# Writing disassembler in Ruby

**URL:** <https://www.ruby-forum.com/t/writing-disassembler-in-ruby/76289>\
**Category:** Ruby\
**Created:** [November 17, 2006, 10:51am UTC](https://www.ruby-forum.com/t/writing-disassembler-in-ruby/76289 "2006-11-17T10:51:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bigos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/f4b2a3/32.png) [@bigos](https://www.ruby-forum.com/u/bigos)\
**Post date:** [November 17, 2006, 10:51am UTC](https://www.ruby-forum.com/t/writing-disassembler-in-ruby/76289/1 "2006-11-17T10:51:35Z")

</div>

Hi,

This is my first post here.

I am interested in writing a disassembler using Ruby.

I have attached little example of my experiments with Ruby and ndisasm.

Please comment on the code usefulness of it etc.

do you know of any disassembler written in Ruby?

Jacek

---

<div class="post-metadata">

**Author:** ![bigos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/f4b2a3/32.png) [@bigos](https://www.ruby-forum.com/u/bigos)\
**Post date:** [November 17, 2006, 11:17am UTC](https://www.ruby-forum.com/t/writing-disassembler-in-ruby/76289/2 "2006-11-17T11:17:36Z")

</div>

On 11/17/06, Jacek P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> do you know of any disassembler written in Ruby?  
> Hello,

I don’t know any (x86 assembly is so ugly and complex that most people  
would rather reuse existing disassembler), but disassemblers output  
plain text,  
and text can be very easily processed by Ruby.

I even did so just a few days ago to extract compiled methods from  
CMUCL-generated image file for some benchmarking reasons 😉  
If you’re interested, here’s extract from my .bash\_history:

$ ndisasm -a -b 32 image-cl.x86f \>l-da  
$ cat l-da | ruby -nle ‘i=$\_[28…-1]; next unless i =~  
/\A(?:call|j\S+|jmp short) 0x(\S+)\Z/; $x||=[]; a=“0” \* (4-$1.size) +  
$1; $x \<\< a; END {puts $x.sort.uniq}’ \>l-addresses  
$ ruby -e ‘ja={};  
File.readlines(“l-addresses”).map{|a|ja[a.chomp.upcase]=true};  
STDIN.each{|line| if !ja[line[4,4]] then line[4,4] = " " else  
line[8,1] = “:” end; line[0,4]=“”; puts line }’ l-da2  
$ ruby -e ‘File.read(“l-da2”).scan(/^[^\n]_pop dword._?jmp  
ecx[^\n]\*$/m) { puts $&; puts “”}’ \>l-da3

Anyway, I think it’s best to do something like what you did in deas.rb

- taking input  
from some preexisting disassembler like ndisasm (or objdump which  
understand  
many binary formats), and then processing it with Ruby.

---

<div class="post-metadata">

**Author:** ![bigos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/f4b2a3/32.png) [@bigos](https://www.ruby-forum.com/u/bigos)\
**Post date:** [November 20, 2006, 2:47pm UTC](https://www.ruby-forum.com/t/writing-disassembler-in-ruby/76289/3 "2006-11-20T14:47:05Z")

</div>

On Fri, Nov 17, 2006 at 07:51:17PM +0900, Bruno M. wrote:

> >

Hi

I’m the developper of Metasm (which is a standalone full ruby lib).  
It’s not yet functionnal, but it’s currently under heavy developpement  
and I expect make a working release soon.

---

<div class="post-metadata">

**Author:** ![bigos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/f4b2a3/32.png) [@bigos](https://www.ruby-forum.com/u/bigos)\
**Post date:** [November 17, 2006, 11:51am UTC](https://www.ruby-forum.com/t/writing-disassembler-in-ruby/76289/4 "2006-11-17T11:51:38Z")

</div>

On 11/17/06, Jacek P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> do you know of any disassembler written in Ruby?  
> Hello,

I think you should take a look at metasploit. In particular, there is a  
plugin, metasm, which can interrest you. I don’t known if it is beta  
software, or if it has been integrated to metasploit.

---

<div class="post-metadata">

**Author:** ![bigos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/f4b2a3/32.png) [@bigos](https://www.ruby-forum.com/u/bigos)\
**Post date:** [November 21, 2006, 4:11pm UTC](https://www.ruby-forum.com/t/writing-disassembler-in-ruby/76289/5 "2006-11-21T16:11:26Z")

</div>

Thanks for the info. I’ll be happy to have a chance to play with it one  
day.