Disassembly
Definition
The process of converting raw binary machine code back into human-readable assembly language instructions. Disassembly is always achievable from a binary, unlike decompilation, but requires the analyst to understand assembly mnemonics and calling conventions for the target architecture.
- Converts
- Machine code to assembly language
- Reliability
- Always achievable from a binary
- Contrast
- Decompilation, not always achievable
- Field
- Static malware analysis
Common questions
Why is disassembly always possible while decompilation is not?+
Disassembly is a mechanical, one-to-one mapping of machine opcodes to their assembly mnemonics, whereas decompilation tries to reconstruct higher-level source-like constructs (loops, variables, types) that are not always recoverable, especially from optimised or obfuscated binaries.
What skills does reading a disassembly listing require that decompiled output does not?+
The analyst needs to track register usage, stack frames, and the calling convention of the target architecture directly, since assembly does not label variables or control-flow structures the way decompiled pseudocode does.
Related terms
- Cryptographic Hash
- A fixed-length digest produced from a file's bytes by an algorithm such as MD5 (128-bit), SHA-1 (160-bit), or SHA-256 (256-bit). Identical files...
- Import Address Table (IAT)
- A section of the PE header that lists every external DLL and the functions the executable calls from each. A malware sample's...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- Packer / Packing
- A technique in which the original malware code is compressed or encrypted and wrapped in a stub loader that decompresses or decrypts...
- Portable Executable (PE)
- The binary file format used by Windows executables (.exe), dynamic-link libraries (.dll), and drivers (.sys). The PE header contains a structured metadata...