Miasm is a reverse engineering framework in Python that enables analysis, modification, and generation of binary programs.
The framework addresses the need to understand and manipulate compiled code by providing integrated tools for working with binaries at multiple levels of abstraction. It embeds its own disassembler, intermediate language representation, and instruction semantics. The approach works by allowing developers to assemble and disassemble multiple architectures, convert assembly to an intermediate representation that captures instruction semantics, emulate code using JIT compilation with LLVM, GCC, Clang, or Python, and perform symbolic execution to reason about program behavior. Expression simplification enables automatic de-obfuscation of code.
Miasm suits security researchers, malware analysts, and reverse engineers who need programmatic control over binary analysis tasks. It works well for dynamic code analysis, unpacking, and understanding obfuscated binaries. The framework supports PE and ELF binaries in 32 and 64-bit formats with both little and big endian variants, and handles multiple instruction set architectures including X86, ARM, MIPS, SH4, and MSP430. Python callbacks allow interaction with the emulation engine to simulate library function effects or implement custom analysis logic.
The project maintains active development with regular contributions addressing core functionality and architecture support. The codebase shows consistent refinement of the intermediate representation system and emulation capabilities. Testing infrastructure is established and maintained to ensure reliability across supported architectures and binary formats. Documentation is actively curated with Jupyter notebooks demonstrating practical usage patterns alongside auto-generated API references.
