Glonce

GrammaTech's DDisasm disassembles binaries into reassemblable code

securityThe Glonce editorsHacker News🔥33Glonce rating33Impact35Novelty40Relevance25Surprise15Players30Credibility90
GrammaTech's DDisasm disassembles binaries into reassemblable code

GrammaTech maintains DDisasm, a disassembler built on the Datalog declarative logic programming language (via the Souffle engine) to compile the rules and heuristics that drive disassembly. According to its documentation, DDisasm describes itself as a fast disassembler accurate enough that the resulting assembly code can be reassembled. The tool first parses ELF (Linux) or PE (Windows) file information and decodes a superset of possible instructions to build an initial set of datalog facts. Those facts are analyzed to identify code locations, symbolization, and function boundaries, producing a refined set of facts that is translated into GTIRB, an intermediate representation for binary analysis and reverse engineering. From there, the GTIRB pretty printer, gtirb-pprinter, converts the representation back into reassemblable assembly. DDisasm covers five instruction set architectures: x86_32, x86_64, ARM32, ARM64, and MIPS32. A published workflow runs the tool inside a Docker container (grammatech/ddisasm:latest): build an example binary with gcc, disassemble it with ddisasm to produce a .gtirb file, optionally rewrite that GTIRB representation programmatically using the GTIRB or gtirb-rewriting libraries, then hand it to gtirb-pprinter to emit either a new binary directly or an editable assembly listing for manual changes and recompilation. Per the documentation, gtirb-pprinter also handles generating the command line options a rebuild needs, including compilation options, library dependencies, and version linker scripts. The project traces to the paper "Datalog Disassembly" by Antonio Flores-Montoya and Eric Schulte, presented at the 29th USENIX Security Symposium in 2020. A follow-on paper, "Disassembly as Weighted Interval Scheduling with Learned Weights," appeared at the 2025 IEEE Symposium on Security and Privacy, extending the underlying disassembly approach. The repository also credits the Programming Language Group at the University of Sydney for initial ARM64 support and GitHub user gogo2464 for a documentation refactor.

Key facts

  • DDisasm compiles disassembly rules and heuristics as Datalog facts, run through the Souffle engine, rather than using a conventional disassembly algorithm.
  • It supports ELF (Linux) and PE (Windows) binaries across five instruction set architectures: x86_32, x86_64, ARM32, ARM64, and MIPS32.
  • The pipeline runs binary to datalog facts to the GTIRB intermediate representation to reassemblable assembly, with gtirb-pprinter handling the final rebuild, including compiler flags and linker scripts.
  • The approach originates from "Datalog Disassembly" by Antonio Flores-Montoya and Eric Schulte, USENIX Security 2020, and is extended in a 2025 IEEE Symposium on Security and Privacy paper on disassembly as weighted interval scheduling.
  • Community contributions are credited to the University of Sydney's Programming Language Group (initial ARM64 support) and GitHub user gogo2464 (documentation refactor).

Why it matters

Ordinary disassemblers turn machine code back into assembly for reading, but the assembly they produce often cannot be reassembled into a working binary: ambiguous byte sequences and mixed code and data trip up naive decoding. DDisasm's pitch is that formulating disassembly as a set of Datalog facts and rules, analyzed the way a database engine analyzes queries, lets it resolve those ambiguities well enough that the output survives a round trip back to a runnable binary. Compiling to GTIRB, a shared intermediate representation, then lets tools other than DDisasm itself inspect or rewrite a binary before reassembly.

Who it affects

The tool targets reverse engineers, binary analysts, and security researchers who need to inspect, patch, or transform compiled programs without their original source, whether for vulnerability research, malware analysis, or binary rewriting.

How to use it

GrammaTech ships a prebuilt Docker image, grammatech/ddisasm:latest. A documented walkthrough builds a sample C program inside the container, runs ddisasm on the resulting binary to produce a .gtirb file, and then uses gtirb-pprinter either to emit a rewritten binary directly or to dump an editable assembly listing that can be modified by hand and recompiled with gcc. Changes to the binary itself can also be made programmatically against the GTIRB representation using the GTIRB or gtirb-rewriting libraries before reassembly.

How solid is it

The technique behind DDisasm is not a fresh idea: it was formalized in "Datalog Disassembly" by Antonio Flores-Montoya and Eric Schulte, published at the 29th USENIX Security Symposium in 2020, a peer-reviewed academic venue. The underlying approach has continued to see research attention, with a 2025 IEEE Symposium on Security and Privacy paper, "Disassembly as Weighted Interval Scheduling with Learned Weights," building on the same problem. The project is maintained by GrammaTech, a company focused on binary analysis tooling, and has accepted outside contributions, including ARM64 support from the University of Sydney's Programming Language Group.

Risks and caveats

The documentation extracted here does not give any benchmark numbers, speed measurements, or accuracy percentages to back its own description of the tool as fast and accurate enough to reassemble, so those qualities are the project's characterization of itself rather than an independently verified figure. No license is stated in the material reviewed, and no date is given for when this version of the tool or repository was released or last updated.