| name | binary-lifting |
| description | Expertise in binary lifting techniques - converting machine code to LLVM IR for analysis, decompilation, and recompilation. Use this skill when working on reverse engineering, binary analysis, deobfuscation, or converting binaries to higher-level representations. |
Binary Lifting Skill
This skill covers techniques and tools for lifting binary executables to LLVM IR, enabling advanced analysis, transformation, and recompilation of existing binaries.
Core Concepts
What is Binary Lifting?
Binary lifting is the process of translating low-level machine code (x86, ARM, etc.) into a higher-level intermediate representation (LLVM IR), enabling:
- Static and dynamic analysis
- Deobfuscation and vulnerability research
- Code recompilation and optimization
- Cross-architecture translation
Lifting Pipeline
Binary → Disassembly → IR Generation → Optimization → Analysis/Recompilation
Major Lifting Frameworks
Production-Grade Tools
- RetDec (Avast): Full decompiler with C output, multi-architecture support
- McSema (Trail of Bits): x86/x64 to LLVM IR, function recovery
- revng: Based on QEMU, supports multiple architectures
- reopt (Galois): Focus on correctness and formal methods
Research/Specialized Tools
- Rellume: Fast x86-64 to LLVM lifting for JIT scenarios
- fcd: Pattern-based decompiler with optimization passes
- bin2llvm: QEMU-based binary to LLVM translator
- llvm-mctoll: Microsoft's machine code to LLVM lifter
Language-Specific Lifters
- llvm2c/IR->C: Convert LLVM IR back to C code
