An In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries
summary
Measurement of nine disassemblers on 981 binaries uses DWARF/PDB plus an LLVM pass to create ground truth and finds IDA recovers 96–99% of instructions, linear disassembly hits 100% on ELF, but function start detection has >20% false positives and negatives even for the best tools. Function signature recovery on x64 is near zero, PE files show some inline jump-table data, tail calls and other function-level optimizations are common, and all raw results are published.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 3:24Experiment Setup
- 6:14Experiment Results
- 12:46Prevalence of Complex Cases
- 16:04Disassembly in the Literature
- 18:09Discussion and Conclusion
related talks
21mDemystify Today's Binary Disassembling and How Modern ABI Makes it Easier
01h 15mReliable Stack Traces, the Reality of Myth
24m(Ab)using Compiler Tools
10mBacktraces in the mirror: mad science by secrets of elves & dwarves!!
45m"Advanced Malware Threat: handling obfuscated code using..."
24mBTD: Unleashing the Power of Decompilation for x86 Deep Neural Network Executables
51mReverse Engineering Binaries
01h 01m“How C++ Debuggers Work”