AwesomeREA.org

Tool

Ddisasm

GrammaTech's Datalog disassembler, which turns ELF and PE binaries for x86-32, x86-64, ARM32, ARM64 and MIPS32 into the GTIRB intermediate representation. It decodes a superset of possible instructions, then applies Soufflé Datalog rules and weighted heuristics to infer code locations, symbolization and function boundaries; gtirb-pprinter turns the result into reassemblable assembly or a rebuilt binary, and the GTIRB APIs or gtirb-rewriting can modify it in between. User hint files add Datalog facts or change heuristic weights where inference goes wrong.

Requirements and limitations

  • Latest GitHub release at review: v1.8.0, published 2023-12-14 without attached files. Later versions are distributed elsewhere: PyPI lists ddisasm 1.9.5, uploaded 2026-07-06 as a single manylinux x86_64 wheel. The reviewed main commit, from 2026-10-13, declares version 1.9.6, which its changelog marks unreleased.
  • Prebuilt options are the grammatech/ddisasm Docker image (stable or unstable tags), Ubuntu 20 (focal) apt packages and Windows .zip builds on GrammaTech's servers; the docs warn against mixing stable and unstable tools. Source builds need a C++17 compiler, GTIRB 1.12.1+, gtirb-pprinter 2.0.0+, Capstone 5.0.1+ (GrammaTech tests with its fork), Soufflé 2.4 built with 64-bit numbers, libehp 1.0.0+ and LIEF 0.13.2+.
  • Input is an ELF or PE binary; rebuilding through gtirb-pprinter invokes a compiler or assembler such as gcc. Code inference and symbolization are heuristic: --self-diagnose checks symbolization only for binaries linked with complete relocation information, and the docs call the option that replaces CFI directives with .eh_frame symbolic expressions experimental and unreliable.
  • AGPL-3.0; contributions require GrammaTech's contributor license agreement. GTIRB, gtirb-pprinter and gtirb-rewriting are separate projects that were not reviewed. The README cites a USENIX Security 2020 paper and an IEEE S&P 2025 paper on the approach; their results are not restated here. No binaries were disassembled.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · GrammaTech/ddisasm · Revision 1d17f29
  2. doc/source/GENERAL/1-Installation.md GitHub · GrammaTech/ddisasm · Revision 1d17f29
  3. doc/source/GENERAL/2-Building-Ddisasm.md GitHub · GrammaTech/ddisasm · Revision 1d17f29
  4. doc/source/GENERAL/3-Command-line-options.md#L38-L53 GitHub · GrammaTech/ddisasm · Revision 1d17f29
  5. doc/source/GENERAL/5-AdvancedUsage.md GitHub · GrammaTech/ddisasm · Revision 1d17f29
  6. CHANGELOG.md GitHub · GrammaTech/ddisasm · Revision 1d17f29
  7. version.txt GitHub · GrammaTech/ddisasm · Revision 1d17f29
  8. CONTRIBUTING.md GitHub · GrammaTech/ddisasm · Revision 1d17f29
  9. LICENSE.txt GitHub · GrammaTech/ddisasm · Revision 1d17f29
  10. https://github.com/GrammaTech/ddisasm/releases/tag/v1.8.0
  11. https://pypi.org/project/ddisasm/1.9.5/
  12. https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya