{"id":13684974,"url":"https://github.com/cea-sec/miasm","last_synced_at":"2025-05-12T13:30:48.432Z","repository":{"id":22534377,"uuid":"25875083","full_name":"cea-sec/miasm","owner":"cea-sec","description":"Reverse engineering framework in Python","archived":false,"fork":false,"pushed_at":"2025-01-26T14:51:44.000Z","size":17337,"stargazers_count":3646,"open_issues_count":171,"forks_count":476,"subscribers_count":140,"default_branch":"master","last_synced_at":"2025-04-23T17:12:25.756Z","etag":null,"topics":["assembler","disassembler","emulator","hacktoberfest","intermediate-representation","python","reverse-engineering","symbolic-execution"],"latest_commit_sha":null,"homepage":"https://miasm.re/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cea-sec.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2014-10-28T15:05:47.000Z","updated_at":"2025-04-18T21:19:12.000Z","dependencies_parsed_at":"2023-01-12T03:30:36.865Z","dependency_job_id":"2fd894bf-6d94-4ae6-8c65-ca05172fb76e","html_url":"https://github.com/cea-sec/miasm","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cea-sec%2Fmiasm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cea-sec%2Fmiasm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cea-sec%2Fmiasm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cea-sec%2Fmiasm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cea-sec","download_url":"https://codeload.github.com/cea-sec/miasm/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250477810,"owners_count":21437049,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["assembler","disassembler","emulator","hacktoberfest","intermediate-representation","python","reverse-engineering","symbolic-execution"],"created_at":"2024-08-02T14:00:41.529Z","updated_at":"2025-04-23T17:12:32.303Z","avatar_url":"https://github.com/cea-sec.png","language":"Python","readme":"[![Build Status](https://travis-ci.org/cea-sec/miasm.svg)](https://travis-ci.org/cea-sec/miasm)\n[![Build status](https://ci.appveyor.com/api/projects/status/g845jr23nt18uf29/branch/master?svg=true)](https://ci.appveyor.com/project/cea-sec/miasm)\n[![Miasm tests](https://github.com/cea-sec/miasm/actions/workflows/tests.yml/badge.svg?branch=master)](https://github.com/cea-sec/miasm/actions/workflows/tests.yml?branch=master)\n[![Code Climate](https://codeclimate.com/github/cea-sec/miasm/badges/gpa.svg)](https://codeclimate.com/github/cea-sec/miasm)\n[![Join the chat at https://gitter.im/cea-sec/miasm](https://badges.gitter.im/cea-sec/miasm.svg)](https://gitter.im/cea-sec/miasm?utm_source=badge\u0026utm_medium=badge\u0026utm_campaign=pr-badge\u0026utm_content=badge)\n\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"https://raw.githubusercontent.com/cea-sec/miasm/master/doc/logo_miasm.png\"\u003e\n\u003c/p\u003e\n\n\nWhat is Miasm?\n==============\n\nMiasm is a free and open source (GPLv2) reverse engineering framework.\nMiasm aims to analyze / modify / generate binary programs. Here is\na non exhaustive list of features:\n\n* Opening / modifying / generating PE / ELF 32 / 64 LE / BE\n* Assembling / Disassembling X86 / ARM / MIPS / SH4 / MSP430\n* Representing assembly semantic using intermediate language\n* Emulating using JIT (dynamic code analysis, unpacking, ...)\n* Expression simplification for automatic de-obfuscation\n* ...\n\nSee the official [blog](http://miasm.re) for more examples and demos.