Package: ddisasm Priority: optional Section: devel Installed-Size: 106346 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.6-focal Depends: libstdc++6, libc6, libgcc1, libgomp1, libgtirb (=2.3.3-focal), libgtirb-pprinter (=2.2.6-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/d/ddisasm/ddisasm_1.9.6-focal_amd64.deb Size: 26058346 MD5sum: 3e6533ee112cbf8e1011c1b4603724b0 SHA1: 4b9b92b9856f7c3ce417017604f9c494de901e13 SHA256: 2ed00f55ed9944a90fa15a9215f29fc6ae542f2b8f627bf5ff2ebfa65c38117e SHA512: e8db2b083c3d7fe96b0abf152a4047c4a234ddf7f39260ed0582605b6d0f89e41f52f5ad47139e654b89a90bfab4d3fe55d9c47bd623e60318403e07bcd2bb75 Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . 3. [Ddisasm WIS](https://ieeexplore.ieee.org/document/11023516) ``` @INPROCEEDINGS{11023516, author={Flores-Montoya, Antonio and Lim, Junghee and Seitz, Adam and Sood, Akshay and Raff, Edward and Holt, James}, booktitle={2025 IEEE Symposium on Security and Privacy (SP)}, title={Disassembly as Weighted Interval Scheduling with Learned Weights}, year={2025}, volume={}, number={}, pages={3033-3050}, keywords={Measurement;Privacy;Accuracy;Heuristic algorithms;Reverse engineering;Binary codes;Benchmark testing;Scheduling;Inference algorithms;Security;disassembly;reverse engineering;learning;binary analysis}, doi={10.1109/SP61157.2025.00192}} ``` . Package: ddisasm Priority: optional Section: devel Installed-Size: 106346 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.5-focal Depends: libstdc++6, libc6, libgcc1, libgomp1, libgtirb (=2.3.3-focal), libgtirb-pprinter (=2.2.5-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/d/ddisasm/ddisasm_1.9.5-focal_amd64.deb Size: 26058330 MD5sum: 35ac3e7fe76c3bb01fea5a2408d47183 SHA1: 653867d618861504ccece82268d3896fdb7ff086 SHA256: 209eb6410e1eb08a30927a7fbc66c3d4c53754c34283bc394dc0eaebe743d2c5 SHA512: 4e7eb3d8ca46758acb7929d2e78d62548e4b4143d820d557ad6c7d3a8f7f616735f893ff2deb42c79f96ea95188206de86aac5f144e0905a7e30ffcd475f7068 Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . 3. [Ddisasm WIS](https://ieeexplore.ieee.org/document/11023516) ``` @INPROCEEDINGS{11023516, author={Flores-Montoya, Antonio and Lim, Junghee and Seitz, Adam and Sood, Akshay and Raff, Edward and Holt, James}, booktitle={2025 IEEE Symposium on Security and Privacy (SP)}, title={Disassembly as Weighted Interval Scheduling with Learned Weights}, year={2025}, volume={}, number={}, pages={3033-3050}, keywords={Measurement;Privacy;Accuracy;Heuristic algorithms;Reverse engineering;Binary codes;Benchmark testing;Scheduling;Inference algorithms;Security;disassembly;reverse engineering;learning;binary analysis}, doi={10.1109/SP61157.2025.00192}} ``` . Package: ddisasm Priority: optional Section: devel Installed-Size: 106141 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.4-focal Depends: libstdc++6, libc6, libgcc1, libgomp1, libgtirb (=2.3.2-focal), libgtirb-pprinter (=2.2.4-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/d/ddisasm/ddisasm_1.9.4-focal_amd64.deb Size: 26010496 MD5sum: 67368c33762ae9a1535d73c9533ecc55 SHA1: 830ec74a0ff05c22a2c14ee92e3f6c84f45a1a27 SHA256: d8aa1f5f216aa0178789f266dfb4325f419cdeac319d6e21f4b9ef5a4cf0cd8e SHA512: 5818aaa3941a8c3aada9e8d674525f8af9b820f7752f162b2dc57e20eead7e461eb6b4cc09f70da0e0aed4e25025d821a3e5d51424cffb303f5f46cd4ca84e86 Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . 3. [Ddisasm WIS](https://ieeexplore.ieee.org/document/11023516) ``` @INPROCEEDINGS{11023516, author={Flores-Montoya, Antonio and Lim, Junghee and Seitz, Adam and Sood, Akshay and Raff, Edward and Holt, James}, booktitle={2025 IEEE Symposium on Security and Privacy (SP)}, title={Disassembly as Weighted Interval Scheduling with Learned Weights}, year={2025}, volume={}, number={}, pages={3033-3050}, keywords={Measurement;Privacy;Accuracy;Heuristic algorithms;Reverse engineering;Binary codes;Benchmark testing;Scheduling;Inference algorithms;Security;disassembly;reverse engineering;learning;binary analysis}, doi={10.1109/SP61157.2025.00192}} ``` . Package: ddisasm Priority: optional Section: devel Installed-Size: 105618 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.3-focal Depends: libstdc++6, libc6, libgcc1, libgomp1, libgtirb (=2.3.1-focal), libgtirb-pprinter (=2.2.3-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/d/ddisasm/ddisasm_1.9.3-focal_amd64.deb Size: 25896628 MD5sum: 614afd899aaefab0238608aa4dcabb58 SHA1: 3796d6b30523c09e66b1596494a918e25dce8686 SHA256: d786c7a80bc4795609922ce9d9f823f39b8759076816cfee5c89f8eba739348f SHA512: 019e538c42f8345917c8726347740585d73af5f57748c16a4825149c018cfd40e78799669f2d1c29fd848f4a27d63bf3a4ff61892444004196752de20b2e3f8b Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . 3. [Ddisasm WIS](https://ieeexplore.ieee.org/document/11023516) ``` @INPROCEEDINGS{11023516, author={Flores-Montoya, Antonio and Lim, Junghee and Seitz, Adam and Sood, Akshay and Raff, Edward and Holt, James}, booktitle={2025 IEEE Symposium on Security and Privacy (SP)}, title={Disassembly as Weighted Interval Scheduling with Learned Weights}, year={2025}, volume={}, number={}, pages={3033-3050}, keywords={Measurement;Privacy;Accuracy;Heuristic algorithms;Reverse engineering;Binary codes;Benchmark testing;Scheduling;Inference algorithms;Security;disassembly;reverse engineering;learning;binary analysis}, doi={10.1109/SP61157.2025.00192}} ``` . Package: ddisasm Priority: optional Section: devel Installed-Size: 102738 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.2-focal Depends: libstdc++6, libc6, libgcc1, libgomp1, libgtirb (=2.3.1-focal), libgtirb-pprinter (=2.2.2-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/d/ddisasm/ddisasm_1.9.2-focal_amd64.deb Size: 25266134 MD5sum: fa3b49bb1d58017081ad1bbabe9c5e9e SHA1: eb528f0be78e5b5efe10f46a43da475998f6a72c SHA256: a417db753591871c05af350f6105a21c2aefd07c4b9cc35f9c9bb5067a1883a9 SHA512: 223e83e0cc833f862f45950746d25b31b9aec978b9fa5b254f9253f58bed0c583591c34a5642f05cf02186700f3403b619dd1016d790236dd69291a536c7bb27 Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . Package: ddisasm Priority: optional Section: devel Installed-Size: 101724 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.1-focal Depends: libstdc++6, libc6, libgcc1, libgomp1, libgtirb (=2.2.0-focal), libgtirb-pprinter (=2.2.1-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/d/ddisasm/ddisasm_1.9.1-focal_amd64.deb Size: 24893368 MD5sum: 867f95dcb522e583cd43783e4a30eed8 SHA1: ce3550151a0cbb3375cf8cba2127e07c6eca7b27 SHA256: 42decb7358c0c1fb483b5c3d771cc94579df00b4b8bf9038d02f60b76032a3a7 SHA512: 538c554639832a45ecd7e95ee8cfc1b66a5731dd4397e94a2de1a25948a1695615b10157df5f999664c38045df6a74b6e4ed9ed038459ec2b6153b60cec4e3c7 Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . Package: ddisasm Priority: optional Section: devel Installed-Size: 102994 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.0-focal Depends: libstdc++6, libc6, libgcc1, libgomp1, libgtirb (=2.1.0-focal), libgtirb-pprinter (=2.2.0-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/d/ddisasm/ddisasm_1.9.0-focal_amd64.deb Size: 25360744 MD5sum: 8d970c32ee693491ff3bade04864e29f SHA1: 6a63dae623ea84553d38630058d7429479a7efe7 SHA256: 25bdd99220a4bb402b9b940a864ed74fba493af4b32b3feb8f86dba4f9e556c1 SHA512: 39ecf2a2da564e01f5858d49a20a0ac6296eec91c8ac76fa681257cf8ce58a15a645dc1527198892fa39d48b327e8fc07c270a1c2f9082a1de54798c7cade14a Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . Package: ddisasm Priority: optional Section: devel Installed-Size: 100876 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.8.1-focal Depends: libstdc++6, libc6, libgcc1, libgomp1, libgtirb (=2.0.1-focal), libgtirb-pprinter (=2.1.1-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.0-gtdev) Filename: pool/unstable/d/ddisasm/ddisasm_1.8.1-focal_amd64.deb Size: 24860172 MD5sum: a0a36845a45d885298466fa8b296baac SHA1: 76af23545d4b00549d3e1002ad2e8a8560d1e562 SHA256: 5bb05b4138c539fd37e47097e71bf8baedc9307396cb77f1bc4e6a2fa4859d05 SHA512: dd7c06a6760aa6fff3098b929fa81019d8f1c71179fd5613a6aed36217794aef7ccc4f22b94859ebd19cfe758a6c01b67ba0bbf82c6b34299345dbc4853d99de Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . Package: ddisasm-dbg Priority: optional Section: devel Installed-Size: 2662148 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.6-focal Depends: ddisasm (=1.9.6-focal) Filename: pool/unstable/d/ddisasm-dbg/ddisasm-dbg_1.9.6-focal_amd64.deb Size: 737060862 MD5sum: 1b679bc1ade94709d6890c99c1af1b39 SHA1: 9f28e0215c8a7a2f1853b115f8c564f9df0e4bf0 SHA256: b3dbbbcffe298fa9b7d01c40a139f15bf6f0342d484c8c155774918351e199fd SHA512: 1053ad40b80f68e642b816f57553ba88863b3080543393f726efb950648a693f2aa6301d6f917713570be70009d460496e1bd630be1c930f2b09db5fc9fe2373 Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . 3. [Ddisasm WIS](https://ieeexplore.ieee.org/document/11023516) ``` @INPROCEEDINGS{11023516, author={Flores-Montoya, Antonio and Lim, Junghee and Seitz, Adam and Sood, Akshay and Raff, Edward and Holt, James}, booktitle={2025 IEEE Symposium on Security and Privacy (SP)}, title={Disassembly as Weighted Interval Scheduling with Learned Weights}, year={2025}, volume={}, number={}, pages={3033-3050}, keywords={Measurement;Privacy;Accuracy;Heuristic algorithms;Reverse engineering;Binary codes;Benchmark testing;Scheduling;Inference algorithms;Security;disassembly;reverse engineering;learning;binary analysis}, doi={10.1109/SP61157.2025.00192}} ``` . Package: ddisasm-dbg Priority: optional Section: devel Installed-Size: 2662148 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.5-focal Depends: ddisasm (=1.9.5-focal) Filename: pool/unstable/d/ddisasm-dbg/ddisasm-dbg_1.9.5-focal_amd64.deb Size: 737060892 MD5sum: 3937e2e8521b35c8f2164d90f540eb00 SHA1: 31b6148d458df745a2e15c9352b095ae0133dce3 SHA256: 36e6781d3710351c991835ac72e5ba759da8843af0e6bc850fbad3f7258f8f4b SHA512: 4ffa274aaedf2a2e673d0815833c399856cfba064cab80ff2dbb765238d4d10d94f2c6bb4ab2897087b5ec247a1b0f72ddca7b77a930dd242b97e0e2e322bd39 Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . 3. [Ddisasm WIS](https://ieeexplore.ieee.org/document/11023516) ``` @INPROCEEDINGS{11023516, author={Flores-Montoya, Antonio and Lim, Junghee and Seitz, Adam and Sood, Akshay and Raff, Edward and Holt, James}, booktitle={2025 IEEE Symposium on Security and Privacy (SP)}, title={Disassembly as Weighted Interval Scheduling with Learned Weights}, year={2025}, volume={}, number={}, pages={3033-3050}, keywords={Measurement;Privacy;Accuracy;Heuristic algorithms;Reverse engineering;Binary codes;Benchmark testing;Scheduling;Inference algorithms;Security;disassembly;reverse engineering;learning;binary analysis}, doi={10.1109/SP61157.2025.00192}} ``` . Package: ddisasm-dbg Priority: optional Section: devel Installed-Size: 2659091 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.4-focal Depends: ddisasm (=1.9.4-focal) Filename: pool/unstable/d/ddisasm-dbg/ddisasm-dbg_1.9.4-focal_amd64.deb Size: 736380194 MD5sum: f7f0b895c42d6609fe38f186f4b09948 SHA1: 5508fc085c3bcb3cffdcdf4a194b2194b4b7f926 SHA256: a87f7136c50095d941e30672ce55c87b3de195afb90304fcc6a1ca84780f220e SHA512: a2f9269bdb08ed7deb6ae32da704ce0df90d2df04779fe9286400365214ddddc2deb71091b79775b70b192b0f099b97b17f6efaa10d57ea9914ae81c1b52eefc Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . 3. [Ddisasm WIS](https://ieeexplore.ieee.org/document/11023516) ``` @INPROCEEDINGS{11023516, author={Flores-Montoya, Antonio and Lim, Junghee and Seitz, Adam and Sood, Akshay and Raff, Edward and Holt, James}, booktitle={2025 IEEE Symposium on Security and Privacy (SP)}, title={Disassembly as Weighted Interval Scheduling with Learned Weights}, year={2025}, volume={}, number={}, pages={3033-3050}, keywords={Measurement;Privacy;Accuracy;Heuristic algorithms;Reverse engineering;Binary codes;Benchmark testing;Scheduling;Inference algorithms;Security;disassembly;reverse engineering;learning;binary analysis}, doi={10.1109/SP61157.2025.00192}} ``` . Package: ddisasm-dbg Priority: optional Section: devel Installed-Size: 2650933 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.3-focal Depends: ddisasm (=1.9.3-focal) Filename: pool/unstable/d/ddisasm-dbg/ddisasm-dbg_1.9.3-focal_amd64.deb Size: 734480576 MD5sum: 3c67ffc90395f80d9c2bcb922619aa7b SHA1: 66e0f606700a44255000e6ab8d1f7f72e7e1a263 SHA256: 42c0737bb27f6d8ed12e15c16123c8938019d191c358edc3bad000511e121edf SHA512: 5fe46a4914512d268a720856f8367daf1deaa8a28617abdb1fdecba56a2b1face3c700aeb7ebeb7e83c245701c1d81571724106c2c39bd9332cdc98878b463cf Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . 3. [Ddisasm WIS](https://ieeexplore.ieee.org/document/11023516) ``` @INPROCEEDINGS{11023516, author={Flores-Montoya, Antonio and Lim, Junghee and Seitz, Adam and Sood, Akshay and Raff, Edward and Holt, James}, booktitle={2025 IEEE Symposium on Security and Privacy (SP)}, title={Disassembly as Weighted Interval Scheduling with Learned Weights}, year={2025}, volume={}, number={}, pages={3033-3050}, keywords={Measurement;Privacy;Accuracy;Heuristic algorithms;Reverse engineering;Binary codes;Benchmark testing;Scheduling;Inference algorithms;Security;disassembly;reverse engineering;learning;binary analysis}, doi={10.1109/SP61157.2025.00192}} ``` . Package: ddisasm-dbg Priority: optional Section: devel Installed-Size: 2545228 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.2-focal Depends: ddisasm (=1.9.2-focal) Filename: pool/unstable/d/ddisasm-dbg/ddisasm-dbg_1.9.2-focal_amd64.deb Size: 703797762 MD5sum: 5d388f7254e228d57f78d94c0928e99c SHA1: b835ce5b77235c46dbc4a0b5ee006cc27c00a27d SHA256: a2f408c570d5bf2ea0493ad50fd2ba064aba5576112063d4df09941248474a8f SHA512: 992053ca59a241406f1bf2b0cfd0a5c91ab5275b85f49153aefc6c0e34f8c1e0a07c2c8db17511e8f7e4d8bd8475286681bacc06a693503bf403bfe2ad224901 Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . Package: ddisasm-dbg Priority: optional Section: devel Installed-Size: 2545202 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.1-focal Depends: ddisasm (=1.9.1-focal) Filename: pool/unstable/d/ddisasm-dbg/ddisasm-dbg_1.9.1-focal_amd64.deb Size: 703739292 MD5sum: 72532553b6f8f6aab1faaff82bd61468 SHA1: ccce014d13b65e92704285e88d3d608def421df7 SHA256: 485702b1bb557bb91ab699953303d0fd5365788e7d101007b6e53dc8bfacb08b SHA512: db5965ae7048e182acd2e3a7f349b5c0c9273578876769db0620b96c427bf01c1f57af5781cab6db6baa8f0fa215205f492d456dc2777291a27ce861f0fc8e1b Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . Package: ddisasm-dbg Priority: optional Section: devel Installed-Size: 2542073 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.9.0-focal Depends: ddisasm (=1.9.0-focal) Filename: pool/unstable/d/ddisasm-dbg/ddisasm-dbg_1.9.0-focal_amd64.deb Size: 702568482 MD5sum: 04c953a9727f99795d6e47da7046bd43 SHA1: 8446134aecedefc96df932d9b1998b32b04970d1 SHA256: b6bc3d232a0cdb06bea4f66358ca191e9717e671a3860d2684f3da409a01e78f SHA512: 95c97f898a8d5e29467e312ed138e31c6756bbb501ac76efba766f003c0ec5f1c42ca868d2861974a2edb0e5ecac8151a75957bf07f74a2f13844cc310d336cc Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . Package: ddisasm-dbg Priority: optional Section: devel Installed-Size: 2478573 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 1.8.1-focal Depends: ddisasm (=1.8.1-focal) Filename: pool/unstable/d/ddisasm-dbg/ddisasm-dbg_1.8.1-focal_amd64.deb Size: 684584718 MD5sum: bea0955bc0e9527c71308c300f3db3db SHA1: 0d8e46d430c416223cb55347f08f0ab2a041c4d1 SHA256: 565c384390fe11810b7b0392ca18cbaa01e0e977f3105fe6e8fcac69e5d61eb4 SHA512: 4e18120dd0791c110301fa3c94472942763581b20b9caff92429ce5ff68ee66353be2701f785582b1a655fe347770a66f7ceb1ac57bdf6fdd61d7f4520bcf7ff Description: A fast disassembler which is accurate enough for the resulting assembly code to be reassembled. The disassembler implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics. Datalog Disassembly =================== . DDisasm is a *fast* disassembler which is *accurate* enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog ([souffle](https://github.com/souffle-lang/souffle)) declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE file information and decodes a superset of possible instructions to create an initial set of datalog facts. These facts are analyzed to identify *code location*, *symbolization*, and *function boundaries*. The results of this analysis, a refined set of datalog facts, are then translated to the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering. The [GTIRB pretty printer](https://github.com/grammatech/gtirb-pprinter) may then be used to pretty print the GTIRB to reassemblable assembly code. . ## Binary Support . Binary formats: . - ELF (Linux) - PE (Windows) . Instruction Set Architectures (ISAs): . - x86_32 - x86_64 - ARM32 - ARM64 - MIPS32 . ## Getting Started . You can run a prebuilt version of Ddisasm using Docker: . ```bash docker pull grammatech/ddisasm:latest ``` . Ddisasm can be used to disassemble a binary into the [GTIRB](https://github.com/grammatech/gtirb) representation. We can try it with one of the examples included in the repository. . First, start the Ddisasm docker container: ```bash docker run -v $PWD/examples:/examples -it grammatech/ddisasm:latest ``` . Within the Docker container, let us build one of the examples: . ```bash apt update && apt install gcc -y cd /examples/ex1 gcc ex.c -o ex ``` . Now we can proceed to disassemble the binary: . ```bash ddisasm ex --ir ex.gtirb ``` . Once you have the GTIRB representation, you can make programmatic changes to the binary using [GTIRB](https://github.com/grammatech/gtirb) or [gtirb-rewriting](https://github.com/grammatech/gtirb-rewriting). . Then, you can use [gtirb-pprinter](https://github.com/grammatech/gtirb-pprinter) (included in the Docker image) to produce a new version of the binary: . ``` gtirb-pprinter ex.gtirb -b ex_rewritten ``` . Internally, `gtirb-pprinter` will generate an assembly file and invoke the compiler/assembler (e.g. gcc) to produce a new binary. `gtirb-pprinter` will take care or generating all the necessary command line options to generate a new binary, including compilation options, library dependencies, or version linker scripts. . You can also use `gtirb-pprinter` to generate an assembly listing for manual modification: ```bash gtirb-pprinter ex.gtirb --asm ex.s ``` . This assembly listing can then be manually recompiled: ```bash gcc -nostartfiles ex.s -o ex_rewritten ``` . Please take a look at our [documentation](https://grammatech.github.io/ddisasm/) for additional information. . ## [Documentation](https://grammatech.github.io/ddisasm/) . ## Contributing . See [CONTRIBUTING.md](CONTRIBUTING.md) . ## External Contributors . * Programming Language Group, The University of Sydney: Initial support for ARM64. * Github user gogo2464: Documentation refactoring. . ## Cite . 1. [Datalog Disassembly](https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya) . ``` @inproceedings {flores-montoya2020, author = {Antonio Flores-Montoya and Eric Schulte}, title = {Datalog Disassembly}, booktitle = {29th USENIX Security Symposium (USENIX Security 20)}, year = {2020}, isbn = {978-1-939133-17-5}, pages = {1075--1092}, url = {https://www.usenix.org/conference/usenixsecurity20/presentation/flores-montoya}, publisher = {USENIX Association}, month = aug, } ``` . 