Disassembler

Programs are written by humans in a programming language, that is, in text that can be read. Before a computer runs them, they are usually translated into pure numbers. This numeric form is understood by the processor, the computing chip in the device, but not by any human. A disassembler reverses this step to some degree: it reads the numbers and writes them out as a list of individual instructions, such as “add”, “compare” or “jump”. This instruction list is called assembly code. It is still very technical, but fundamentally readable.

What you can extract from someone else’s program code

With a great many programs, you only get the finished file, not the written text behind it. Nobody ships Windows, games, or the software in a car as readable source code. Anyone who still wants to know exactly what such a program does only has the numbers. A disassembler is then the first step toward an answer.

The most important field of application is IT security. When a virus is found on a computer, no manual exists for it. Experts take the file apart to see which files it alters and which server it communicates with. Only from this does a protective rule for antivirus scanners emerge.

But there are also more harmless reasons. Companies use this to check whether a supplier really delivered what was agreed in the contract. And old software whose source code has been lost for decades can be repaired or ported to new devices this way.

From a stream of numbers to a list of instructions

Every type of processor has a fixed catalog of instructions. Each instruction is assigned a specific number. The disassembler knows this catalog and looks numbers up in it. It reads the file from beginning to end, recognizes a number as an instruction, and substitutes an abbreviation for it such as “MOV” or “JMP”. It then continues reading from the point where the next instruction begins.

That sounds simpler than it is. The same file also contains data, such as text or images, and these likewise look like nothing but numbers. If the tool starts reading at the wrong point, meaningless nonsense results that nevertheless looks like program code. Good disassemblers therefore follow the program’s actual flow of execution rather than simply guessing from top to bottom.

One important distinction: a decompiler tries to produce something from the same file that again looks like the original programming language. This is more comfortable to read, but less accurate. The disassembler stays close to what the processor actually executes. In both cases, the names of variables and all of the programmer’s comments are lost, since these never appear in the finished file.

Tools, points of contention, and AI assistance

Well-known programs of this kind are Ghidra, which the US intelligence agency NSA released, as well as IDA Pro and the free Radare2. Ghidra is free of charge and is used at universities and in security firms. Such tools show up in the news when a major piece of malware has been analyzed or when someone has found a security vulnerability in a widely used device.

The topic is also present legally. Disassembling someone else’s software is permitted in Germany only within narrow limits, for instance to make one’s own program compatible. Many license agreements additionally prohibit it. Exceptions exist for security research, and these are repeatedly disputed.

What is new is the combination with language models, that is, AI systems that generate text. They are presented with the instruction list and formulate a guess as to what the section does. This saves time but is not reliable. The models occasionally invent plausible-sounding explanations that are simply wrong. Verification therefore remains a task for humans.