Disassembly of Executable Code Revisited

Machine code disassembly routines form a fundamentalcomponent of software systems that statically analyze ormodify executable programs, e.g., reverse engineering systems,static binary translators, and link-time optimizers.The task of disassembly is complicated by indirect jumpsand the presence of non-executable data--jump tables,alignment bytes, etc.--in the instruction stream. Existingdisassembly algorithms are not always able to copesuccessfully with executable files containing such features,and they fail silently--i.e., produce incorrect disassemblieswithout any indication that the results they are producingare incorrect. In this paper we examine two commonly-useddisassembly algorithms and illustrate their shortcomings.We propose a hybrid approach that performs betterthan these algorithms in the sense that it is able to detect situationswhere the disassembly may be incorrect and limitthe extent of such disassembly errors. Experimental resultsindicate that the algorithm is quite effective: the amountof code flagged as incurring disassembly errors is usuallyquite small.