2. [GTIRB](https://arxiv.org/abs/1907.02859) . ``` @misc{schulte2020gtirb, title={GTIRB: Intermediate Representation for Binaries}, author={Eric Schulte and Jonathan Dorn and Antonio Flores-Montoya and Aaron Ballman and Tom Johnson}, year={2020}, eprint={1907.02859}, archivePrefix={arXiv}, primaryClass={cs.PL} } ``` . Package: gtirb-pprinter Priority: optional Section: devel Installed-Size: 630 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.6-focal Depends: libstdc++6, libc6, libgcc1, libgtirb (=2.3.3-focal), libgtirb-pprinter (=2.2.6-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/g/gtirb-pprinter/gtirb-pprinter_2.2.6-focal_amd64.deb Size: 198416 MD5sum: ae2347f19e3ded5a758332fc447d057a SHA1: dcfd2931ea41563f3699f1db77d509c21170aee6 SHA256: 01478504f89ed3aaa8775f2a4954979296f71fcba14000cedaaf05ed152ea042 SHA512: 137728ad7365282f19ec39bf85173c855fbc377f3ebbe935651870cbad7d8249284d63aa309cafcca7f0eec2058272d18452751ff629cb3959b1a24a5d9be270 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter Priority: optional Section: devel Installed-Size: 630 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.5-focal Depends: libstdc++6, libc6, libgcc1, libgtirb (=2.3.3-focal), libgtirb-pprinter (=2.2.5-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/g/gtirb-pprinter/gtirb-pprinter_2.2.5-focal_amd64.deb Size: 198420 MD5sum: f7246a09788a24865eed887f8f6496b1 SHA1: cd5fe624042cc4533f440ce669f994b30f13ccd7 SHA256: 0aabf1d41378c3dad3b1751bfbf701d31b0cf0cac4cf61eb6883d4019f549fb4 SHA512: 243252413b344b8c6677bc76413d8c0e9d316a251b747c6b38232664fab48ef0fd891c101a1ba79aab9e442ea0147b569651ae8fb5f52c1f9faf26fce64c1607 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter Priority: optional Section: devel Installed-Size: 630 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.4-focal Depends: libstdc++6, libc6, libgcc1, libgtirb (=2.3.2-focal), libgtirb-pprinter (=2.2.4-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/g/gtirb-pprinter/gtirb-pprinter_2.2.4-focal_amd64.deb Size: 198414 MD5sum: 023b62f206de2dcc49393a01bd3451cd SHA1: 446475aa3d3cb9d46f9f2f539fb4a4a1b4493081 SHA256: ff023662ad12ec88e768e3abf6c328ed324e396d102710c097ba03cf12d19e25 SHA512: 1ec9e390ef0fda23eb42038f51ead4e69379d637378c1531ca80c72b579fdff6cc5c0bf37f919074523b37592c83cd66c7dd810fcb8f0f17b698df3a032f8926 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter Priority: optional Section: devel Installed-Size: 630 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.3-focal Depends: libstdc++6, libc6, libgcc1, libgtirb (=2.3.1-focal), libgtirb-pprinter (=2.2.3-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/g/gtirb-pprinter/gtirb-pprinter_2.2.3-focal_amd64.deb Size: 198420 MD5sum: 5370123277098d4bba01900d8d183590 SHA1: 2a9773d4e5e1ba9f5a9c3e1545c7a07f79ae7d2d SHA256: b86f94022bfcc6bb3609a67fda61fe1b5fccaa7e787e519b9abaa830822452e8 SHA512: c863f7c1f635f2d57215d0e245a6c66cfba204fc07092f3ae112357d35e6820b02296b27c558e00aa3473961f8e513fd840165f459848b146b5abfe4adb64043 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter Priority: optional Section: devel Installed-Size: 630 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.2-focal Depends: libstdc++6, libc6, libgcc1, libgtirb (=2.3.1-focal), libgtirb-pprinter (=2.2.2-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/g/gtirb-pprinter/gtirb-pprinter_2.2.2-focal_amd64.deb Size: 198412 MD5sum: 7b4fef3a7c6bac537688e21c8367966e SHA1: 968e9b4d5703c04c2937728c4411c45671c1d663 SHA256: 49859d750bd48217d458dfa2d1391c277415d85b82e38ff019721e3d0c7f7129 SHA512: afc7bd9ad14227d4f70df8d0c181f8ea7878da6de0e380297409f79d8cfada94bd5d8e32633de1556fc088449b099ef2e087fd01077f51af52e32773d2e79a35 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter Priority: optional Section: devel Installed-Size: 630 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.1-focal Depends: libstdc++6, libc6, libgcc1, libgtirb (=2.2.0-focal), libgtirb-pprinter (=2.2.1-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/g/gtirb-pprinter/gtirb-pprinter_2.2.1-focal_amd64.deb Size: 198408 MD5sum: 772228dc058877cb91843a04650292a7 SHA1: 3bcc78c36e0a12294dcefd8af56f22738194df18 SHA256: 7a80f20ebb5286fd79b161aa2bd4aa4a1fabaedd2fcb7edd9de0f2e93c4001f9 SHA512: 64ab36875b7fcca2055081cd5a4af32387b12b7f136978999c3ed0e8820470a623d97046e0e74a6d6a5370d0603c525601ea6d31bcf5c21d32b103c1e3e0d559 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter Priority: optional Section: devel Installed-Size: 626 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.0-focal Depends: libstdc++6, libc6, libgcc1, libgtirb (=2.1.0-focal), libgtirb-pprinter (=2.2.0-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/g/gtirb-pprinter/gtirb-pprinter_2.2.0-focal_amd64.deb Size: 197152 MD5sum: 011a1cf4d7f615c1f5e6562e338338ac SHA1: a09ddb0809009828facc05aa3ec7af944b17b48d SHA256: 3e85028069643673fa67766bd438cb970259da5116a1aded759ea33839c3cb5d SHA512: d4bd6e2a046a27f97116049d88f39f041bca2de0bfdbc5e64eb4e4376e75b90a0580f6585c345d690bb7263a64bf52e542826006bd6a9cdbfaaa21b214d61832 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter Priority: optional Section: devel Installed-Size: 626 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.1.1-focal Depends: libstdc++6, libc6, libgcc1, libgtirb (=2.0.1-focal), libgtirb-pprinter (=2.1.1-focal), libboost-filesystem1.71.0, libboost-program-options1.71.0, libcapstone-dev (=1:5.0.0-gtdev) Filename: pool/unstable/g/gtirb-pprinter/gtirb-pprinter_2.1.1-focal_amd64.deb Size: 197178 MD5sum: bac3f466e2ae82b2af784dd67acd876e SHA1: c5b3bda45679b977f60ac5a03e6c3460275129b1 SHA256: da547d92ebf8c66fa7116ead466d6dada6928d5c5b3c32afcd555efbc895222c SHA512: 11fa5eeb0b09b3fff47ecbb28577bad81f7687e2ff565c965b7181138c2a11e5b0ec5dd7bf2078596640de2301903e8173560da4e338886463f37cfe921f496f Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). At the moment we require our own fork https://github.com/GrammaTech/capstone/tree/next that contains some additional fixes (until new official releases are cut). * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 32044 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.6-focal Depends: gtirb-pprinter (=2.2.6-focal) Filename: pool/unstable/g/gtirb-pprinter-dbg/gtirb-pprinter-dbg_2.2.6-focal_amd64.deb Size: 5948712 MD5sum: 58fffdca4eb1786b8082987332d68b64 SHA1: 8a424a6080045c3949bf1b563e3930ba3381346b SHA256: 5e1c73e6165da397a1823aad4686f99299ca1cc735f93c1ce607823b0d3c9a71 SHA512: fc2ba6a8b4c6ad1687a8f8c60b281b07cdfe19d39e55bf49f21f80e311e4f3a6a48bfba5f103ffd2548cdd433d4fa9e151ad3f20d47510544a1c21763edbe8bc Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 32044 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.5-focal Depends: gtirb-pprinter (=2.2.5-focal) Filename: pool/unstable/g/gtirb-pprinter-dbg/gtirb-pprinter-dbg_2.2.5-focal_amd64.deb Size: 5948708 MD5sum: 86b7659e781a7de73bec815cbec948f0 SHA1: 9dc9c79f0257539de696212a757d6578bdc01ba4 SHA256: d89ba350f01e0097c17480a8b1c42d74f5c191c731455f013c37adeb71c6f0fe SHA512: 91b0c5e62fc4028304e5c690e9e3eaa57580d6b9541dfb11054c972469e062a0beb6f634d1b6d1aff1a45358e8f94599c1e57929ec964e4ef21475b42ef6903d Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 32044 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.4-focal Depends: gtirb-pprinter (=2.2.4-focal) Filename: pool/unstable/g/gtirb-pprinter-dbg/gtirb-pprinter-dbg_2.2.4-focal_amd64.deb Size: 5948672 MD5sum: 8edc6f1fd585b371f6c1aabc98a27134 SHA1: 343fe5dbb80fb6ce25d8cf60cb84ad30ded367f5 SHA256: d1516921babc055011cb0a0aa9def642a3e55b4d4d7f66f482733a56445a027e SHA512: 3acdc451ccefdf1a7f5e236e0a0a4df6ab90aaf5693bc902484aa072e8e224ac7b2254c1b01864086a11805a4f0bf353775eb87f5b2c06c4383029b0a31d9827 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 32044 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.3-focal Depends: gtirb-pprinter (=2.2.3-focal) Filename: pool/unstable/g/gtirb-pprinter-dbg/gtirb-pprinter-dbg_2.2.3-focal_amd64.deb Size: 5946822 MD5sum: 38ac2a2427c27b4c58c63b76bfa6ba5c SHA1: e02118a71ce2e6659483da0891a2e857286f4d6b SHA256: a28ae6bd974e1102df33f1c8d90f3aa2f05c03fdeff4e248b537ddce54543c54 SHA512: c1cd14d2c49f92d34306f9e538a36c95554eca09970f3ee230b21429b9e1c17ed9cf07d691ffd9031fbfac78238bd34c4a25ebb9608b6f556409f46c84971321 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 32044 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.2-focal Depends: gtirb-pprinter (=2.2.2-focal) Filename: pool/unstable/g/gtirb-pprinter-dbg/gtirb-pprinter-dbg_2.2.2-focal_amd64.deb Size: 5948590 MD5sum: 0b6bef4c218f53d75f246234c824ae64 SHA1: 2adb1ca97719de3d33f242aedc7ce7f42eb55e77 SHA256: cf82ea0b04d457ba8aaa186e840488fd98b349143d0eede9ac3e2864b164d434 SHA512: 7ac4ed203a342c8abdb823b8a510491c058ffae1c763eb30cb9b5d5d65e0224730121583fd568084752c3c2616decb84510b64d0fc4e5f00f78b317d6c3effe3 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 32044 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.1-focal Depends: gtirb-pprinter (=2.2.1-focal) Filename: pool/unstable/g/gtirb-pprinter-dbg/gtirb-pprinter-dbg_2.2.1-focal_amd64.deb Size: 5946950 MD5sum: ff66e6c3b6e81baaf8c0d3beb343afbc SHA1: 4047432e2577a45b852a09dfbffbaa0a32843c30 SHA256: 3fe6408d4476899f2293aa626bec48a9515088c49b904ca5028ed63a95050ccb SHA512: f890980ef4945a0f7fdf552a1a043235f13803ed92e13e2bec4f2c41035a8708dfe58e0c614c81ccb84abcaeaf6b385d409a0d04e05825ab4251de982c913bbb Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 31867 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.0-focal Depends: gtirb-pprinter (=2.2.0-focal) Filename: pool/unstable/g/gtirb-pprinter-dbg/gtirb-pprinter-dbg_2.2.0-focal_amd64.deb Size: 5905718 MD5sum: 7b6ccbeecd07fb33e8a425a4e4450314 SHA1: 01b320d91491542ce629c39b668c7afe3fd18ca6 SHA256: 1d0998643b342d07660ce3c61a96523c494399a621f6db20f8d89c7a7d4d23c6 SHA512: 8b3e1dd0610e3d46c61c650bd1deb639d916289ea58d1205a0d9c63f179b7b8f3f8a086e9b3e833c6267b7b6813cab8f147fb509e46bb908269b8e36f98dee4a Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: gtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 31864 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.1.1-focal Depends: gtirb-pprinter (=2.1.1-focal) Filename: pool/unstable/g/gtirb-pprinter-dbg/gtirb-pprinter-dbg_2.1.1-focal_amd64.deb Size: 5905848 MD5sum: c77603fb74ee5ec51e129dc3171edbef SHA1: 5bb6cf98a946c458cc89ef69acab9b7b028e7c92 SHA256: bea0b49eacff306872219084c86935860f9305ccfebe5c23a89c26ea09583823 SHA512: 