The METASM assembly manipulation suite

Some news

Take a look at the updates to the repository for more

About METASM

Metasm is a cross-architecture assembler, disassembler, compiler, linker and debugger.

It has some advanced features such as live process manipulation, GCC/Microsoft Visual Studio-compatible preprocessor, automatic backtracking in the disassembler (similar to "slicing"), C headers shrinking, linux/windows/remote debugging API interface, a C compiler/decompiler, a gdb-server compatible debugger, and various advanced features. It is written in pure Ruby, with no dependency.

Metasm has been written in such a way that it is easy to add a new architecture. For now, the following architectures are supported:

The following file formats are supported:

Metasm GUI screenshot Metasm Lindebug Metasm Debugger

This tool was mainly developed from 2006 to Sept. 2008 at France Telecom R&D. Starting from Oct. 2008, Yoann Guillot will continue development at Sogeti/ESEC.

Metasm has been integrated into Metasploit, however the Metasploit trunk is not necessarily synced with the latest version.

Yoann GUILLOT (Developer) and Julien TINNES (Sales ;) (The 'contact' link on the left is the prefered way to contact us.)

You can also get in touch in the #metasm channel on the Freenode IRC network.

Documentation

The README documents most stable features.

The samples directory holds a bunch of scripts which demonstrate the use of more or less advanced features (read the comments at the beginning of each file.)

However, the source is the most complete doc available ;)

A beginning of actual documentation (work in progress)(progressing slowly :P)

A few publications on the framework:

Get Metasm

The current developement snapshot is no longer available as a zip file.

To download metasm, you should use mercurial and clone the testing repository:
hg clone https://code.google.com/p/metasm/

Afterwards you can keep in sync with the latest version by using
hg pull -u

You can also download metasm v0.1 here (completely obsolete - kept only for archeological purposes).