I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting instructions to the LLVM-IR level? For example, where can I look at code that just translate one pop rsp instruction to LLVM-IR? Since I didn't find anything like that.

Maybe someone has articles where this is described or can someone suggest with an example?

  • I think I used RetDec to lift PE to LLVM IR
    – raspiduino
    Commented Jan 20, 2023 at 9:32
  • 1
    @raspiduino I am studying for a PhD (Computer Science) and this is my project, a 500 megabyte file, also cannot process retdec. I need to make my own code lifter, can you tell me with this?
    – OSPFv3
    Commented Jan 20, 2023 at 12:53


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.