METASM - Assembly Manipulation Suite

Metasm is a cross-architecture assembler, disassembler, compiler, linker and debugger. It is written in pure Ruby.

It has some advanced features such as remote process manipulation, GCC-compatible preprocessor, automatic backtracking in the disassembler ("slicing"), C headers shrinking, linux/windows debugging API interface, a C compiler, a gdb-server compatible debugger, and various advanced features.

Metasm has been integrated into Metasploit, however the Metasploit trunk is not necessarily synced with the latest version.

JPEG - 13 kb

Metasm has been written in such a way that it is easy to add a new architecture.

Architectures:

  • Intel IA32 (16/32/64bits)
  • MIPS
  • PPC
  • Maybe later:
    • ARM
    • Cell
    • SPARC

File formats:

  • Raw (for shellcodes)
  • MZ, PE/COFF (32 and 64 bits)
  • ELF (32 and 64 bits)
  • Mach-O (incomplete) and UniversalBinary
  • a few other (a.out, xcoff, nds)

More Information:

Post scriptum

  • To download metasm, you should use mercurial and clone the testing repository:
    hg clone https://metasm.cr0.org/hg/metasm

Compliance Mandates

  • Code Auditing :

    PCI/DSS 6.3.6, 6.3.7, 6.6, SOX A12.8, GLBA 16CFR Part 314.4(b) and (2);FISMA RA-5, SC-18, SA-11 SI-2, and ISO 27001/27002 (12.4.1, 12.4.3, 12.5)


Comments

Related Articles

Code Auditing
METASM