Disassembly, the process of recovering assembly code from binary executables, is foundational in software security. Whether you’re reverse engineering malware, performing binary patching, or hunting for vulnerabilities in legacy systems, the accuracy and efficiency of disassembly directly affect your results. Our new research paper, Disassembly as Weighted Interval Scheduling with Learned Weights by Antonio Flores-Montoya et al., joint research between GrammaTech, Booz Allen Hamilton, and the Laboratory for Physical Sciences, offers an approach to disassembly that enhances both performance and precision.
Our paper presents a novel and effective framework for static disassembly that introduces two significant contributions to the field: modeling disassembly as a weighted interval scheduling (WIS) problem, and automatically inferring optimal heuristic weights using linear programming. We used a well-known scheduling method to decide which parts of the software are real code and which are not, making the results both faster and more accurate. We also developed a way to automatically learn which heuristics matter, instead of relying on guesswork or manual tuning.
The implementation, built on top of the DDisasm disassembler, supports multiple architectures (x86, x64, ARM32, AArch64) and was extensively evaluated across diverse datasets. It consistently achieved among the highest recall and largest number of perfectly disassembled binaries, demonstrating both practical effectiveness and generalizability.
Ultimately, our work offers a principled, scalable, and empirically validated framework that not only improves the state of disassembly but also provides tools for ongoing improvement and adaptation, marking a significant step forward in binary analysis and reverse engineering.
For more information about our work check out the paper here: Disassembly as Weighted Interval Scheduling with Learned Weights
