Tbdisasm is a trace-based disassembler designed to recover code that is hidden, packed, encrypted, or generated at runtime.
By monitoring a target binary’s execution using the DynamoRIO dynamic instrumentation framework, Tbdisasm emits a runtime disassembly in the GTIRB intermediate representation, enabling analysis and rewriting of code that static tools cannot see.
Packed and obfuscated binaries often conceal their payload until execution time. Tbdisasm addresses this challenge by capturing executed basic blocks, dynamically generated code regions, control-flow relationships, and memory dumps corresponding to unpacked payloads. The resulting GTIRB provides a structured representation of both file-backed and runtime-generated code.
Tbdisasm integrates with DDisasm through IterDisasm, an iterative analysis pipeline that seeds static disassembly with dynamic trace information. This combined approach enables significantly more complete recovery of packed payloads than either static or dynamic disassembly alone.
Visit the repositories at github.com/grammatech/tbdisasm and github.com/grammatech/instr_trace