97113ab3f06623b23cd3435ca050f5940e8d0aaec36d7504809fb091daeb568031400ee1e2a0a6bc035848a0056db82582f127bc46641e9203892a323e2dbd2d Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). At the moment we require our own fork https://github.com/GrammaTech/capstone/tree/next that contains some additional fixes (until new official releases are cut). * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libcapstone-dev Priority: extra Section: checkinstall Installed-Size: 30816 Maintainer: afloresmontoya@grammatech.com Architecture: amd64 Version: 1:5.0.1-gtdev Provides: libcapstone-dev Filename: pool/unstable/libc/libcapstone-dev/libcapstone-dev_5.0.1_gtdev_amd64.deb Size: 2979288 MD5sum: dcc5e8275fdbaed6a0f261c6352e822d SHA1: 560ff26f92967f3197a6dc5cec40841b1dc8b5ae SHA256: 834d469517c0420fe3d537fee1143ad0dd7ca114e87497e08a182912b9ad0a91 SHA512: a2f242142ff420037b05a20920b40b99183ff199d649fed16bed5588e42d70862c97e9a342b25e90e07c62297d3b94669dc32e225449369364d71d5399213764 Description: Package created with checkinstall 1.6.3 Package: libcapstone-dev Priority: extra Section: checkinstall Installed-Size: 28216 Maintainer: afloresmontoya@grammatech.com Architecture: amd64 Version: 1:5.0.0-gtdev Provides: libcapstone-dev Filename: pool/unstable/libc/libcapstone-dev/libcapstone-dev_5.0.0_gtdev.deb Size: 2729152 MD5sum: 5ff038036e48846e8bf2570d9063257a SHA1: 32f82b306b53a7037c52cb65e72f3b9298b82d14 SHA256: f5110609564cc7a87eb0e1a58b5d3ca4a76df64a9cd65ccd12e38f33775abc69 SHA512: 85b0e5c8194d426886d1416643c26b62f9b34f9cd38e6a2acac8da2426b9a246b37fc640e724e85c3289004a815ee94fe05b388142ae33cff8ae0d6485794fd6 Description: Package created with checkinstall 1.6.2 Package: libgtirb Priority: optional Section: devel Installed-Size: 2110 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.3.3-focal Depends: libstdc++6, libc6, libgcc1, libprotobuf17 Filename: pool/unstable/libg/libgtirb/libgtirb_2.3.3-focal_amd64.deb Size: 351308 MD5sum: d23b2c4f1c8e98dd7baf66b12691aaae SHA1: 3d29214264f3f24c7f6638bd75ab4b9bff75df64 SHA256: 8579b1014e9b8dce7d15dd3508bce0b522acb213b62ff21d5014e584d1edabb8 SHA512: ff345ac5ca74cf1c421d78b4d53cb01d81bde0e626114c21d4acd9720e1025366a31a5341219db821745f73e0200fff4f8d89466b3d28c7012438af3c2798c33 Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.68 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb Priority: optional Section: devel Installed-Size: 2110 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.3.2-focal Depends: libstdc++6, libc6, libgcc1, libprotobuf17 Filename: pool/unstable/libg/libgtirb/libgtirb_2.3.2-focal_amd64.deb Size: 351308 MD5sum: cb032966bd251afbbf3417135951a1ed SHA1: 293a85dcd2e25f21e10a1e7766185f8c9dcb99dd SHA256: 5c188a2bb82f5fd6e55805246be9833b4f7d984e9be7d936871240183ff7547b SHA512: 9baf7eefa5dc02aa15e7ccd6ab0cebf884cce9cfc8e25d3653f002c6eb329789969a7bddafb3c57121769935386d8df825f4b7819513f36ace13abe135373910 Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.68 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb Priority: optional Section: devel Installed-Size: 2110 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.3.1-focal Depends: libstdc++6, libc6, libgcc1, libprotobuf17 Filename: pool/unstable/libg/libgtirb/libgtirb_2.3.1-focal_amd64.deb Size: 351282 MD5sum: bc344c3bf1d78f00c03258767a28713a SHA1: ea0e1ffb3c57a8fdc2a12c898bc5c0cd403dcceb SHA256: af44dae9bf929f1f017cd79c5b9df9eea6f9686299b02168e9fa3043c30c49a4 SHA512: 6eabc8b0f24e40c46f007e5d8479b7627c497c37844b388dd32bda198aac04728eab43337efa22b866393042bc1ac26bccb51eef00fb5e776eb0fc188b1b00df Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.68 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb Priority: optional Section: devel Installed-Size: 2110 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.0-focal Depends: libstdc++6, libc6, libgcc1, libprotobuf17 Filename: pool/unstable/libg/libgtirb/libgtirb_2.2.0-focal_amd64.deb Size: 351280 MD5sum: cf3d4bf32bfcf974c555298ff908a81b SHA1: 87b77e54c736a4906115feedaa26699b85d13191 SHA256: 7109b9f72675b12f704dc93f0529cbd8167f0a10ee9de59b7498f2c78a9083ba SHA512: df073a21a4ed522189bd8910468f488eee5a608234be50b9676e5870ebf8e0edf2129a4f8594be15995c87923536812bbb744eda06441511352d853469d07ce8 Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.68 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb Priority: optional Section: devel Installed-Size: 2095 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.1.1-focal Depends: libstdc++6, libc6, libgcc1, libprotobuf17 Filename: pool/unstable/libg/libgtirb/libgtirb_2.1.1-focal_amd64.deb Size: 346344 MD5sum: 463f94258e0f68b3411756786850b9c3 SHA1: beaa3a148ecedfb45f9807219721cc8c2e869c08 SHA256: 90d3407149d6926326f60d02252b60470b844123bc8279a40b0573ad8b187a1e SHA512: 1adb1d64b914459610080d6274237e3a48e10ca93f0da5c152f5474ed6aeb5c4f0f7c709019539e6a6242720d0bf96eb75eefc169869e9e2767c9c2bcb5351cd Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.67 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb Priority: optional Section: devel Installed-Size: 2095 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.1.0-focal Depends: libstdc++6, libc6, libgcc1, libprotobuf17 Filename: pool/unstable/libg/libgtirb/libgtirb_2.1.0-focal_amd64.deb Size: 346344 MD5sum: 99ab8afe95a5b63043103d4fd02e32fe SHA1: d344874e0e9a84482c441b740f48b6642da72355 SHA256: b996168bccc909f8e4ed361c9f3853a1554aec031b7eb85c881fcf399b827eba SHA512: 0e2627d01fd6cca00b2188618074e8af2dc0437278a2df70027b36a0ecea95637b64c2d3445bf3af982a50b4afa6e50c5810538f41acab1ee77623c367d9d7de Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-unstable-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.67 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb Priority: optional Section: devel Installed-Size: 2061 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.0.1-focal Depends: libstdc++6, libc6, libgcc1, libprotobuf17 Filename: pool/unstable/libg/libgtirb/libgtirb_2.0.1-focal_amd64.deb Size: 345450 MD5sum: 6c9e71482460108565945f7127be43d4 SHA1: d04b09f2db45d39d0f853a6e91007c6c10e8bb62 SHA256: e4948e84db4163a81d55f22289f2f1576220d0021d22d8d7b844e52975a0c06b SHA512: 991b17b93e2c0b9c66702c2c82586dd77397dae3901b39b3f33e62f27e078f4a09a1266317029aa3c6f46dfce20ec065e1227948d288b26a69b23acde6d0a9a9 Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-unstable-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: There is a problem with the packages in the stable repository that will cause conflicts if you try `apt-get upgrade`. In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.67 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dbg Priority: optional Section: devel Installed-Size: 42009 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.3.3-focal Depends: libgtirb (=2.3.3-focal) Filename: pool/unstable/libg/libgtirb-dbg/libgtirb-dbg_2.3.3-focal_amd64.deb Size: 12079664 MD5sum: bea2aa38b2eb311e9ffca9e68a50ffd8 SHA1: 4f3d0d38bd5d45bdae229cb27431f6d7c6c8865f SHA256: b875c4cfdb1791311a75b7c5597e340f1d9470c1aaa7787cd865a0b70ef5fe86 SHA512: ba5016fb65cbffc76ad62179131fec588c1c05ffe3ab177f05003cbf8c9b843d467c8541b59983ed9db1603d3e7cf1b0d460fe652f043adba9e2f103e2f1bcb1 Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.68 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dbg Priority: optional Section: devel Installed-Size: 42009 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.3.2-focal Depends: libgtirb (=2.3.2-focal) Filename: pool/unstable/libg/libgtirb-dbg/libgtirb-dbg_2.3.2-focal_amd64.deb Size: 12079670 MD5sum: 3b87c734b17158f268f6011f5d3fc602 SHA1: 7711e1a644b2489c47c39f5b5e4f9b4b30397789 SHA256: bf6fece94644f1045ddb0b2ce1044e8b2c78a92e7ad47486125b141bff56879c SHA512: bff122545af560656a4a3db548033a641a45466a7874c170a1f557a17ed566262998c749af3d7e4de6c30317f0b353d7e64654130012b3783d3f0858faf16263 Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.68 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dbg Priority: optional Section: devel Installed-Size: 42009 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.3.1-focal Depends: libgtirb (=2.3.1-focal) Filename: pool/unstable/libg/libgtirb-dbg/libgtirb-dbg_2.3.1-focal_amd64.deb Size: 12078784 MD5sum: 958901f5685b934249e1d0927243aa3e SHA1: 537a2118be0f0ddbbd277a91872c657ae2d28b50 SHA256: 9cf7616d0ebca52e7dfcacf8b390576255c61fc44c1e8ff171481d2c95b50f60 SHA512: acbf7f7cf96abf137ce6425e15d993bc6f8145c2cf16e54eddedb60f41b4a80c3e0e2d3c37746a9aae9bd99deb373320dcb1b1520ec2da9a8226bcb33b38e632 Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.68 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dbg Priority: optional Section: devel Installed-Size: 42009 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.0-focal Depends: libgtirb (=2.2.0-focal) Filename: pool/unstable/libg/libgtirb-dbg/libgtirb-dbg_2.2.0-focal_amd64.deb Size: 12078792 MD5sum: ae77aa7dce16fee87f4f8bf5a8b5aaf6 SHA1: a7a4faf4513e621dd0b1e4806fc115b4b035529c SHA256: f2cbf5504f460704f8abe3d04b9c00c5470fd8df6bd5154430e45034cff5b34e SHA512: cb6af04f264e09e1ab4521893195144cd2aa59d3bf454c01699f051d9b77d71fa2d0ffa628cd1939108d39526dd5cc8e9f9591b70a701875a33184ea5bed9e2c Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.68 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dbg Priority: optional Section: devel Installed-Size: 42005 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.1.1-focal Depends: libgtirb (=2.1.1-focal) Filename: pool/unstable/libg/libgtirb-dbg/libgtirb-dbg_2.1.1-focal_amd64.deb Size: 12079308 MD5sum: f8e252fc9628eacc5dbb5c534f1d8c5c SHA1: e4b5fd92256b63c8a1ed1e02dec62e26560fb178 SHA256: f3e5f64205e47413f4cb36d35e0f35d049872b5d80133203f0620c1175b85e2d SHA512: fdd94ac09b3f5a001fba535a8480f7a284d2674801b73d25aabcd120d53a8fe1a55354c786dc1c059780c801b81206d935ebd6cd0416fa25d7a687e512b7706a Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.67 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dbg Priority: optional Section: devel Installed-Size: 42005 