\n\nTable of Contents\n=================\n\n- [What is Miasm?](#user-content-what-is-miasm)\n- [Basic examples](#user-content-basic-examples)\n\t- [Assembling / Disassembling](#user-content-assembling--disassembling)\n\t- [Intermediate representation](#user-content-intermediate-representation)\n\t- [Emulation](#user-content-emulation)\n\t- [Symbolic execution](#user-content-symbolic-execution)\n- [How does it work?](#user-content-how-does-it-work)\n- [Documentation](#user-content-documentation)\n- [Obtaining Miasm](#user-content-obtaining-miasm)\n\t- [Software requirements](#user-content-software-requirements)\n\t- [Configuration](#user-content-configuration)\n\t- [Windows \u0026 IDA](#user-content-windows--ida)\n- [Testing](#user-content-testing)\n- [They already use Miasm](#user-content-they-already-use-miasm)\n- [Misc](#user-content-misc)\n\n\nBasic examples\n==============\n\nAssembling / Disassembling\n--------------------------\n\nImport Miasm x86 architecture:\n```pycon\n\u003e\u003e\u003e from miasm.arch.x86.arch import mn_x86\n\u003e\u003e\u003e from miasm.core.locationdb import LocationDB\n```\nGet a location db:\n\n```pycon\n\u003e\u003e\u003e loc_db = LocationDB()\n```\nAssemble a line:\n```pycon\n\u003e\u003e\u003e l = mn_x86.fromstring('XOR ECX, ECX', loc_db, 32)\n\u003e\u003e\u003e print(l)\nXOR        ECX, ECX\n\u003e\u003e\u003e mn_x86.asm(l)\n['1\\xc9', '3\\xc9', 'g1\\xc9', 'g3\\xc9']\n```\nModify an operand:\n```pycon\n\u003e\u003e\u003e l.args[0] = mn_x86.regs.EAX\n\u003e\u003e\u003e print(l)\nXOR        EAX, ECX\n\u003e\u003e\u003e a = mn_x86.asm(l)\n\u003e\u003e\u003e print(a)\n['1\\xc8', '3\\xc1', 'g1\\xc8', 'g3\\xc1']\n```\nDisassemble the result:\n```pycon\n\u003e\u003e\u003e print(mn_x86.dis(a[0], 32))\nXOR        EAX, ECX\n```\nUsing `Machine` abstraction:\n\n```pycon\n\u003e\u003e\u003e from miasm.analysis.machine import Machine\n\u003e\u003e\u003e mn = Machine('x86_32').mn\n\u003e\u003e\u003e print(mn.dis('\\x33\\x30', 32))\nXOR        ESI, DWORD PTR [EAX]\n```\n\nFor MIPS:\n```pycon\n\u003e\u003e\u003e mn = Machine('mips32b').mn\n\u003e\u003e\u003e print(mn.dis(b'\\x97\\xa3\\x00 ', \"b\"))\nLHU        V1, 0x20(SP)\n```\nIntermediate representation\n---------------------------\n\nCreate an instruction:\n\n```pycon\n\u003e\u003e\u003e machine = Machine('arml')\n\u003e\u003e\u003e instr = machine.mn.dis('\\x00 \\x88\\xe0', 'l')\n\u003e\u003e\u003e print(instr)\nADD        R2, R8, R0\n```\n\nCreate an intermediate representation object:\n```pycon\n\u003e\u003e\u003e lifter = machine.lifter_model_call(loc_db)\n```\nCreate an empty ircfg:\n```pycon\n\u003e\u003e\u003e ircfg = lifter.new_ircfg()\n```\nAdd instruction to the pool:\n```pycon\n\u003e\u003e\u003e lifter.add_instr_to_ircfg(instr, ircfg)\n```\n\nPrint current pool:\n```pycon\n\u003e\u003e\u003e for lbl, irblock in ircfg.blocks.items():\n...     print(irblock)\nloc_0:\nR2 = R8 + R0\n\nIRDst = loc_4\n\n```\nWorking with IR, for instance by getting side effects:\n```pycon\n\u003e\u003e\u003e for lbl, irblock in ircfg.blocks.items():\n...     for assignblk in irblock:\n...         rw = assignblk.get_rw()\n...         for dst, reads in rw.items():\n...             print('read:   ', [str(x) for x in reads])\n...             print('written:', dst)\n...             print()\n...\nread:    ['R8', 'R0']\nwritten: R2\n\nread:    []\nwritten: IRDst\n\n```\n\nMore information on Miasm IR is in the [corresponding Jupyter Notebook](https://github.com/cea-sec/miasm/blob/master/doc/expression/expression.ipynb).