[Paper Review] Datalog Disassembly

Antonio Flores-Montoya, Eric Schulte|arXiv (Cornell University)|Jun 7, 2019

Software Engineering Research4 citations

TL;DR

This paper presents Ddisasm, a novel Datalog-based disassembly framework that combines static analysis and heuristics to produce reassembleable, symbolically accurate assembly from stripped x64 binaries. By leveraging Datalog's declarative inference for instruction boundary identification and symbolic reference disambiguation, Ddisasm achieves higher accuracy and speed than state-of-the-art tools like Ramblr across 7,658 binaries from diverse compilers and optimization levels.

ABSTRACT

Disassembly is fundamental to binary analysis and rewriting. We present a novel disassembly technique that takes a stripped binary and produces reassembleable assembly code. The resulting assembly code has accurate symbolic information, providing cross-references for analysis and to enable adjustment of code and data pointers to accommodate rewriting. Our technique features multiple static analyses and heuristics in a combined Datalog implementation. We argue that Datalog's inference process is particularly well suited for disassembly and the required analyses. Our implementation and experiments support this claim. We have implemented our approach into an open-source tool called Ddisasm. In extensive experiments in which we rewrite thousands of x64 binaries we find Ddisasm is both faster and more accurate than the current state-of-the-art binary reassembling tool, Ramblr.

Motivation & Objective

• To address the challenge of disassembling stripped binaries accurately when source code is unavailable, especially for binary rewriting and analysis.
• To overcome the fundamental ambiguity in disassembly—distinguishing code from data and resolving symbolic references—through integrated static analysis and heuristics.
• To develop a scalable, high-accuracy disassembler that produces reassembleable output suitable for binary hardening, refactoring, and instrumentation.
• To demonstrate that Datalog’s declarative, rule-based inference is uniquely suited for combining multiple disassembly analyses efficiently and accurately.

Proposed method

• Model disassembly as a decision problem: determining instruction boundaries and symbolic vs. literal operands using weighted evidence from multiple analyses.
• Implement all disassembly logic in a single Datalog program, where logical dependencies dictate execution order and enable modular composition of analyses.
• Perform static analyses including def-use chains, a novel register value analysis, and data access pattern analysis to gather evidence for symbolic disambiguation.
• Assign weights to evidence from each analysis and heuristic, then aggregate them via Datalog rules to compute confidence scores for each interpretation.
• Use Souffle, a high-performance Datalog engine, to compile the Datalog program into optimized C++ code for efficient execution.
• Validate results through semantics-preserving modifications (e.g., inserting NOPs), reassembly, and regression testing to ensure functional correctness.

Experimental results

Research questions

• RQ1 Can a unified Datalog-based framework effectively combine multiple static analyses and heuristics to improve disassembly accuracy for stripped binaries?
• RQ2 How does the declarative nature of Datalog enable more scalable and maintainable integration of disassembly components compared to imperative implementations?
• RQ3 To what extent can Datalog’s inference engine outperform existing disassemblers in both speed and accuracy when handling complex, real-world binaries?
• RQ4 How well does the system perform across diverse compilers and optimization levels in resolving symbolic references and maintaining reasembly correctness?

Key findings

• Ddisasm outperforms Ramblr in both speed and accuracy across 7,658 x64 binaries compiled with 7 compilers and 5–6 optimization flags.
• On the Coreutils benchmark suite, Ddisasm achieved 0 false positives and 0 false negatives across all compilers and optimization levels except for ICC, where it still outperformed Ramblr significantly.
• In real-world application testing, Ddisasm achieved 0 broken binaries and 0 false positives across all compilers except ICC, where it had 10 false positives and 1 false negative in -O3 and -Ofast modes.
• For the CGC benchmark suite, Ddisasm maintained 0 false positives and 0 false negatives across all compilers and optimization levels, while Ramblr reported up to 106 broken binaries with ICC.
• Ddisasm demonstrated superior performance on the most challenging binaries, including those compiled with ICC, where Ramblr failed catastrophically with over 16,000 false positives.
• The system’s use of Datalog enabled a clean, modular, and maintainable implementation of complex disassembly logic, with execution order fully determined by data dependencies.