AwesomeREA.org

Tool

Miasm

Python reverse-engineering framework for analyzing, modifying and generating binary programs. It reads, modifies and generates 32- and 64-bit PE and ELF files, assembles and disassembles x86, ARM, AArch64, MIPS, PowerPC, SH4, MSP430 and MeP code, and lifts it into its own intermediate language for symbolic execution, SSA and data-flow analysis, dependency graphs and expression simplification aimed at deobfuscation. Its JIT emulator runs shellcode or parts of binaries through LLVM, GCC, Clang or pure-Python backends, with Python callbacks that stand in for library functions, sandboxes with selected Windows API and Linux emulation, and dynamic symbolic execution through Z3.

Requirements and limitations

  • PyPI’s latest release and the newest tag are 0.1.5 from 2023-04-18; GitHub releases stop at v0.1.3 from 2019. The reviewed master commit still declares 0.1.5 but is 100 commits ahead of that tag, so current code is installed from a clone with pip or taken from the project’s Docker images. CI runs the regression suite on Ubuntu with Python 3.10 and 3.13.
  • pyproject.toml requires Python 3.10+ with future and pyparsing, pinned to 3.3.2. Native jitter extensions are built only when a C compiler is available; otherwise installation continues without the jitter features unless MIASM_REQUIRE_JIT=1 is set. Optional extras add pycparser C-type parsing, Z3 for solver-backed dependency graphs and dynamic symbolic execution, llvmlite 0.44.0 for the LLVM backend, graphviz export and pycryptodome for Windows crypto API emulation. The README marks the LLVM backend untested on Windows.
  • Binaries, shellcode and memory dumps come from the analyst. The bundled Windows API emulation targets 32-bit x86, and other library effects are modeled with Python callbacks. The IDA plugins use a subset of Miasm without the jitter.
  • GPL-2.0-only. Lifted IR, simplified expressions and emulation results are analysis aids, not proof of equivalence with the original code. No binaries were analyzed or emulated.

About this entry

Type
Tool
Category
Binary analysis libraries
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · cea-sec/miasm · Revision 3671fc2
  2. README.md#L503-L603 GitHub · cea-sec/miasm · Revision 3671fc2
  3. pyproject.toml GitHub · cea-sec/miasm · Revision 3671fc2
  4. CHANGELOG.md GitHub · cea-sec/miasm · Revision 3671fc2
  5. LICENSE GitHub · cea-sec/miasm · Revision 3671fc2
  6. .github/workflows/tests.yml GitHub · cea-sec/miasm · Revision 3671fc2
  7. miasm/arch GitHub · cea-sec/miasm · Revision 3671fc2
  8. miasm/analysis GitHub · cea-sec/miasm · Revision 3671fc2
  9. miasm/os_dep GitHub · cea-sec/miasm · Revision 3671fc2
  10. https://pypi.org/project/miasm/0.1.5/