\n\nEmulation\n---------\n\nGiving a shellcode:\n```pycon\n00000000 8d4904      lea    ecx, [ecx+0x4]\n00000003 8d5b01      lea    ebx, [ebx+0x1]\n00000006 80f901      cmp    cl, 0x1\n00000009 7405        jz     0x10\n0000000b 8d5bff      lea    ebx, [ebx-1]\n0000000e eb03        jmp    0x13\n00000010 8d5b01      lea    ebx, [ebx+0x1]\n00000013 89d8        mov    eax, ebx\n00000015 c3          ret\n\u003e\u003e\u003e s = b'\\x8dI\\x04\\x8d[\\x01\\x80\\xf9\\x01t\\x05\\x8d[\\xff\\xeb\\x03\\x8d[\\x01\\x89\\xd8\\xc3'\n```\nImport the shellcode thanks to the `Container` abstraction:\n\n```pycon\n\u003e\u003e\u003e from miasm.analysis.binary import Container\n\u003e\u003e\u003e c = Container.from_string(s, loc_db)\n\u003e\u003e\u003e c\n\u003cmiasm.analysis.binary.ContainerUnknown object at 0x7f34cefe6090\u003e\n```\n\nDisassembling the shellcode at address `0`:\n\n```pycon\n\u003e\u003e\u003e from miasm.analysis.machine import Machine\n\u003e\u003e\u003e machine = Machine('x86_32')\n\u003e\u003e\u003e mdis = machine.dis_engine(c.bin_stream, loc_db=loc_db)\n\u003e\u003e\u003e asmcfg = mdis.dis_multiblock(0)\n\u003e\u003e\u003e for block in asmcfg.blocks:\n...  print(block)\n...\nloc_0\nLEA        ECX, DWORD PTR [ECX + 0x4]\nLEA        EBX, DWORD PTR [EBX + 0x1]\nCMP        CL, 0x1\nJZ         loc_10\n-\u003e      c_next:loc_b    c_to:loc_10\nloc_10\nLEA        EBX, DWORD PTR [EBX + 0x1]\n-\u003e      c_next:loc_13\nloc_b\nLEA        EBX, DWORD PTR [EBX + 0xFFFFFFFF]\nJMP        loc_13\n-\u003e      c_to:loc_13\nloc_13\nMOV        EAX, EBX\nRET\n```\n\nInitializing the JIT engine with a stack:\n\n```pycon\n\u003e\u003e\u003e jitter = machine.jitter(loc_db, jit_type='python')\n\u003e\u003e\u003e jitter.init_stack()\n```\n\nAdd the shellcode in an arbitrary memory location:\n```pycon\n\u003e\u003e\u003e run_addr = 0x40000000\n\u003e\u003e\u003e from miasm.jitter.csts import PAGE_READ, PAGE_WRITE\n\u003e\u003e\u003e jitter.vm.add_memory_page(run_addr, PAGE_READ | PAGE_WRITE, s)\n```\n\nCreate a sentinelle to catch the return of the shellcode:\n\n```Python\ndef code_sentinelle(jitter):\n    jitter.running = False\n    jitter.pc = 0\n    return True\n\n\u003e\u003e\u003e jitter.add_breakpoint(0x1337beef, code_sentinelle)\n\u003e\u003e\u003e jitter.push_uint32_t(0x1337beef)\n```\n\nActive logs:\n\n```pycon\n\u003e\u003e\u003e jitter.set_trace_log()\n```\n\nRun at arbitrary address:\n\n```pycon\n\u003e\u003e\u003e jitter.init_run(run_addr)\n\u003e\u003e\u003e jitter.continue_run()\nRAX 0000000000000000 RBX 0000000000000000 RCX 0000000000000000 RDX 0000000000000000\nRSI 0000000000000000 RDI 0000000000000000 RSP 000000000123FFF8 RBP 0000000000000000\nzf 0000000000000000 nf 0000000000000000 of 0000000000000000 cf 0000000000000000\nRIP 0000000040000000\n40000000 LEA        ECX, DWORD PTR [ECX+0x4]\nRAX 0000000000000000 RBX 0000000000000000 RCX 0000000000000004 RDX 0000000000000000\nRSI 0000000000000000 RDI 0000000000000000 RSP 000000000123FFF8 RBP 0000000000000000\nzf 0000000000000000 nf 0000000000000000 of 0000000000000000 cf 0000000000000000\n....\n4000000e JMP        loc_0000000040000013:0x40000013\nRAX 0000000000000000 RBX 0000000000000000 RCX 0000000000000004 RDX 0000000000000000\nRSI 0000000000000000 RDI 0000000000000000 RSP 000000000123FFF8 RBP 0000000000000000\nzf 0000000000000000 nf 0000000000000000 of 0000000000000000 cf 0000000000000000\nRIP 0000000040000013\n40000013 MOV        EAX, EBX\nRAX 0000000000000000 RBX 0000000000000000 RCX 0000000000000004 RDX 0000000000000000\nRSI 0000000000000000 RDI 0000000000000000 RSP 000000000123FFF8 RBP 0000000000000000\nzf 0000000000000000 nf 0000000000000000 of 0000000000000000 cf 0000000000000000\nRIP 0000000040000013\n40000015 RET\n\u003e\u003e\u003e\n\n```\n\nInteracting with the jitter:\n\n```pycon\n\u003e\u003e\u003e jitter.vm\nad 1230000 size 10000 RW_ hpad 0x2854b40\nad 40000000 size 16 RW_ hpad 0x25e0ed0\n\n\u003e\u003e\u003e hex(jitter.cpu.EAX)\n'0x0L'\n\u003e\u003e\u003e jitter.cpu.ESI = 12\n```\n\nSymbolic execution\n------------------\n\nInitializing the IR pool:\n\n```pycon\n\u003e\u003e\u003e lifter = machine.lifter_model_call(loc_db)\n\u003e\u003e\u003e ircfg = lifter.new_ircfg_from_asmcfg(asmcfg)\n```\n\nInitializing the engine with default symbolic values:\n\n```pycon\n\u003e\u003e\u003e from miasm.ir.symbexec import SymbolicExecutionEngine\n\u003e\u003e\u003e sb = SymbolicExecutionEngine(lifter)\n```\n\nLaunching the execution:\n\n```pycon\n\u003e\u003e\u003e symbolic_pc = sb.run_at(ircfg, 0)\n\u003e\u003e\u003e print(symbolic_pc)\n((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)\n```\n\nSame, with step logs (only changes are displayed):\n\n```pycon\n\u003e\u003e\u003e sb = SymbolicExecutionEngine(lifter, machine.mn.regs.regs_init)\n\u003e\u003e\u003e symbolic_pc = sb.run_at(ircfg, 0, step=True)\nInstr LEA        ECX, DWORD PTR [ECX + 0x4]\nAssignblk:\nECX = ECX + 0x4\n________________________________________________________________________________\nECX                = ECX + 0x4\n________________________________________________________________________________\nInstr LEA        EBX, DWORD PTR [EBX + 0x1]\nAssignblk:\nEBX = EBX + 0x1\n________________________________________________________________________________\nEBX                = EBX + 0x1\nECX                = ECX + 0x4\n________________________________________________________________________________\nInstr CMP        CL, 0x1\nAssignblk:\nzf = (ECX[0:8] + -0x1)?(0x0,0x1)\nnf = (ECX[0:8] + -0x1)[7:8]\npf = parity((ECX[0:8] + -0x1) \u0026 0xFF)\nof = ((ECX[0:8] ^ (ECX[0:8] + -0x1)) \u0026 (ECX[0:8] ^ 0x1))[7:8]\ncf = (((ECX[0:8] ^ 0x1) ^ (ECX[0:8] + -0x1)) ^ ((ECX[0:8] ^ (ECX[0:8] + -0x1)) \u0026 (ECX[0:8] ^ 0x1)))[7:8]\naf = ((ECX[0:8] ^ 0x1) ^ (ECX[0:8] + -0x1))[4:5]\n________________________________________________________________________________\naf                 = (((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[4:5]\npf                 = parity((ECX + 0x4)[0:8] + 0xFF)\nzf                 = ((ECX + 0x4)[0:8] + 0xFF)?(0x0,0x1)\nECX                = ECX + 0x4\nof                 = ((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) \u0026 ((ECX + 0x4)[0:8] ^ 0x1))[7:8]\nnf                 = ((ECX + 0x4)[0:8] + 0xFF)[7:8]\ncf                 = (((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) \u0026 ((ECX + 0x4)[0:8] ^ 0x1)) ^ ((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[7:8]\nEBX                = EBX + 0x1\n________________________________________________________________________________\nInstr JZ         loc_key_1\nAssignblk:\nIRDst = zf?(loc_key_1,loc_key_2)\nEIP = zf?(loc_key_1,loc_key_2)\n________________________________________________________________________________\naf                 = (((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[4:5]\nEIP                = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)\npf                 = parity((ECX + 0x4)[0:8] + 0xFF)\nIRDst              = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)\nzf                 = ((ECX + 0x4)[0:8] + 0xFF)?(0x0,0x1)\nECX                = ECX + 0x4\nof                 = ((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) \u0026 ((ECX + 0x4)[0:8] ^ 0x1))[7:8]\nnf                 = ((ECX + 0x4)[0:8] + 0xFF)[7:8]\ncf                 = (((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) \u0026 ((ECX + 0x4)[0:8] ^ 0x1)) ^ ((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[7:8]\nEBX                = EBX + 0x1\n________________________________________________________________________________\n\u003e\u003e\u003e\n```\n\n\nRetry execution with a concrete ECX. Here, the symbolic / concolic execution reach the shellcode's end:\n\n```pycon\n\u003e\u003e\u003e from miasm.expression.expression import ExprInt\n\u003e\u003e\u003e