2017 · Conference paper

Ramblr: Making Reassembly Great Again

Ruoyu Wang; Yan Shoshitaishvili; Antonio Bianchi; Aravind Machiry; John Grosen; Paul Grosen; Christopher Kruegel; Giovanni Vigna

Ramblr produces reassembleable disassembly: assembly recovered from a stripped binary that can be edited and assembled again with an off-the-shelf assembler. Starting from angr's CFG recovery, it classifies the contents of data regions, then decides which immediates and data values are references to code or data that must become symbols. Base-pointer reattribution handles compiler-optimized references that point outside their target object, and sanity checks let Ramblr refuse to reassemble a binary it cannot handle safely, such as one that encrypts pointers. The authors evaluate 106 GNU Coreutils programs for x86 and x86-64 and 143 DARPA Cyber Grand Challenge binaries at six optimization levels. They report that Uroboros broke 22.64% of 32-bit Coreutils binaries at -O0 and 56.61% at -O1, while Ramblr broke none, and that Ramblr reassembled over 98% of CGC binaries at every level.

Scope and limitations

The prototype handles x86 and x86-64 ELF binaries produced by GCC or Clang, whose code regions contain no inline data; binaries from compilers such as MSVC, which place jump tables inline, need further work. The authors stress that static content classification is infeasible in general: Ramblr is an empirical approach that is likely to fail if, for example, a binary is linked at a base address chosen so its addresses collide with ordinary constants. The Uroboros comparison covers only 32-bit binaries and, on Coreutils, only -O0 and -O1, because Uroboros failed on 64-bit inputs and its failure rate above -O1 was not meaningful. Correctness is measured by symbolization against linker ground truth and by each program's test cases, which do not prove full equivalence. Results are from 2017 versions of angr and the evaluated toolchains.

Why it fits this collection

Adds reassembleable disassembly, the basis of static binary rewriting that emits modifiable assembly instead of patching bytes, alongside the collection's decompilation and binary-recovery research.

Publication and review details

Venue: NDSS 2017
Status: Conference paper
Publication / posting date: 2017 (exact date not verified)
Date source: Internet Society-deposited Crossref metadata supplies only publication year 2017; the publisher PDF separately identifies the 26 February–1 March 2017 symposium, which is not used to assert a publication month or day.
DOI: 10.14722/ndss.2017.23225

Crossref gives the title, the eight-author order and year 2017 with no pages; the DOI resolves to the NDSS programme page, which links the 15-page PDF and slides. The PDF footer identifies NDSS ’17, 26 February–1 March 2017, San Diego. The paper says the entire Ramblr toolchain is open source, with Ramblr included in angr as a Python analysis and other parts in the Patcherex binary-patching platform, but it gives no repository URL, version or commit. angr currently ships a Reassembler analysis (reviewed at commit ae9f578), but that source never names Ramblr or the paper, so neither angr nor Patcherex is recorded as the paper’s code_url. The evaluation ran under PyPy 5.3.1 on Ubuntu Server 16.04. Nothing was installed or run.

Sources reviewed 2026-10-19

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Report an outdated entry Suggest a translation fix

Scope and limitations

Why it fits this collection

Publication and review details

Primary sources