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.1.0-focal Depends: libgtirb (=2.1.0-focal) Filename: pool/unstable/libg/libgtirb-dbg/libgtirb-dbg_2.1.0-focal_amd64.deb Size: 12079298 MD5sum: 63629a4982cf2e3849f41bf596b6d253 SHA1: b1d991faa370d48958d2aaaa67c5690b90ddbd62 SHA256: 226d7b9fb96f6065bcabfc6ccc4eeae5aa2287d9b7171240a7a491df28c21b73 SHA512: 7d2b07b6e767ffee96e70ffd11a4317df3bef7c8ac94b99a1461b427c610e62db308f87eef6e1a8d84821b8a7b094e26d724e4086530f58552e8eee9c991888a Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-unstable-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.67 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dbg Priority: optional Section: devel Installed-Size: 41784 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.0.1-focal Depends: libgtirb (=2.0.1-focal) Filename: pool/unstable/libg/libgtirb-dbg/libgtirb-dbg_2.0.1-focal_amd64.deb Size: 12039234 MD5sum: 23ebc21d1b2783c4286a66d20219458f SHA1: d84b3d3c30b7dc1a012e794f6d1639df68e8ad0f SHA256: f995ac2db6b9691916eddad7bf891e1fe90bc2b3c8e41240317700acd8f05adb SHA512: 2b5b894a7c534c8fdfd24d4af588dca124a6c232a0373fc4b6b1211093d291af4def9e10b72aa364e25b267ddf1f79b00edc1df5a7d7e5323df2198851ea1fdf Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-unstable-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: There is a problem with the packages in the stable repository that will cause conflicts if you try `apt-get upgrade`. In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.67 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dev Priority: optional Section: devel Installed-Size: 25025 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.3.3-focal Depends: libgtirb (=2.3.3-focal), libboost-dev (>=1.68) | libboost1.68-dev, libprotobuf-dev (>=3.6.1~), libprotobuf-dev (<<3.6.2) Filename: pool/unstable/libg/libgtirb-dev/libgtirb-dev_2.3.3-focal_amd64.deb Size: 4922726 MD5sum: 5c22cfd6410c0800afc795b93e56c3af SHA1: 11a4327ddc74b279abf921f7fdd21efe1bb6469b SHA256: e5e76a12019aefa40dcabb861fa2eff68b38766a9aa08d7e889229007187c537 SHA512: d04db8f9ba28c84a726deba6cff231eeaec64f6924d2efa2bf11c122fa901213d094671d290012383b6bec9358956585070669081a5df325896b0f551041f763 Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.68 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dev Priority: optional Section: devel Installed-Size: 25025 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.3.2-focal Depends: libgtirb (=2.3.2-focal), libboost-dev (>=1.68) | libboost1.68-dev, libprotobuf-dev (>=3.6.1~), libprotobuf-dev (<<3.6.2) Filename: pool/unstable/libg/libgtirb-dev/libgtirb-dev_2.3.2-focal_amd64.deb Size: 4922718 MD5sum: 0d8f26529010950bd1cd31c4b2cd2e73 SHA1: 7d8a2bf7622ee1e2972084acc5f64cd431494d5f SHA256: 98820fce7d8ca2d3b8381f572b4824c0725ea1c832cb085d2d9274eb9bb83a4c SHA512: 28a95939968aa315c83ff1dbb992e622826d8b699cf7e0d197fe5c95fd300f5a01e529c5d04022713c681aeed634b4a842479e077f24f801efbe6886a8c77c5f Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.68 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dev Priority: optional Section: devel Installed-Size: 25024 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.3.1-focal Depends: libgtirb (=2.3.1-focal), libboost-dev (>=1.68) | libboost1.68-dev, libprotobuf-dev (>=3.6.1~), libprotobuf-dev (<<3.6.2) Filename: pool/unstable/libg/libgtirb-dev/libgtirb-dev_2.3.1-focal_amd64.deb Size: 4922628 MD5sum: a328e2c6f010c51097a58caa86c17705 SHA1: d73f9d690eac08aabe80f4daf1559bc0a2d9db36 SHA256: 89b86d7815ee8b675706f6eff8e76122a3d2f81c493a7334dbbbe48332c26283 SHA512: d3ca04ce419d7f7f62f822943bd78511a73c160f14e7635bc379328015c2bb044581bf79d5a4e724ea4f341da8cb00f244aa85fc529d70e03daf16d446d93c30 Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.68 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dev Priority: optional Section: devel Installed-Size: 25024 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.0-focal Depends: libgtirb (=2.2.0-focal), libboost-dev (>=1.68) | libboost1.68-dev, libprotobuf-dev (>=3.6.1~), libprotobuf-dev (<<3.6.2) Filename: pool/unstable/libg/libgtirb-dev/libgtirb-dev_2.2.0-focal_amd64.deb Size: 4922618 MD5sum: 3ba13fb3355bc2bbc34e4e93df17b365 SHA1: bd37629c6a4dcde72d50c31665570b53aac12b89 SHA256: 7507cb361a80e7657b29f0d3f7e63ac513dd578c721fcf193103cc5e2a3c4d9c SHA512: bf56d437b4cbf45747f5185a0ca641ee83a6df1ea7735b0f9b6e7e29e98494795741ce3382aee352abc2d1f23064a60e235a1f7090a1847ae985d0d4b8b1728e Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.68 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dev Priority: optional Section: devel Installed-Size: 25021 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.1.1-focal Depends: libstdc++6, libc6, libgcc1, libgtirb (=2.1.1-focal), libboost-dev (>=1.67) | libboost1.67-dev, libprotobuf-dev (>=3.6.1~), libprotobuf-dev (<<3.6.2) Filename: pool/unstable/libg/libgtirb-dev/libgtirb-dev_2.1.1-focal_amd64.deb Size: 4922030 MD5sum: 1513e731adaae8eb9fee4fa8c296e8e2 SHA1: eb9795a2ac857ea7f39e5aa36a75d05d8eb9f032 SHA256: 78399dd8838d23bab63e17bc104266a0a71fb8be6d7d4a58e9be32564a206f96 SHA512: acb9ce70a3f5303d15ad0a99f27fd8f1ddd2537cbc0767245bd2360ab2932747af5a79e677a2ec53c28d475f0781781f5592a9c4541460c713639957aed3362e Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-0.dev-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.67 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dev Priority: optional Section: devel Installed-Size: 25021 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.1.0-focal Depends: libstdc++6, libc6, libgcc1, libgtirb (=2.1.0-focal), libboost-dev (>=1.67) | libboost1.67-dev, libprotobuf-dev (>=3.6.1~), libprotobuf-dev (<<3.6.2) Filename: pool/unstable/libg/libgtirb-dev/libgtirb-dev_2.1.0-focal_amd64.deb Size: 4922044 MD5sum: ec20168c0e52f407cd267d4da745ac84 SHA1: f674fa5b6257397d6b8b0739d16ab400cd7a8bab SHA256: 53c740c4848d1532944047bcca14ea6b3b7f0fc0078ba051f87105187bba3e0c SHA512: 8f392eff28749fd449c3eb8cb411eb99fbe80de630f5f5d00706a9ee74e3c8e65dc568dee37db9758a2e2ae28666f672951830267c4810b5d16afaa36bf00295 Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-unstable-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: Stable versions gtirb-2.0.0, gtirb-pprinter-2.1.0, ddisasm-1.8.0 and OLDER rely on metapackages which cause conflicts if you try `apt-get upgrade` (see https://github.com/GrammaTech/gtirb/issues/63). In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). NEWER stable versions no longer rely on metapackages and can be upgraded without problems. . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.67 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-dev Priority: optional Section: devel Installed-Size: 25016 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.0.1-focal Depends: libstdc++6, libc6, libgcc1, libgtirb (=2.0.1-focal), libboost-dev (>=1.67) | libboost1.67-dev, libprotobuf-dev (>=3.6.1~), libprotobuf-dev (<<3.6.2) Filename: pool/unstable/libg/libgtirb-dev/libgtirb-dev_2.0.1-focal_amd64.deb Size: 4920824 MD5sum: 2024f4692d44152798da999304eb8a27 SHA1: 5936d071a12bb8501c2135ab1ebb4364b34f0bb9 SHA256: b504d8d09aaf927abc0de23b30ca55fd2de3bfae8cd3beaff8be17de2d719ba7 SHA512: 4609ff16229ad3ba5573e709356ba856df11c2d6ee4f2338d912378367b87f74a28a4d371666b98a25dd9a2cb7e7007d138329ac7cd015dd9a082a46ef391c5f Description: The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. # GTIRB . The GrammaTech Intermediate Representation for Binaries (GTIRB) is a machine code analysis and rewriting data structure. It is intended to facilitate the communication of binary IR between programs performing binary disassembly, analysis, transformation, and pretty printing. GTIRB is modeled on LLVM-IR, and seeks to serve a similar functionality of encouraging communication and interoperability between tools. . The remainder of this file describes various aspects of GTIRB: - [Structure](#structure) - [Installing](#installing) - [Building](#building) - [Usage](#usage) . # Structure . GTIRB has the following structure. Solid lines denote inheritance. Dotted lines denote reference by UUID. . ![GTIRB Data Structure](.gtirb.svg) . ## IR . An instance of GTIRB may include multiple modules (`Module`) which represent loadable objects such as executables or libraries, an inter-procedural control flow graph (`IPCFG`), and Auxiliary Data tables (`AuxData`) which can hold arbitrary analysis results in user-defined formats which can easily reference other elements of the IR. Each module holds information such as symbols (`Symbol`) and sections which themselves hold the actual bytes and data and code blocks of the module. The CFG consists of basic blocks (`Block`) and control flow edges between these blocks. Each data or code block references a range of bytes in a byte interval (`ByteInterval`). A section may hold one large byte interval holding all blocks---if the relative positions of blocks in that section are defined---or may hold one byte interval per block---if the relative positions of blocks is not defined, e.g. for the code blocks in the `.text` section during program rewriting. Each symbol holds a pointer to the block or datum it references. . . ## Instructions . GTIRB explicitly does NOT represent instructions or instruction semantics but does provide symbolic operand information and access to the bytes. There are many *intermediate languages* (IL)s for representation of instruction semantics (e.g., [BAP][]'s [BIL][], [Angr][]'s [Vex][], or [Ghidra][]'s P-code). GTIRB works with these or any other IL by storing instructions generally and efficiently as *raw machine-code bytes* and separately storing the symbolic and control flow information. The popular [Capstone][]/[Keystone][] decoder/encoder provide an excellent option to read and write instructions from/to GTIRB's machine-code byte representation without committing to any particular semantic IL. By supporting multiple ILs and