I'm trying to write a disassembler to disassemble the binary code of smart contract. There are trailing bytes at the end, which causes disassemble problem. For example, the last few lines of this contract looks like:

    0821    20    SHA3
    0822    66    PUSH7 0x61696c6564a264
    082A    69    PUSH10 0x7066735822122093f028
    0835    25    25
    0836    50    POP
    0837    35    CALLDATALOAD
    0838    B6    B6
    0839    1D    SAR
    083A    F4    DELEGATECALL
    083B    76    PUSH23 0xb13b9dba3c4f06f60e51b9b4caee31680b389aef327f64
    0853    73    PUSH20 0x6f6c63430008020033  <- PUSH20 requires 20 bytes, only 9 bytes left, which causes error while disassembling

Compare to the full binary data from its creation:

    0E9D    20    SHA3
    0E9E    66    PUSH7 0x61696c6564a264
    0EA6    69    PUSH10 0x7066735822122093f028
    0EB1    25    25
    0EB2    50    POP
    0EB3    35    CALLDATALOAD
    0EB4    B6    B6
    0EB5    1D    SAR
    0EB6    F4    DELEGATECALL
    0EB7    76    PUSH23 0xb13b9dba3c4f06f60e51b9b4caee31680b389aef327f64
    0ECF    73    PUSH20 0x6f6c63430008020033b53127684a568b3173ae13 <--- the 20 bytes and the rest
    0EE4    B9    B9
    0EE5    F8    F8
    0EE6    A6    A6
    0EE7    01    ADD
    0EE8    6E    PUSH15 0x243e63b6e8ee1178d6a717850b5d61

The PUSH20 9-bytes seems corrupted, and look around a bit, there are many hex values seems to be strings. So I guess the last segment in contract binary is "data segment", which contains string.

But where the segment of code ends? So I can stop disassembling at that place.

And currently I just disassemble the code, the next step I'll try to parse the strings and show at where being used, like:

    0EEE    XX    SOME_OPERAND  ; "some string used at this line"

Is there any document about the binary layout?

1 Answer 1


This part is the CBOR encoded contract metadata, you can read about it in the documentation. Basically, the last 2 bytes of the contract runtime code will be the metadata payload length located just above, which you can omit during decompilation.

The metadata of that contract are a264697066735822122093f028255035b61df476b13b9dba3c4f06f60e51b9b4caee31680b389aef327f64736f6c63430008020033 which decodes to : {"ipfs": h'122093F028255035B61DF476B13B9DBA3C4F06F60E51B9B4CAEE31680B389AEF327F', "solc": h'000802'}

A contract creation code will include :

  • The constructor
  • The contract code
  • The arguments

In this answer, I provided a way to identify all of those sections in a contract deployment bytecode if that can be of any use to you since you are indeed decompiling the arguments in :

0ECF    73    PUSH20 0x6f6c63430008020033b53127684a568b3173ae13
                                         ^ Arguments start here

Once you have all the section, you only need to decompile :

  • Contract creation code
  • Contract bytecode (without metadata)

I hope that answers your question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.