Disassembly as Weighted Interval Scheduling with Learned Weights

TL;DR

This work tackles static disassembly across multiple ISAs by reframing conflict resolution as a Weighted Interval Scheduling (WIS) problem and by learning heuristic weights via linear programming with soft constraints. It introduces a three-phase pipeline (candidate generation, block weighting, and conflict resolution) that is extended to x86, x64, arm32, and aarch64, including data-block handling, jump-table detection, and prefix-enclosed instruction analysis. The weight-learning component uses ground-truth binaries to infer symbolic weights, solves an LP to maximize satisfied constraints, and demonstrates comparable precision with improved recall on several datasets while drastically reducing the number of active heuristics. Experimental results show high disassembly accuracy and practical runtime overhead, with learned weights generalizing to unseen binaries and often outperforming manually tuned weights. Overall, the approach advances reliable, multi-ISA disassembly for binary analysis and rewriting tasks, providing robust performance improvements and a scalable method for heuristic refinement.

Abstract

Disassembly is the first step of a variety of binary analysis and transformation techniques, such as reverse engineering, or binary rewriting. Recent disassembly approaches consist of three phases: an exploration phase, that overapproximates the binary's code; an analysis phase, that assigns weights to candidate instructions or basic blocks; and a conflict resolution phase, that downselects the final set of instructions. We present a disassembly algorithm that generalizes this pattern for a wide range of architectures, namely x86, x64, arm32, and aarch64. Our algorithm presents a novel conflict resolution method that reduces disassembly to weighted interval scheduling.

Figures (3)

• Figure 1: x64 assembly snippet extracted from glibc-2.36. The example contains both padding in the address range $[94c67-94c70)$) and a prefix-enclosed instruction at address $94c43$.
• Figure 2: Jump table snippet in arm32 binutils's strip binary. The instruction at loads the jump table start address (), corresponds to the index variable, and the shift implies that each jump table entry is $4$ bytes. The comparison at address indicates that the jump table has $211$ entries.
• Figure 3: arm32 Binary snippet extracted from program procd from the openwrt dataset arm-evaluation. The example illustrates different possible interpretations as Data (D), ARM (A), or Thumb (T) code of the address range $[19754,19764)$. The right hand side contains a representation of all the candidate blocks generated by the extended traversal, annotated with the decode mode (left) and numbered according to their end address (right). The real blocks are gray.

Theorems & Definitions (22)

• Definition 1: Code
• Definition 2: Data
• Example 1
• Example 2
• Definition 3: Code Block
• Definition 4: Data Block
• Example 5
• Definition 5: Sound Candidate Overapproximation
• Example 6
• Theorem 1