sb.symbols[machine.mn.regs.ECX] = ExprInt(-3, 32)\n\u003e\u003e\u003e symbolic_pc = sb.run_at(ircfg, 0, step=True)\nInstr LEA        ECX, DWORD PTR [ECX + 0x4]\nAssignblk:\nECX = ECX + 0x4\n________________________________________________________________________________\naf                 = (((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[4:5]\nEIP                = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)\npf                 = parity((ECX + 0x4)[0:8] + 0xFF)\nIRDst              = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)\nzf                 = ((ECX + 0x4)[0:8] + 0xFF)?(0x0,0x1)\nECX                = 0x1\nof                 = ((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) \u0026 ((ECX + 0x4)[0:8] ^ 0x1))[7:8]\nnf                 = ((ECX + 0x4)[0:8] + 0xFF)[7:8]\ncf                 = (((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) \u0026 ((ECX + 0x4)[0:8] ^ 0x1)) ^ ((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[7:8]\nEBX                = EBX + 0x1\n________________________________________________________________________________\nInstr LEA        EBX, DWORD PTR [EBX + 0x1]\nAssignblk:\nEBX = EBX + 0x1\n________________________________________________________________________________\naf                 = (((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[4:5]\nEIP                = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)\npf                 = parity((ECX + 0x4)[0:8] + 0xFF)\nIRDst              = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)\nzf                 = ((ECX + 0x4)[0:8] + 0xFF)?(0x0,0x1)\nECX                = 0x1\nof                 = ((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) \u0026 ((ECX + 0x4)[0:8] ^ 0x1))[7:8]\nnf                 = ((ECX + 0x4)[0:8] + 0xFF)[7:8]\ncf                 = (((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) \u0026 ((ECX + 0x4)[0:8] ^ 0x1)) ^ ((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[7:8]\nEBX                = EBX + 0x2\n________________________________________________________________________________\nInstr CMP        CL, 0x1\nAssignblk:\nzf = (ECX[0:8] + -0x1)?(0x0,0x1)\nnf = (ECX[0:8] + -0x1)[7:8]\npf = parity((ECX[0:8] + -0x1) \u0026 0xFF)\nof = ((ECX[0:8] ^ (ECX[0:8] + -0x1)) \u0026 (ECX[0:8] ^ 0x1))[7:8]\ncf = (((ECX[0:8] ^ 0x1) ^ (ECX[0:8] + -0x1)) ^ ((ECX[0:8] ^ (ECX[0:8] + -0x1)) \u0026 (ECX[0:8] ^ 0x1)))[7:8]\naf = ((ECX[0:8] ^ 0x1) ^ (ECX[0:8] + -0x1))[4:5]\n________________________________________________________________________________\naf                 = 0x0\nEIP                = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)\npf                 = 0x1\nIRDst              = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)\nzf                 = 0x1\nECX                = 0x1\nof                 = 0x0\nnf                 = 0x0\ncf                 = 0x0\nEBX                = EBX + 0x2\n________________________________________________________________________________\nInstr JZ         loc_key_1\nAssignblk:\nIRDst = zf?(loc_key_1,loc_key_2)\nEIP = zf?(loc_key_1,loc_key_2)\n________________________________________________________________________________\naf                 = 0x0\nEIP                = 0x10\npf                 = 0x1\nIRDst              = 0x10\nzf                 = 0x1\nECX                = 0x1\nof                 = 0x0\nnf                 = 0x0\ncf                 = 0x0\nEBX                = EBX + 0x2\n________________________________________________________________________________\nInstr LEA        EBX, DWORD PTR [EBX + 0x1]\nAssignblk:\nEBX = EBX + 0x1\n________________________________________________________________________________\naf                 = 0x0\nEIP                = 0x10\npf                 = 0x1\nIRDst              = 0x10\nzf                 = 0x1\nECX                = 0x1\nof                 = 0x0\nnf                 = 0x0\ncf                 = 0x0\nEBX                = EBX + 0x3\n________________________________________________________________________________\nInstr LEA        EBX, DWORD PTR [EBX + 0x1]\nAssignblk:\nIRDst = loc_key_3\n________________________________________________________________________________\naf                 = 0x0\nEIP                = 0x10\npf                 = 0x1\nIRDst              = 0x13\nzf                 = 0x1\nECX                = 0x1\nof                 = 0x0\nnf                 = 0x0\ncf                 = 0x0\nEBX                = EBX + 0x3\n________________________________________________________________________________\nInstr MOV        EAX, EBX\nAssignblk:\nEAX = EBX\n________________________________________________________________________________\naf                 = 0x0\nEIP                = 0x10\npf                 = 0x1\nIRDst              = 0x13\nzf                 = 0x1\nECX                = 0x1\nof                 = 0x0\nnf                 = 0x0\ncf                 = 0x0\nEBX                = EBX + 0x3\nEAX                = EBX + 0x3\n________________________________________________________________________________\nInstr RET\nAssignblk:\nIRDst = @32[ESP[0:32]]\nESP = {ESP[0:32] + 0x4 0 32}\nEIP = @32[ESP[0:32]]\n________________________________________________________________________________\naf                 = 0x0\nEIP                = @32[ESP]\npf                 = 0x1\nIRDst              = @32[ESP]\nzf                 = 0x1\nECX                = 0x1\nof                 = 0x0\nnf                 = 0x0\ncf                 = 0x0\nEBX                = EBX + 0x3\nESP                = ESP + 0x4\nEAX                = EBX + 0x3\n________________________________________________________________________________\n\u003e\u003e\u003e\n```\n\n\n\nHow does it work?\n=================\n\nMiasm embeds its own disassembler, intermediate language and\ninstruction semantic. It is written in Python.\n\nTo emulate code, it uses LLVM, GCC, Clang or Python to JIT the\nintermediate representation. It can emulate shellcodes and all or parts of\nbinaries. Python callbacks can be executed to interact with the execution, for\ninstance to emulate library functions effects.\n\nDocumentation\n=============\n\nSome documentation ressources are available in the [doc](doc) folder.\n\nAn auto-generated documentation is available:\n* [Doxygen](http://miasm.re/miasm_doxygen)\n* [pdoc](http://miasm.re/miasm_pdoc)\n\nObtaining Miasm\n===============\n\n* Clone the repository: [Miasm on GitHub](https://github.com/cea-sec/miasm/)\n* Get one of the Docker images at [Docker Hub](https://registry.hub.docker.com/u/miasm/)\n\nSoftware requirements\n---------------------\n\nMiasm uses:\n\n* python-pyparsing\n* python-dev\n* optionally python-pycparser (version \u003e= 2.17)\n\nTo enable code JIT, one of the following module is mandatory:\n* GCC\n* Clang\n* LLVM with Numba llvmlite, see below\n\n'optional' Miasm can also use:\n* Z3, the [Theorem Prover](https://github.com/Z3Prover/z3)\n\nConfiguration\n-------------\n\nTo use the jitter, GCC or LLVM is recommended\n* GCC (any version)\n* Clang (any version)\n* LLVM\n  * Debian (testing/unstable): Not tested\n  * Debian stable/Ubuntu/Kali/whatever: `pip install llvmlite` or install from [llvmlite](https://github.com/numba/llvmlite)\n  * Windows: Not tested\n* Build and install Miasm:\n```pycon\n$ cd miasm_directory\n$ python setup.py build\n$ sudo python setup.py install\n```\n\nIf something goes wrong during one of the jitter modules compilation, Miasm will\nskip the error and disable the corresponding module (see the compilation\noutput).