Binary Lifting Skill

Core Concepts

What is Binary Lifting?

• Static and dynamic analysis
• Deobfuscation and vulnerability research
• Code recompilation and optimization
• Cross-architecture translation

Lifting Pipeline

Binary → Disassembly → IR Generation → Optimization → Analysis/Recompilation

Major Lifting Frameworks

Production-Grade Tools

• RetDec (Avast): Full decompiler with C output, multi-architecture support
• McSema (Trail of Bits): x86/x64 to LLVM IR, function recovery
• revng: Based on QEMU, supports multiple architectures
• reopt (Galois): Focus on correctness and formal methods

Research/Specialized Tools

• Rellume: Fast x86-64 to LLVM lifting for JIT scenarios
• fcd: Pattern-based decompiler with optimization passes
• bin2llvm: QEMU-based binary to LLVM translator
• llvm-mctoll: Microsoft's machine code to LLVM lifter

Language-Specific Lifters

• llvm2c/IR->C: Convert LLVM IR back to C code
• llvm2cranelift: LLVM IR to Cranelift IR
• Leaven: LLVM IR to Go language
• masxinlingvonta: JVM bytecode to LLVM IR

Implementation Techniques

Instruction Semantics Translation

// Example: Translating x86 ADD to LLVM IR
Value* translateADD(IRBuilder<> &builder, Value* op1, Value* op2) {
    Value* result = builder.CreateAdd(op1, op2, "add_result");
    
    // Update flags (CF, OF, SF, ZF, etc.)
    updateCarryFlag(builder, op1, op2, result);
    updateOverflowFlag(builder, op1, op2, result);
    updateSignFlag(builder, result);
    updateZeroFlag(builder, result);
    
    return result;
}

Control Flow Recovery

1. Linear Sweep: Simple but misses code with embedded data
2. Recursive Descent: Follow control flow, better coverage
3. Speculative Disassembly: Handle indirect jumps/calls
4. Machine Learning: Use ML to identify function boundaries

Handling Indirect Control Flow

• Value Set Analysis (VSA)
• Symbolic execution for jump target resolution
• Type recovery for virtual table reconstruction

Triton Integration

from triton import TritonContext, ARCH, Instruction

ctx = TritonContext(ARCH.X86_64)

# Symbolically execute and extract AST
inst = Instruction(b"\x48\x01\xd8")  # add rax, rbx
ctx.processing(inst)

# Convert Triton AST to LLVM IR
ast = ctx.getRegisterAst(ctx.registers.rax)
llvm_ir = triton_ast_to_llvm(ast)

Deobfuscation via Lifting

Approach

1. Lift obfuscated binary to LLVM IR
2. Apply optimization passes to simplify
3. Use custom passes for specific obfuscation patterns
4. Re-emit cleaned code

Useful Optimization Passes

• Dead Store Elimination (DSE)
• Global Value Numbering (GVN)
• Constant Propagation
• Instruction Combining
• Loop Simplification

VMP/VM Handler Recovery

• Identify dispatcher patterns
• Extract VM bytecode semantics
• Convert handlers to native IR
• Example: TicklingVMProtect for VMProtect analysis

Best Practices

1. Architecture Support: Handle endianness, calling conventions, ABI differences
2. Memory Modeling: Accurate memory layout for global/stack variables
3. External Dependencies: Handle library calls and system calls
4. Validation: Compare execution traces of original vs lifted code
5. Incremental Lifting: Support partial program analysis

Dynamic Binary Lifting

Runtime Translation

• Instrew: Fast instrumentation through LLVM
• QBDI: QuarkslaB Dynamic Binary Instrumentation
• binopt: Runtime optimization of binary code

JIT Recompilation

• Profile-guided lifting
• Hot path detection
• Speculative optimization

Resources

Getting Detailed Information

https://raw.githubusercontent.com/gmh5225/awesome-llvm-security/refs/heads/main/README.md

• Binary lifting frameworks and tools (LIFT section)
• Related research papers and documentation
• Implementation examples and tutorials