News for hackers. Stuff that matters.

A comment on McSema: A native code to LLVM IR translation framework.

Re:McSema: A native code to LLVM IR translation framework by beernutz on Thursday August 07, 2014 @04:36PM (#8150000)
Pardon my ignorance, (I don't mean to be dense here) but what the heck is this doing? It sounds like recompiling machine code into intermediate code. Is that a fair (if short and over simple) description?
[ Parent | on HN ]
Re:McSema: A native code to LLVM IR translation framework by SloopJon on Thursday August 07, 2014 @04:45PM (#8150052)
The announcement links to an earlier blog post (pardon my formatting):

http://blog.trailofbits.com/2014/06/23/a-preview-of-mcsema/

"McSema translates x86 machine code into LLVM bitcode.

"Why would we do such a crazy thing?

"Because we wanted to analyze existing binary applications, and reasoning about LLVM bitcode is much easier than reasoning about x86 instructions.

"Not only is it easier to reason about LLVM bitcode, but it is easier to manipulate and re-target bitcode to a different architecture."

[ Parent | on HN ]
Re:McSema: A native code to LLVM IR translation framework by beernutz on Thursday August 07, 2014 @04:55PM (#8150097)
Thank you. I missed that post.
[ Parent | on HN ]
Re:McSema: A native code to LLVM IR translation framework by frakturfreund on Thursday August 07, 2014 @04:42PM (#8150029)
Yes, it’s a Disassembler: https://en.wikipedia.org/wiki/Disassembler
[ Parent | on HN ]
Re:McSema: A native code to LLVM IR translation framework by tptacek on Thursday August 07, 2014 @08:32PM (#8150891)
It's more than a disassembler. Disassemblers are easy to write. Stateful transformation is much harder.
[ Parent | on HN ]