1

I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting instructions to the LLVM-IR level? For example, where can I look at code that just translate one pop rsp instruction to LLVM-IR? Since I didn't find anything like that.

Maybe someone has articles where this is described or can someone suggest with an example?

OSPFv3
  • 33
  • 5

1 Answers1

2

Here is a list of similar tools you could try:

  1. MeSema relies on IDA Pro to disassemble a binary file and produce a control flow graph. Then it can convert the control flow graph into LLVM IR.
  2. llvm-mctoll is easy to use, but SIMD instructions such as SSE, AVX, and Neon cannot be raised.
  3. retdec is a retargetable machine-code decompiler
  4. reopt is a general purpose decompilation and recompilation tool, support x86-64 Linux programs.
西风逍遥游
  • 94
  • 7
  • Thanks! I'm currently trying to rewrite this under Windows: https://github.com/aengelke/rellume Maybe you know something like a library for translating code to LLVM-IR so that I can integrate this library into my code? – OSPFv3 Jan 28 '23 at 00:21