separate storage of analysis results in auxiliary data tables GTIRB enables collaboration between independent binary analysis and rewriting teams and tools. . [BAP]: https://github.com/BinaryAnalysisPlatform/bap [BIL]: https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf [Angr]: http://angr.io [Vex]: https://github.com/angr/pyvex [Ghidra]: https://www.nsa.gov/resources/everyone/ghidra/ [Capstone]: https://www.capstone-engine.org [Keystone]: https://www.keystone-engine.org . . ## Auxiliary Data . GTIRB provides for the sharing of additional information, e.g. analysis results, in the form of `AuxData` objects. These can store maps and vectors of basic GTIRB types in a portable way. The [GTIRB manual][] describes the structure for common types of auxiliary data such as function boundary information, type information, or results of common analyses in [Standard AuxData Schemata][]. . [GTIRB manual]: https://grammatech.github.io/gtirb/ [Standard AuxData Schemata]: https://grammatech.github.io/gtirb/md__aux_data.html . . ## UUIDs . Every element of GTIRB---e.g., modules (`Module`), symbols (`Symbol`), and blocks (`Block`)---has a universally unique identifier (UUID). UUIDs allow both first-class IR components and AuxData tables to reference elements of the IR. . Instructions and symbolic operands can be addressed by the class `Offset` which encapsulates a UUID (that refers to the instruction's block) and an offset. . . # Installing . Packages currently exist for easily installing GTIRB (and attendant tooling including the [ddisasm][] disassembler and [gtirb-pprinter][] pretty printer) on Windows, and Ubuntu 20. See below for instructions. Additionally, a public Docker image exists at [grammatech/ddisasm][] with all of these tools installed. GTIRB is versioned with Major.Minor.Patch versioning where Major version increments will require significant source changes but should be very rare, Minor version increments may require small source changes, and Patch version increments shouldn't break any downstream builds. We do not yet provide ABI compatibility across any version changes. . [ddisasm]: https://github.com/GrammaTech/ddisasm [gtirb-pprinter]: https://github.com/GrammaTech/gtirb-pprinter [grammatech/ddisasm]: https://hub.docker.com/r/grammatech/ddisasm . . ## Python API . The latest stable GTIRB Python API may be installed from PyPI using pip: . ```sh pip install gtirb ``` . The latest unstable version of the Python API can be installed from a prebuilt wheel: . ```sh pip install https://download.grammatech.com/gtirb/files/python/gtirb-unstable-py3-none-any.whl ``` . It is critical that the choice of a `stable` or `unstable` package matches the installed ddisasm and gtirb-pprinter packages. . ## Windows . Windows releases are packaged as .zip files and are available at https://download.grammatech.com/gtirb/files/windows-release/. . ## Ubuntu . Packages for Ubuntu 20 are available in the GTIRB apt repository and may be installed per the following instructions. . First, add GrammaTech's APT key. ```sh wget -O - https://download.grammatech.com/gtirb/files/apt-repo/conf/apt.gpg.key | apt-key add - ``` . Next update your sources.list file. ```sh echo "deb [arch=amd64] https://download.grammatech.com/gtirb/files/apt-repo [distribution] [component]"| sudo tee -a /etc/apt/sources.list ``` Where: - `[distribution]` is `focal` (currently, only Ubuntu 20 packages are available) - `[component]` is either `stable`, which holds the last versioned release, or `unstable`, which holds the HEAD of the repository. . Finally update your package database and install the core GTIRB tools: ```sh sudo apt-get update sudo apt-get install gtirb-pprinter ddisasm ``` . **Warning**: There is a problem with the packages in the stable repository that will cause conflicts if you try `apt-get upgrade`. In this case, uninstall and reinstall the packages you got from the GTIRB repository. You may need to use `dpkg --remove` to remove the metapackages (e.g. `ddisasm`) before removing the concrete versioned packages (e.g. `ddisasm-1.5.1`). . # Building . GTIRB's C++ API should successfully build in 64-bits with GCC, Clang, and Visual Studio compilers supporting at least C++17. GTIRB uses CMake which must be installed with at least version 3.10. . The common build process looks like this: ```sh mkdir build cd build # Note: You may wish to add some -D arguments to the next command. See below. cmake <path/to/gtirb> cmake --build . # Run the test suite. ctest ``` . For customizing the GTIRB build, you can get a list of customization options by navigating to your build directory and running: . ```sh cmake -LH ``` . ## Requirements . To build and install GTIRB, the following requirements should be installed: . - [CMake][], version 3.10.0 or higher. - Ubuntu 18 provides this version via the APT package `cmake`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - [Protobuf][], version 3.0.0 or later. - Ubuntu 18 provides this version via the APT packages `libprotobuf-dev` and `protobuf-compiler`. - Ubuntu 16 and earlier provide out of date versions; build from source on those versions. - Boost [(non-standard Ubuntu package from launchpad.net)][], version 1.67 or later. - Ubuntu 18 only has version 1.65 in the standard repository. See Ubuntu instructions above. . [CMake]: https://cmake.org/ [Protobuf]: https://developers.google.com/protocol-buffers/ [(non-standard Ubuntu package from launchpad.net)]: https://launchpad.net/~mhier/+archive/ubuntu/libboost-latest . . # Usage . GTIRB is designed to be serialized using [Google protocol buffers][] (i.e., [protobuf][]), enabling [easy and efficient use from any;programming language](#using-serialized-gtirb-data). . GTIRB may also be used through a dedicated API implemented in multiple languages. The APIs provide efficient data structures suitable for use by binary analysis and rewriting applications; see [below](#gtirb-api-implementations) for details. . [Google protocol buffers]: https://developers.google.com/protocol-buffers/ [protobuf]: https://github.com/google/protobuf/wiki . . ## Using Serialized GTIRB Data . GTIRB uses a serialized format that consists of an 8-byte signature followed by serialized [protobuf][] data. The protobuf data allows for exploration and manipulation in the language of your choice. The [Google protocol buffers][] homepage lists the languages in which protocol buffers can be used directly; users of other languages can convert the protobuf-formatted data to JSON format and then use the JSON data in their applications. . The `proto` directory in this repository contains the protocol buffer message type definitions for GTIRB. You can inspect these `.proto` files to determine the structure of the various GTIRB message types. The top-level message type is `IR`. . For more details, see [Using Serialized GTIRB Data](PROTOBUF.md). . . ## GTIRB API Implementations . The GTIRB API is currently available in C++, Python, and Common Lisp. There is a *partial* Java API which is not ready for external use. For language-independent API information, see [GTIRB;Components](doc/general/ComponentsIndex.md). For information about the different API implementations, see: . - [C++ API](doc/cpp/README.md) - [Python API](python/README.md) - [Common Lisp API](cl/README.md) - Java API **incomplete** . Homepage: https://github.com/GrammaTech/gtirb Package: libgtirb-pprinter Priority: optional Section: devel Installed-Size: 5552 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.6-focal Depends: gcc, libstdc++6, libc6, libgcc1, libgtirb (=2.3.3-focal), libboost-filesystem1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter/libgtirb-pprinter_2.2.6-focal_amd64.deb Size: 583116 MD5sum: a5f6a96c6a46c8317172850941204422 SHA1: 911c39c582a90e9eb8ecf4cf411083643c956de6 SHA256: 18e0dc781c8185eb818a189efe63bd7aea79f30785914cb0a53b06447713bf23 SHA512: b64ad9b2856e3cc233b7541f08b357539b8dffae5347be55669dfd96c689e56065834b588750a4c307f1235d0f3b62b06bc0afc046cfa92c589db121c3d846b7 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter Priority: optional Section: devel Installed-Size: 5552 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.5-focal Depends: gcc, libstdc++6, libc6, libgcc1, libgtirb (=2.3.3-focal), libboost-filesystem1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter/libgtirb-pprinter_2.2.5-focal_amd64.deb Size: 583104 MD5sum: b742bb57b72735ac935186e37139ef9e SHA1: 1ac912b6b87b458b305e5b7d0d17dedd76c1f641 SHA256: d5fc2f041c7003baebf445cc276b9ad3d2d478f3b1bbc7a6d7d97d991c26ec74 SHA512: 16f971f7b299e6b4385930d715de0cc01391cf55cbf273e5fe8f7ff38740cb52fd74ece7200fa874bede05eb8aecef006956363d3df37ea66472a4d5e2992021 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter Priority: optional Section: devel Installed-Size: 5551 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.4-focal Depends: gcc, libstdc++6, libc6, libgcc1, libgtirb (=2.3.2-focal), libboost-filesystem1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter/libgtirb-pprinter_2.2.4-focal_amd64.deb Size: 582682 MD5sum: 46025b1e2c8f8e0fc1183ef11261bafa SHA1: b6ac347f7b764f143ef668521ae7831a8e988853 SHA256: bb16fd0828f0b9cd6c6c773a73ee6060cf8fbe574adb7987fe9ad68b0a4bf66f SHA512: e83895d0a2ad4122725fd2365bba483a8a700dd1781561d6ef0ef4569f1d33568d05eba1b2783950a76888372a5c9ac8ce8c6be7814dce6eccfe9c850bbfb388 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter Priority: optional Section: devel Installed-Size: 5551 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.3-focal Depends: gcc, libstdc++6, libc6, libgcc1, libgtirb (=2.3.1-focal), libboost-filesystem1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter/libgtirb-pprinter_2.2.3-focal_amd64.deb Size: 582678 MD5sum: 921f497bdd87a41970797104fee3face SHA1: 1275ac571d4541d7db0daca16c6c22a9f9a3050e SHA256: 3a4c87f759633ca934913c3450e500c1ac1504c820685449b17feb06fb81a294 SHA512: