Ithaca, NY — GrammaTech today announced the open‑source release of Tbdisasm, a new tool that helps experts uncover hidden code inside packed, encrypted, or otherwise obfuscated software. Tbdisasm works by monitoring a target binary’s execution and emitting runtime disassembly as GTIRB, an open intermediate representation for binary analysis and rewriting.
Tbdisasm is paired with IterDisasm, a companion tool that combines Tbdisasm’s runtime information with the strengths of GrammaTech’s static disassembler, Ddisasm. Together, these tools create a more complete picture of a program, recovering code that neither static nor dynamic analysis could uncover on their own.
We evaluated our tools on 815 binaries spanning 25 packer families. For the samples which executed successfully, IterDisasm located the original payload in 81.8% of cases. Across all samples, including those which did not execute successfully, it located the original payload in 62.3% of cases, compared to 6.0% for static disassembly alone. This demonstrates the value of seeding static disassembly with dynamic trace information when analyzing packed binaries.
“These results show that dynamic trace information is a game-changer for unpacking and analyzing obfuscated software,” said Dan Goodwin. “By combining dynamic execution traces with static analysis, we’re uncovering code that traditional tools simply can’t reach, giving analysts a far more complete picture of what packed binaries are doing.”
GrammaTech remains committed to advancing binary analysis with powerful open‑source technologies like Tbdisasm, GTIRB, and next‑generation tools designed to help researchers tackle modern software obfuscation and malware packing techniques.