\n\nWindows \u0026 IDA\n-------------\n\nMost of Miasm's IDA plugins use a subset of Miasm functionality.\nA quick way to have them working is to add:\n* `pyparsing.py` to `C:\\...\\IDA\\python\\` or `pip install pyparsing`\n* `miasm/miasm` directory to `C:\\...\\IDA\\python\\`\n\nAll features excepting JITter related ones will be available. For a more complete installation, please refer to above paragraphs.\n\nTesting\n=======\n\nMiasm comes with a set of regression tests. To run all of them:\n\n```pycon\ncd miasm_directory/test\n\n# Run tests using our own test runner\npython test_all.py\n\n# Run tests using standard frameworks (slower, require 'parameterized')\npython -m unittest test_all.py        # sequential, requires 'unittest'\npython -m pytest test_all.py          # sequential, requires 'pytest'\npython -m pytest -n auto test_all.py  # parallel, requires 'pytest' and 'pytest-xdist'\n```\n\nSome options can be specified:\n\n* Mono threading: `-m`\n* Code coverage instrumentation: `-c`\n* Only fast tests: `-t long` (excludes the long tests)\n\nThey already use Miasm\n======================\n\nTools\n-----\n\n* [Sibyl](https://github.com/cea-sec/Sibyl): A function divination tool\n* [R2M2](https://github.com/guedou/r2m2): Use miasm as a radare2 plugin\n* [CGrex](https://github.com/mechaphish/cgrex): Targeted patcher for CGC binaries\n* [ethRE](https://github.com/jbcayrou/ethRE): Reversing tool for Ethereum EVM (with corresponding Miasm2 architecture)\n\nBlog posts / papers / conferences\n---------------------------------\n\n* [Deobfuscation: recovering an OLLVM-protected program](http://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html)\n* [Taming a Wild Nanomite-protected MIPS Binary With Symbolic Execution: No Such Crackme](https://doar-e.github.io/blog/2014/10/11/taiming-a-wild-nanomite-protected-mips-binary-with-symbolic-execution-no-such-crackme/)\n* [Génération rapide de DGA avec Miasm](https://www.lexsi.com/securityhub/generation-rapide-de-dga-avec-miasm/): Quick computation of DGA (French article)\n* [Enabling Client-Side Crash-Resistance to Overcome Diversification and Information Hiding](https://www.internetsociety.org/sites/default/files/blogs-media/enabling-client-side-crash-resistance-overcome-diversification-information-hiding.pdf): Detect undirected call potential arguments\n* [Miasm: Framework de reverse engineering](https://www.sstic.org/2012/presentation/miasm_framework_de_reverse_engineering/) (French)\n* [Tutorial miasm](https://www.sstic.org/2014/presentation/Tutorial_miasm/) (French video)\n* [Graphes de dépendances : Petit Poucet style](https://www.sstic.org/2016/presentation/graphes_de_dpendances__petit_poucet_style/): DepGraph (French)\n\nBooks\n-----\n\n* [Practical Reverse Engineering: X86, X64, Arm, Windows Kernel, Reversing Tools, and Obfuscation](http://eu.wiley.com/WileyCDA/WileyTitle/productCd-1118787315,subjectCd-CSJ0.html): Introduction to Miasm (Chapter 5 \"Obfuscation\")\n* [BlackHat Python - Appendix](https://github.com/oreilly-japan/black-hat-python-jp-support/tree/master/appendix-A): Japan security book's samples\n","funding_links":[],"categories":["Reversing","Reverse Engine","Disassemblers","Python","Project","Tools","Reverse Engineering"],"sub_categories":["Program Analysis","Binaries","Malware Articles and Sources"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcea-sec%2Fmiasm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcea-sec%2Fmiasm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcea-sec%2Fmiasm/lists"}