a56494f0f5ed50841079d31b3f69ca0d7fb3f6f0eee63e38e6156a32bafb1b44eba801023250f7f9361e73db55e2b72a5a78ed80c415913521187b5822ddc3d3 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter Priority: optional Section: devel Installed-Size: 5536 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.2-focal Depends: gcc, libstdc++6, libc6, libgcc1, libgtirb (=2.3.1-focal), libboost-filesystem1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter/libgtirb-pprinter_2.2.2-focal_amd64.deb Size: 578774 MD5sum: 1655a292104c08419f1f0a78e8a0a594 SHA1: 4f874f67b56586792cba81742fdf7b4b47909185 SHA256: 7fe1dad6df200c7278db8eff03a7d6bf82dcd1d2ff863a2a2ab1b90a21a5ce8d SHA512: 32fb395f280a3d8f1136d642961fd1a85fd97c323afbff765828c905640707ef011fa8dee20adff48a60c875bc2b090107a064605adc2ed3600ecc76330fb40d Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter Priority: optional Section: devel Installed-Size: 5536 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.1-focal Depends: gcc, libstdc++6, libc6, libgcc1, libgtirb (=2.2.0-focal), libboost-filesystem1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter/libgtirb-pprinter_2.2.1-focal_amd64.deb Size: 578670 MD5sum: bd714aecbc1e8a5e10684e8c22de0beb SHA1: 948c27ccd471876e31a57d14b42d2d660202ecf1 SHA256: 13928a9963a31e16b059a07f4af7977d02e04aa0924f68ef52de3ae4016a8870 SHA512: 69f30fc6a0cbec6f2db3decddc074ce627483e2561ea78185fac17ee11e54f866660386e61514db4edd27ea67eea35901f2a113066242ded519e328f089152a4 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter Priority: optional Section: devel Installed-Size: 5522 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.0-focal Depends: gcc, libstdc++6, libc6, libgcc1, libgtirb (=2.1.0-focal), libboost-filesystem1.71.0, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter/libgtirb-pprinter_2.2.0-focal_amd64.deb Size: 577246 MD5sum: dc94ccf50ff68ef7a1c7b4bc9307ec5b SHA1: a92601e26e56626b357c6498bd14b8a4191d5fe1 SHA256: c950aaf61ce33d30693c165aeab63d17e701a61e48351b17f6c982c1dcb428d1 SHA512: 57daa569acd4b6d0c3897094801c72d477fe02ea523efa6b912cf538b0bd8fd81e02220c971334d936fb6382df5d8b407e7948a9683e2da08b2a8335018e5c23 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter Priority: optional Section: devel Installed-Size: 5452 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.1.1-focal Depends: gcc, libstdc++6, libc6, libgcc1, libgtirb (=2.0.1-focal), libboost-filesystem1.71.0, libcapstone-dev (=1:5.0.0-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter/libgtirb-pprinter_2.1.1-focal_amd64.deb Size: 570588 MD5sum: fc9fa17cad199bf86fbedb704732de32 SHA1: 45404a112e5a57e3f332526d5ca8d20998016703 SHA256: a544a610ccaf0bc4741dd327f30192843557cfce2fa3d910e9a24ca941ca87b8 SHA512: 2c848ff2283e40ae77c04923bc5fad1bd5fc05999599de2f7bad2464dbb11e85f87df41323454225c67c12a8944a17af56ad4123cc63f4707d519676f6f0f54e Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). At the moment we require our own fork https://github.com/GrammaTech/capstone/tree/next that contains some additional fixes (until new official releases are cut). * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 83222 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.6-focal Depends: libgtirb-pprinter (=2.2.6-focal) Filename: pool/unstable/libg/libgtirb-pprinter-dbg/libgtirb-pprinter-dbg_2.2.6-focal_amd64.deb Size: 21293732 MD5sum: 1197f22860970cb476ead17a19c95649 SHA1: 3a2d4a2cbb0a4ba6dbb8cc06b110cf3ea8921e50 SHA256: 3d5b3ef6ac8e285ecdb8567108e149604b21f6207071b441edb8366427017493 SHA512: 47232473067020725602f6c8bf1ad4e2cd8e34f0d682e83af51a8bb704fae0eb7792cd2a83eab8e00a9e201867ebfa28c4973785f58b6f034974bff37320a337 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 83222 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.5-focal Depends: libgtirb-pprinter (=2.2.5-focal) Filename: pool/unstable/libg/libgtirb-pprinter-dbg/libgtirb-pprinter-dbg_2.2.5-focal_amd64.deb Size: 21299416 MD5sum: aacbea0e859b969c983fef01a6046582 SHA1: 1a900a8fcb3dc167a60629507722ac1abdc2db47 SHA256: 1443905c6001009a4997fcbcab669698608abe507b8199854c6ca744146a6d4d SHA512: a273e23e8b2f2956a1f7b2b568cee387856686862446085e5ca57d09d225ae581a950723ee7ec0465227dcb9eec1abed2f444d92b7887dd43ff416c1b4a61282 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 83213 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.4-focal Depends: libgtirb-pprinter (=2.2.4-focal) Filename: pool/unstable/libg/libgtirb-pprinter-dbg/libgtirb-pprinter-dbg_2.2.4-focal_amd64.deb Size: 21296048 MD5sum: 951eb7d84d5446de0001c42ef2fdbcdf SHA1: 830e8383b1e6609f8fd15838d63d77ba2bc786bd SHA256: 735cde2ef0dedbd34f7a4ddacfa7972b0a5837f6729cc08986b87b41e63268eb SHA512: b6d3100ff6f420691f2e6f764406e2d7d414198b19b12df533de0b79bc01179d127694252b730c92505da29c0c85647b669075e90ec8a49edaa730a391862966 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 83212 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.3-focal Depends: libgtirb-pprinter (=2.2.3-focal) Filename: pool/unstable/libg/libgtirb-pprinter-dbg/libgtirb-pprinter-dbg_2.2.3-focal_amd64.deb Size: 21288906 MD5sum: b7b5ecee169df800bf1f7aa3c9de5427 SHA1: 205a9bb0e48de29462a8225d35ac7d30e6195743 SHA256: 1d34de7e2df25db3bbb0e2a6cc88035f9d5291d84ea54e0de990aabcba8febe2 SHA512: 2ccbcd6a3b57b54bdea59179a51ce007f6c0a77f87bded51cd16c8687bc26529081558ef84eb03752bdcd1dc3ce483426b1e91824f6d21efe2d3ffcd7bb5ff4c Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 82854 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.2-focal Depends: libgtirb-pprinter (=2.2.2-focal) Filename: pool/unstable/libg/libgtirb-pprinter-dbg/libgtirb-pprinter-dbg_2.2.2-focal_amd64.deb Size: 21233142 MD5sum: 5bbf9a89e496aa14e206c7e066df775d SHA1: 93e762ec78f51af842dd3d6a477dfb7d3a8b07e2 SHA256: ab1bde1d3721605880a55ceb66cb601a0ed09b11f25d455d3c8d8e0d81d17a61 SHA512: b7367b7780796c9a90660abe43a096189cd102dffdeb52527a0eb90c080b9da6d6ec81aa2a0e825f4113b4ac8a35238088eb48c811991a0284c9d4fa2196a283 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 82853 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.1-focal Depends: libgtirb-pprinter (=2.2.1-focal) Filename: pool/unstable/libg/libgtirb-pprinter-dbg/libgtirb-pprinter-dbg_2.2.1-focal_amd64.deb Size: 21234566 MD5sum: 75358aaa6188a040d971af8a4d05a030 SHA1: e24abbbb8d765f94354e1c3dd78de6bf0ac75b1c SHA256: f4e278d0c15b30cf484aa50205f4eb2bcff757348202754a1ca2fc0d48ebfbdd SHA512: a82ae12e2b697ddca2856e6e0f72b67ed987739b28488cfb92285ff8206f067e3d28d0f9d8685ae39ef12e885ec352b3b9241ce62d77806b59c338c01a348df8 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 82709 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.0-focal Depends: libgtirb-pprinter (=2.2.0-focal) Filename: pool/unstable/libg/libgtirb-pprinter-dbg/libgtirb-pprinter-dbg_2.2.0-focal_amd64.deb Size: 21191910 MD5sum: ab698a061f22d9387a4d95d29c58bb1c SHA1: eb04837cfd24baa63feca6caebf0fb9bc5b5a407 SHA256: 3a5418786e82112ec9cab1ce24761b0333222df45bc75c1463b2021d41b236e2 SHA512: 6f58f11b27872b098ed901a408b2cc213f5dbf09dcd76b549341650ca060dea972e7a979c8c15089277c0136d94c4e3a1e41af55df2193085b4575d46f616cfd Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dbg Priority: optional Section: devel Installed-Size: 82159 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.1.1-focal Depends: libgtirb-pprinter (=2.1.1-focal) Filename: pool/unstable/libg/libgtirb-pprinter-dbg/libgtirb-pprinter-dbg_2.1.1-focal_amd64.deb Size: 21031820 MD5sum: 1913d492b7d94618d33a188395fd42fa SHA1: 19e40d60cf88f75f980a5eb5e66b616e0dc64159 SHA256: 3a159e8a7fe21322ad5a66d7fddbc735aca712cf40015c603c85c05f69d3f92e SHA512: ee51a4b94d8de5d971316be61cd1ef12e31f775173e448de5b403b1a0ac4d0af1bbffbbfec0bfaa8494899cfeb64347fb603e050b05936be32a0e0b279fbe459 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). At the moment we require our own fork https://github.com/GrammaTech/capstone/tree/next that contains some additional fixes (until new official releases are cut). * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dev Priority: optional Section: devel Installed-Size: 138 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.6-focal Depends: libstdc++6, libc6, libgcc1, libgtirb-dev (=2.3.3-focal), libgtirb-pprinter (=2.2.6-focal), libboost-dev, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter-dev/libgtirb-pprinter-dev_2.2.6-focal_amd64.deb Size: 26856 MD5sum: 531f05cdd5c919e6822c6dfb00e8c1a2 SHA1: f385dd64cde69b537db43ba9db17bb4ff1938e74 SHA256: ae4f1e35ef4f515b421532b72aae2bae8a551b4d87d13dbae77be66cad8e7d09 SHA512: a013d733074aa5b1020367e57852a30a4461d57d5916fada205ea17ad4eb49ff1740d24df9982fe03b7aab791fb49a62b1cdcd4bed53bf70c084496227ed1678 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dev Priority: optional Section: devel Installed-Size: 138 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.5-focal Depends: libstdc++6, libc6, libgcc1, libgtirb-dev (=2.3.3-focal), libgtirb-pprinter (=2.2.5-focal), libboost-dev, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter-dev/libgtirb-pprinter-dev_2.2.5-focal_amd64.deb Size: 26842 MD5sum: 68e9f2e38a064c63d1a829d992797b5a SHA1: d5fb10898bbb5d3d32feac3b8d6d5df90688d298 SHA256: 4a004a31d80a3a4d0ae7a1c4b4b322244dcb1ab37d1c34e38b6c66b744b51608 SHA512: 1a90338c5cfb0c0d8a3ea0141b60fdb6ebf9262d115f4d8739a4ca5edbdff457005f0f7c16803b89e55bbb91d1e9f91e2cea44e13dfc91ac5b17b37695b062b6 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dev Priority: optional Section: devel Installed-Size: 137 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.4-focal Depends: libstdc++6, libc6, libgcc1, libgtirb-dev (=2.3.2-focal), libgtirb-pprinter (=2.2.4-focal), libboost-dev, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter-dev/libgtirb-pprinter-dev_2.2.4-focal_amd64.deb Size: 26636 MD5sum: f02b91fd60eed9d72f790982bd48fb8b SHA1: 6f8ced931e44849992d55aff6173283c3fda2f0a SHA256: def40bd3c46460001e349186558529c6e5c0d9d7b4deeaab96841829734bf555 SHA512: