PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Preview of McSema

blog.trailofbits.com | blog | #reverse-engineering | #recon | #llvm | #binary-translation | #mcsema | #fpu
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A preview of McSema ahead of REcon 2014: translating x86 binaries into LLVM bitcode lets LLVM tools (KLEE, PAGAI, LLBMC) work on existing software, plus a floating-point walkthrough.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Heavy lifting with McSema 2.0
McSema 2.0 separates instruction semantics into Remill, adds AArch64 and AVX support, improves control flow recovery, and integrates Binary Ninja, even transpiling AArch64 binaries to x86-64.
blog · blog.trailofbits.com
McSema: I’m liftin’ it
A hackathon overhauled McSema, the x86-to-LLVM bitcode translator: stock LLVM 3.8, no Boost dependency, leaner generated bitcode, faster builds, and better documentation.
blog · blog.trailofbits.com
Optimizing Lifted Bitcode with Dead Store Elimination
A Trail of Bits internship project adds dead store elimination passes for McSema-lifted bitcode, cutting roughly 117,000 register-emulation stores from Apache httpd and halving Remill state writes.
blog · blog.trailofbits.com
Close Encounters with Symbolic Execution (Part 2)
Part 2: how to build KLEE with LLVM 3.2 on Ubuntu 14.04 and use mcsema to symbolically execute a maze-oracle binary — translating it to bitcode and solving all paths with a symbolic-input driver.
blog · blog.trailofbits.com
McSema is Officially Open Source!
McSema is now open source under a BSD license: the framework translates x86 machine code to LLVM bitcode so tools like KLEE can run on existing binaries; development was DARPA-sponsored.
blog · blog.trailofbits.com
Let’s build a high-performance fuzzer with GPUs!
Trail of Bits prototyped a GPU-based fuzzer for embedded software using binary translation and managed memory; early results show 5x more executions per second per dollar than libFuzzer.
Back