Tags:intermediate representation, QEMU and static analysis
Abstract:
In this work, we introduce libtcg, an easy-to-use library able to lift executable code to an architecture-independent Intermediate Representation (IR). Being based on QEMU, libtcg inherits its wide and well tested Instruction Set Architecture (ISA) support. Furthermore, the IR exposed by libtcg is independent of the input ISA and explicitly represents how each instruction affects the CPU state. This makes it particularly suitable for building general static analysis tools such as register dataflow visualizations or stack boundary identifiers. As a consequence effort can then be spent on advanced and sound analyses rather than dealing with the quirks of each supported ISA.
Libtcg -- Accurate Lifting of Executable Code Using QEMU