f8f560d4933262b8bb61f1ba79a9f573383caefb7c6887a34db0aeff36463ee41d25201f72f9c072c9e3a543202f27625a64fde36924008fe14370ad80471c48 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dev Priority: optional Section: devel Installed-Size: 137 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.3-focal Depends: libstdc++6, libc6, libgcc1, libgtirb-dev (=2.3.1-focal), libgtirb-pprinter (=2.2.3-focal), libboost-dev, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter-dev/libgtirb-pprinter-dev_2.2.3-focal_amd64.deb Size: 26630 MD5sum: ab83ba8add40ccdb834eee96f474abce SHA1: 2f6866c2da873fe697ec1745ca7d43dcbef1d740 SHA256: 8f587bc92a1694c4aac0dcfe3104834537565f36eacd59e00a7fbfca617a56f4 SHA512: aba67bcda12d934b3e705dd6555b03380fbe1cec25df5756ab763e0dc615428a4f738740b6cefcf4c89fe18a9199293304d8ca8e386375c51caf646902894d96 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dev Priority: optional Section: devel Installed-Size: 136 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.2-focal Depends: libstdc++6, libc6, libgcc1, libgtirb-dev (=2.3.1-focal), libgtirb-pprinter (=2.2.2-focal), libboost-dev, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter-dev/libgtirb-pprinter-dev_2.2.2-focal_amd64.deb Size: 26538 MD5sum: 011aae8c273334123831cdc7a75db0e0 SHA1: df68b2e529e26d46262505a5869e38451c4f3f25 SHA256: 7c55894569b2653ee58774d9bfbd6da41abe73b337e7db6f36f7562bb0cb1c7f SHA512: 4c0c707ebda1fe920444ac6b0bd30a7ff908186ed15ae5b0358459322cfcc9edba4aaaf2143300190840adaf5ba59ed985b72f928d7a139ebcd16b3ddd2658f7 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dev Priority: optional Section: devel Installed-Size: 136 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.1-focal Depends: libstdc++6, libc6, libgcc1, libgtirb-dev (=2.2.0-focal), libgtirb-pprinter (=2.2.1-focal), libboost-dev, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter-dev/libgtirb-pprinter-dev_2.2.1-focal_amd64.deb Size: 26538 MD5sum: 789fabd02be65cc12c3ce6bc2a0d1435 SHA1: 76f4d6460d6c2032a700685d4fe775d90ea16d6f SHA256: 834f33687d14424bd84b938519c8e3b420ba155792ba1e5969f8053e5042e62c SHA512: f15cdac66ae72aa387c95459f349404cc4e8a00bfbd8a617264166433da8282ae758a2b857d5ad72205f051aa3d0171693c543c4ba6f6d56ad08b6030c405aac Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dev Priority: optional Section: devel Installed-Size: 136 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.2.0-focal Depends: libstdc++6, libc6, libgcc1, libgtirb-dev (=2.1.0-focal), libgtirb-pprinter (=2.2.0-focal), libboost-dev, libcapstone-dev (=1:5.0.1-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter-dev/libgtirb-pprinter-dev_2.2.0-focal_amd64.deb Size: 26434 MD5sum: e5dbaa528288871705646d9acaf36a31 SHA1: 7395eb4a6ee25eac7b5c22aa1d875c3cf539558b SHA256: acf1988dc105f859ea011049edd9b01faf655d8b1fba4bec88941bbcac80b76a SHA512: b780d9115647a56e62150643e02a841f87ddef7834e22c3bf2639663c26697aba31f3aa3a0f0539ecca7d86013dc5c726d0d39a90ac37223536639b408f803b9 Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). We use our own fork https://github.com/GrammaTech/capstone/tree/v5 which at the moment is equivalent to the official release. * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | . Package: libgtirb-pprinter-dev Priority: optional Section: devel Installed-Size: 135 Maintainer: gtirb@grammatech.com Architecture: amd64 Version: 2.1.1-focal Depends: libstdc++6, libc6, libgcc1, libgtirb-dev (=2.0.1-focal), libgtirb-pprinter (=2.1.1-focal), libboost-dev, libcapstone-dev (=1:5.0.0-gtdev) Filename: pool/unstable/libg/libgtirb-pprinter-dev/libgtirb-pprinter-dev_2.1.1-focal_amd64.deb Size: 26308 MD5sum: e719bc4e0e346aa76269f4d79313b637 SHA1: 6806d83f3ad6d34ccac48e00844e050c4ded488d SHA256: 066a50c5599b1b3c5a2133ff88e8640465310396130f7a32467ccc6014a99d75 SHA512: 1aa8f352865e9399aff9c1c20c67f83320e6c3e76b1db7d7ff052a4e38fff474b872c893334580c3c593b13982a251c96236e6c7881e26c607588ff603088d7f Description: A pretty printer from the GTIRB intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. GTIRB Pretty Printer ==================== . A pretty printer from the [GTIRB](https://github.com/grammatech/gtirb) intermediate representation for binary analysis and reverse engineering to gas-syntax assembly code. . . ## Building . The pretty-printer uses C++17, and requires a compiler which supports that standard such as gcc 7, clang 6, or MSVC 2017. . To build and install the pretty printer, the following requirements should be installed: . * [GTIRB](https://github.com/grammatech/gtirb). * [Capstone](http://www.capstone-engine.org/). At the moment we require our own fork https://github.com/GrammaTech/capstone/tree/next that contains some additional fixes (until new official releases are cut). * [Boost](https://www.boost.org/), version 1.67.0 or later. * Requires the libraries: * filesystem * program_options * system . Note that these versions are newer than what your package manager may provide by default: This is true on Ubuntu 18, Debian 10, and others. Prefer building these dependencies from sources to avoid versioning problems. . Use the following options to configure cmake: - You can tell CMake which compiler to use with `-DCMAKE_CXX_COMPILER=<compiler>`. - Normally CMake will find GTIRB automatically, but if it does not you can pass `-Dgtirb_DIR=<path-to-gtirb-build>`. - gtirb-pprinter can make use of GTIRB in static library form (instead of shared library form, the default) if you use the flag `-DGTIRB_PPRINTER_BUILD_SHARED_LIBS=OFF`. - Furthermore, if you want to produce a `gtirb-pprinter` executable that links statically, specify `-DGTIRB_PPRINTER_STATIC_DRIVERS=ON`. - You can configure CMake to use a custom location for Capstone by specifying `-DCMAKE_LIBRARY_PATH=<path-to-capstone>`. - You can use vcpkg on Windows to provide some dependencies by passing `-DCMAKE_TOOLCHAIN_FILE=<path-to-vcpkg\scripts\buildsystems\vcpkg.cmake>`. . Once the dependencies are installed, you can configure and build as follows: . ```sh cmake ./ -Bbuild cd build make ``` . ## Installing See the [GTIRB readme](https://github.com/GrammaTech/gtirb/#installing). . ## Usage . ### Generate reassembleable assembly code Pretty print the GTIRB for a simple hello world executable to an assembly file named `hello.S`, assemble this file with the GNU assembler to an object file named `hello.o`, and link this object file into an executable. . ```sh gtirb-pprinter hello.gtirb --asm hello.S as hello.S -o hello.o ld hello.o -o hello ./hello ``` ### Generate a new binary The `--binary` flag to gtirb-pprinter generates a new binary by calling `gcc` directly. . ```sh gtirb-pprinter hello.gtirb --binary hello ``` . This option admits an argument `--library-paths` or `-L` to specify additional paths where libraries might be located. . For example: ```sh gtirb-pprinter hello.gtirb --binary hello -L . -L /usr/local/lib ``` . ### Dummy .so In some cases, it is desirable to rebuild a dynamically linked ELF executable without any of the libraries to which it is linked (e.g., if rebuilding an executable from another system). . Normally, the linker needs to have the libraries in order to link with them. However, the `--dummy-so` option generates fake libraries that contain the required symbols used by the binary, which is sufficient for running the linker. An example is shown: . ```sh gtirb-pprinter hello.gtirb --binary hello --dummy-so=yes ``` . ## AuxData Used by the Pretty Printer . Generating assembly depends on a number of additional pieces of information beyond the symbols and instruction/data bytes in the IR. The pretty printer expects this information to be available in a number of [AuxData](https://github.com/GrammaTech/gtirb/blob/master/README.md#auxiliary-data) objects stored with the IR. We document the expected keys along with the associated types and contents in this table. . | Key | Type | Purpose | |------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | comments | `std::map<gtirb::Offset, std::string>` | Per-instruction or data element comments. | | functionEntries | `std::map<gtirb::UUID, std::set<gtirb::UUID>>` | UUIDs of the blocks that are entry points of functions. | | symbolForwarding | `std::map<gtirb::UUID, gtirb::UUID>` | Map from symbols to other symbols. This table is used to forward symbols due to relocations or due to the use of plt and got tables. | | encodings | `std::map<gtirb::UUID,std::string>` | Map from (typed) data objects to the encoding of the data, expressed as a std::string containing an assembler encoding specifier: "string", "uleb128" or "sleb128". | | sectionProperties | `std::map<gtirb::UUID, std::tuple<uint64_t, uint64_t>>` | Map from section UUIDs to tuples with the section types and flags. | | cfiDirectives | `std::map<gtirb::Offset, std::vector<std::tuple<std::string, std::vector<int64_t>, gtirb::UUID>>>` | Map from Offsets to vector of cfi directives. A cfi directive contains: a string describing the directive, a vector of numeric arguments, and an optional symbolic argument (represented with the UUID of the symbol). | | elfSymbolInfo | `std::map<gtirb::UUID, std::tuple<uint64_t, std::string, std::string, std::string, uint64_t>>` | On ELF targets only: Map from symbols to their type, binding, and visibility categories. | . ## AuxData Used by the Binary Printer . In order to generate new binaries, gtirb-binary-printer also uses the following tables: . | Key | Type | Purpose | |------------------|----------------------------------|----------------------------------------------------------------------------------| | libraries | `std::vector<std::string>` | Names of the libraries that are needed. | | libraryPaths | `std::vector<std::string>` | Paths contained in the rpath of the binary | | elfStackExec | `bool` | Stack executable flag specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack,[no]execstack` | | elfStackSize | `uint64_t` | Stack size specified by PT_GNU_STACK segment in ELF files. Binary-printed with `-Wl,-z,stack-size=value`. | .