skills.rest
gmh5225
gmh5225COMMUNITY
Explore all skills by this author →
Website𝕏@gmhzxyGitHub

binary-lifting

Translates machine code into LLVM IR for analysis and de-ossification.

868|100|Updated Jan 10, 2022
Search Tags:#LLVM IR#deobfuscation#reverse-engineering#binary#recompilation#lifting
One-click install
npx skills add https://github.com/gmh5225/awesome-llvm-security --skill binary-lifting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: binary-lifting
Source: https://github.com/gmh5225/awesome-llvm-security/tree/main/.claude/skills/binary-lifting
Command: npx skills add https://github.com/gmh5225/awesome-llvm-security --skill binary-lifting

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables translating low-level machine code into LLVM IR to enable in-depth analysis, deobfuscation, and recompilation of binaries.

Core Features & Use Cases

  • Support for multiple lifting frameworks to generate LLVM IR from binaries (e.g., McSema, RetDec, revng, reopt).
  • Techniques for control flow recovery, indirect jump resolution, and memory modeling to improve analysis accuracy.
  • Dynamic lifting and integration with runtime instrumentation to lift hot code paths.

Quick Start

Install a lifting framework such as McSema, lift a sample binary to LLVM IR, and inspect the resulting IR.

Frequently Asked Questions about binary-lifting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I translate machine code into LLVM IR for binary deobfuscation?▼

To translate machine code into LLVM IR for binary deobfuscation, you must install an external lifting framework such as McSema or RetDec to generate and validate the intermediate representation.

What is binary lifting and how does it help with reverse engineering?▼

Binary lifting is the process of translating low-level machine code into LLVM IR. It enables in-depth reverse engineering by allowing analysis, deobfuscation, and recompilation of binaries.

Can I use McSema or RetDec to lift binaries across different architectures?▼

Yes, frameworks like McSema and RetDec support cross-architecture translation. This Skill leverages them to lift binaries into LLVM IR for cross-architecture translation workflows.

How do I resolve indirect jumps and recover control flow when lifting binaries?▼

To resolve indirect jumps and recover control flow when lifting binaries, this Skill applies techniques like memory modeling and control flow recovery to improve analysis accuracy.

Does dynamic lifting with runtime instrumentation work for hot code paths?▼

Yes, dynamic lifting integrates with runtime instrumentation to specifically lift hot code paths. This approach enhances analysis accuracy by targeting frequently executed instructions.

Why do I need an external lifting framework to generate LLVM IR?▼

An external lifting framework is required to generate LLVM IR because this Skill provides the processing logic and techniques for translation, relying on these frameworks to execute the lift and validate correctness.

Related Skills

Explore More Software Engineering Skills→
backengineeringbackengineering
434

binary_lifting

Convert binary executables into LLVM IR using RetDec, McSema, and Triton.

Official
Advanced
NeverSightNeverSight
69

llvm-obfuscation

Implement LLVM passes for control flow and data obfuscation.

Official
Advanced
fjor1025fjor1025

address-sanitizer

Detect memory errors in C/C++ code with AddressSanitizer during fuzzing.

Community
Intermediate
nolanvenholanolanvenhola
3

reverse-engineering

Automate disassembly, decompilation, and deobfuscation of binaries with Ghidra, IDA Pro, radare2, and angr.

Community
Advanced