Reverse-Engineering Instruction Encodings (2001)

A closer look at Reverse-Engineering Instruction Encodings (2001)

What this paper presents

This is a conference paper describing DERIVE, a tool that reverse-engineers bit-level instruction encodings from assemblers. The paper explains how DERIVE feeds permutations of assembly instructions to the system assembler, analyzes the resulting machine code, and solves equations to determine opcode and operand encodings.

The authors report that DERIVE can solve the entire MIPS, SPARC, Alpha, and PowerPC instruction sets, and most of ARM and x86 (except some instructions with non-continuous fields).

What you can actually get from DERIVE

DERIVE outputs C structure declarations that describe instruction encodings; these can be used by binary tools that interpret or manipulate machine code.

The authors used DERIVE’s output with a code emitter generator that produced C macros for fast code emission and applied those to rewrite a Java JIT backend (Kaffe), reducing the backend description size by 40%.

Who will find this useful

People building binary tools - disassemblers, JIT compilers, assemblers, executable rewriters, or dynamic code generators - who need explicit, accurate representations of instruction encodings will find the approach relevant.

Researchers or engineers who want to avoid hand-transcribing bitfield layouts from architecture manuals, or who want to compare assembler behavior to the manual, will also benefit since DERIVE can reveal differences between an architecture manual and an assembler implementation.

Questions people ask about Reverse-Engineering Instruction Encodings (2001)

Does DERIVE produce code I can use directly to emit instructions?

DERIVE produces C data structure declarations that describe encodings; the authors built a generator that consumes those declarations to produce C macros for fast code emission.

Which instruction sets does DERIVE handle?

The paper states DERIVE solves MIPS, SPARC, Alpha, and PowerPC completely, and handles most ARM and x86 instructions except some with non-contiguous fields.

Can DERIVE detect differences between an assembler and the architecture manual?

Yes; the paper notes DERIVE can quickly find differences between what an architecture manual says and what an assembler actually implements.

Reverse-Engineering Instruction Encodings (2001) was shared on NexURLs by Nexis on October 26, 2026, in Tech & AI.