CODEWITHSUNDEEP
virtual-machinellvmllvm-irdeobfuscationlifting
OSPFv3
OSPFv3

Reputation: 43

How can i Lifting x86_64 assembly code to LLVM-IR?

I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting instructions to the LLVM-IR level? For example, where can I look at code that just translate one pop rsp instruction to LLVM-IR? Since I didn't find anything like that.

Maybe someone has articles where this is described or can someone suggest with an example?

Upvotes: 2

Views: 1701

Answers (1)

西风逍遥游
西风逍遥游

Reputation: 94

Here is a list of similar tools you could try:

  1. MeSema relies on IDA Pro to disassemble a binary file and produce a control flow graph. Then it can convert the control flow graph into LLVM IR.
  2. llvm-mctoll is easy to use, but SIMD instructions such as SSE, AVX, and Neon cannot be raised.
  3. retdec is a retargetable machine-code decompiler
  4. reopt is a general purpose decompilation and recompilation tool, support x86-64 Linux programs.

Upvotes: 2

Related Questions