The (Long) Journey to a Multi-Architecture Disassembler
summary
JEB implements a multi‑architecture disassembler that converts native instructions to a unified IL, simulates IL forward to resolve indirect branches and function pointers, and uses type libraries to mark non‑returning APIs. It models delay slots and shared basic blocks with mutable “skeleton” blocks, supports switching instruction sets (ARM/Thumb) by trying alternatives and keeping the best CFG, and identifies statically linked libraries via strict assembly hashes and call‑name features. It logs heuristic failures and falls back to conservative mode for safety, enabling JEB IL simulation and compiler-specific heuristics plus signature-based library ID.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:21Disassembler
- 4:38Agenda
- 4:51Toy Example
- 9:50Intuitive Strategy
- 12:46Instructions
- 13:16NonReturning Calls
- 14:43NonReturning APIs
- 15:49Type Libraries
- 18:06Basic Block Visual Definition
- 18:49Basic Block Skeletons
- 19:16Branch Delay Slot
- 27:52JAB
- 32:01Code vs Data
- 35:58Instruction Set
- 38:31All code matters
- 39:02Identifying library routines
- 41:43Conclusion
related talks
23mAn In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries
37mAssembling
40mDynamic Binary Instrumentation Techniques to Address Native Code Obfuscation
21mDemystify Today's Binary Disassembling and How Modern ABI Makes it Easier
54mWhat Lies Beneath
24mKeystone Engine: Next Generation Assembler Framework
44mBuild Your Own VM with JIT Compilation for Dummies
22mGigue: A JIT Code Binary Generator for Hardware Testing