Reassembleable Disassembling

Reverse engineering has many important applications in computer security, one of which is retrofitting software for safety and security hardening when source code is not available. By surveying available commercial and aca-demic reverse engineering tools, we surprisingly found that no existing tool is able to disassemble executable binaries into assembly code that can be correctly assem-bled back in a fully automated manner, even for simple programs. Actually in many cases, the resulted disas-sembled code is far from a state that an assembler ac-cepts, which is hard to fix even by manual effort. This has become a severe obstacle. People have tried to over-come it by patching or duplicating new code sections for retrofitting of executables, which is not only inefficient but also cumbersome and restrictive on what retrofitting techniques can be applied to. In this paper, we present UROBOROS, a tool that can disassemble executables to the extent that the gener-ated code can be assembled back to working binaries without manual effort. By empirically studying 244 binaries, we summarize a set of rules that can make the disassembled code relocatable, which is the key to reassembleable disassembling. With UROBOROS, the disassembly-reassembly process can be repeated thou-sands of times. We have implemented a prototype of UROBOROS and tested over the whole set of GNU Core-utils, SPEC2006, and a set of other real-world applica-tion and server programs. The experiment results show that our tool is effective with a very modest cost.