: the IEEE S&P 2020 paper describes the x64 version and a separate HexHive thesis the aarch64 version.",
    "CI runs a SPEC CPU benchmark script on a self-hosted runner, and test scripts clone and rewrite coreutils, SQLite and Debian packages. Demos cover userspace, kernel-module and fuzzing setups; the Docker fuzzing demo bundles fuzz seeds and a patched AFL 2.52b archive but also needs a self-built clang 8, a git bundle of the repository and the separately downloaded LAVA-M corpus, and kernel fuzzing setup downloads about 10 GB of syzkaller VM files.",
    "MIT according to the LICENSE file and README, although GitHub does not recognize the license; capstone is included as a submodule under its own license."
  ],
  "requirements_zh": [
    "没有发布版本或标签，setup.py 标注的版本为 1.0.0。所审阅的 master 提交日期为 2025-04-26，调整了四天前新增的一个 x64 改写模块，该模块会打乱函数内的指令顺序；在此之前的最近提交来自 2023 和 2024 年，修复了 capstone 选项以及旧内核上的可执行栈问题。",
    "以 Python 3 编写（README 写明 3.6），依赖 pyelftools、capstone 4.0.2 或更高版本、intervaltree，以及固定为 9.1.11752 的 archinfo；README 建议用 pip 安装这些依赖，而不要使用发行版软件包。x64 输出可用 gcc 等普通编译器重新汇编，BASan 需链接 -lasan，AFL 覆盖率则改用 afl-gcc 或 afl-clang；在 aarch64 上由 retrowrite -a 完成汇编和链接。README 中 KRetrowrite 的安装步骤调用 setup.sh，但该脚本位于各演示目录中，而不在仓库根目录。",
    "输入为使用者自己的二进制或内核模块。根据 README 的功能表，x64 改写器要求位置无关、未去除符号且由标准编译器生成的二进制，不支持 C++；aarch64 改写器还能处理去除符号和非 PIE 的二进制，但不支持内核模块和 C++；--ignore-no-pie 与 --ignore-stripped 可跳过这些检查，需谨慎使用。两种架构采用不同的改写算法：IEEE S&P 2020 论文介绍 x64 版本，另一篇 HexHive 学位论文介绍 aarch64 版本。",
    "CI 在自托管运行器上执行 SPEC CPU 基准脚本，测试脚本会克隆并改写 coreutils、SQLite 和 Debian 软件包。演示涵盖用户态、内核模块和模糊测试环境；Docker 模糊测试演示附带模糊测试种子和打过补丁的 AFL 2.52b 压缩包，但还需要自行构建的 clang 8、仓库的 git bundle 以及另行下载的 LAVA-M 语料；内核模糊测试的安装会下载约 10 GB 的 syzkaller 虚拟机文件。",
    "依据 LICENSE 文件与 README 采用 MIT 许可，但 GitHub 未能识别该许可；capstone 以子模块形式引入，适用其自身许可。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/HexHive/retrowrite",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}