2

I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting instructions to the LLVM-IR level? For example, where can I look at code that just translate one pop rsp instruction to LLVM-IR? Since I didn't find anything like that.

Maybe someone has articles where this is described or can someone suggest with an example?

Improve this question
2
  • I think I used RetDec to lift PE to LLVM IR
    – raspiduino
    Jan 20 at 9:32
  • 1
    @raspiduino I am studying for a PhD (Computer Science) and this is my project, a 500 megabyte file, also cannot process retdec. I need to make my own code lifter, can you tell me with this?
    – OSPFv3
    Jan 20 at 12:53

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.