AwesomeREA.org

Tool

RetroWrite

HexHive's static binary rewriter for x64 and aarch64 Linux ELF binaries, which turns a binary into symbolized, reassemblable assembly so instrumentation can be inserted without source code and without heuristics. Bundled passes add a binary-only AddressSanitizer and AFL coverage instrumentation, plus a coarse-grained control-flow-integrity pass on aarch64, and the symbolized assembly can also be edited by hand or by other tools before reassembly. The KRetrowrite variant of the x64 rewriter instruments Linux kernel modules with BASan or kcov for kernel fuzzing.

Requirements & limits

  • There are no releases or tags, and setup.py says 1.0.0. The reviewed master commit, from 2025-04-26, adjusts an x64 pass added four days earlier that randomizes instruction order within functions; before that, the latest commits, from 2023 and 2024, fixed capstone options and executable stacks on older kernels.
  • Written in Python 3 (the README names 3.6) with pyelftools, capstone 4.0.2 or later, intervaltree and archinfo pinned to 9.1.11752, which the README says to install with pip rather than from distribution packages. x64 output is reassembled with an ordinary compiler such as gcc, linking -lasan for BASan, or with afl-gcc or afl-clang for AFL coverage; on aarch64, retrowrite -a assembles and links. The README's KRetrowrite setup calls a setup.sh that sits in the demo folders rather than at the repository root.
  • Inputs are the user's own binaries or kernel modules. Per the README feature table, the x64 rewriter needs position-independent, unstripped binaries from standard compilers and has no C++ support, while the aarch64 rewriter also takes stripped and non-PIE binaries but not kernel modules or C++; --ignore-no-pie and --ignore-stripped skip the checks, to be used with caution. The two architectures use different rewriting algorithms: the IEEE S&P 2020 paper describes the x64 version and a separate HexHive thesis the aarch64 version.
  • CI runs a SPEC CPU benchmark script on a self-hosted runner, and test scripts clone and rewrite coreutils, SQLite and Debian packages. Demos cover userspace, kernel-module and fuzzing setups; the Docker fuzzing demo bundles fuzz seeds and a patched AFL 2.52b archive but also needs a self-built clang 8, a git bundle of the repository and the separately downloaded LAVA-M corpus, and kernel fuzzing setup downloads about 10 GB of syzkaller VM files.
  • MIT according to the LICENSE file and README, although GitHub does not recognize the license; capstone is included as a submodule under its own license. The reviewed sources state no REA use, and this collection did not install RetroWrite or rewrite any binary.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Related entries

Matched by the same code repository or publication identifier.

Primary sources

  1. README.md GitHub · HexHive/retrowrite · Revision 3b1e366
  2. retrowrite#L160-L200 GitHub · HexHive/retrowrite · Revision 3b1e366
  3. requirements.txt GitHub · HexHive/retrowrite · Revision 3b1e366
  4. setup.py GitHub · HexHive/retrowrite · Revision 3b1e366
  5. .github/workflows/action.yml GitHub · HexHive/retrowrite · Revision 3b1e366
  6. demos/fuzzing/README.md GitHub · HexHive/retrowrite · Revision 3b1e366
  7. demos/fuzzing/docker/README.md GitHub · HexHive/retrowrite · Revision 3b1e366
  8. demos/kernel_demo/README.md GitHub · HexHive/retrowrite · Revision 3b1e366
  9. LICENSE GitHub · HexHive/retrowrite · Revision 3b1e366
  10. https://doi.org/10.1109/SP40000.2020.00009
  11. https://hexhive.epfl.ch/theses/20-dibartolomeo-thesis.pdf

More in Native binaries

All 116 entries in Native binaries