- Installs
- 75
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/gmh5225/awesome-llvm-security --skill binary-lifting- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads binary-lifting automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Binary Lifting Skill
This skill covers techniques and tools for lifting binary executables to LLVM IR, enabling advanced analysis, transformation, and recompilation of existing binaries.
Core Concepts
What is Binary Lifting?
Binary lifting is the process of translating low-level machine code (x86, ARM, etc.) into a higher-level intermediate representation (LLVM IR), enabling:
- Static and dynamic analysis
- Deobfuscation and vulnerability research
- Code recompilation and optimization
- Cross-architecture translation
Lifting Pipeline
Binary → Disassembly → IR Generation → Optimization → Analysis/Recompilation
Major Lifting Frameworks
Production-Grade Tools
- RetDec (Avast): Full decompiler with C output, multi-architecture support
- McSema (Trail of Bits): x86/x64 to LLVM IR, function recovery
- revng: Based on QEMU, supports multiple architectures
- reopt (Galois): Focus on correctness and formal methods
Research/Specialized Tools
- Rellume: Fast x86-64 to LLVM lifting for JIT scenarios
- fcd: Pattern-based decompiler with optimization passes
- bin2llvm: QEMU-based binary to LLVM translator
- llvm-mctoll: Microsoft's machine code to LLVM lifter
Language-Specific Lifters
- llvm2c/IR->C: Convert LLVM IR back to C code
- llvm2cranelift: LLVM IR to Cranelift IR
- Leaven: LLVM IR to Go language
- masxinlingvonta: JVM bytecode to LLVM IR
Implementation Techniques
Instruction Semantics Translation
// Example: Translating x86 ADD to LLVM IR
Value* translateADD(IRBuilder<> &builder, Value* op1, Value* op2) {
Value* result = builder.CreateAdd(op1, op2, "add_result");
// Update flags (CF, OF, SF, ZF, etc.)
updateCarryFlag(builder, op1, op2, result);
updateOverflowFlag(builder, op1, op2, result);
updateSignFlag(builder, result);
updateZeroFlag(builder, result);
return result;
}
Control Flow Recovery
- Linear Sweep: Simple but misses code with embedded data
- Recursive Descent: Follow control flow, better coverage
- Speculative Disassembly: Handle indirect jumps/calls
- Machine Learning: Use ML to identify function boundaries
Handling Indirect Control Flow
- Value Set Analysis (VSA)
- Symbolic execution for jump target resolution
- Type recovery for virtual table reconstruction
Triton Integration
Triton symbolic execution engine can be used with lifting:
from triton import TritonContext, ARCH, Instruction
ctx = TritonContext(ARCH.X86_64)
# Symbolically execute and extract AST
inst = Instruction(b"\x48\x01\xd8") # add rax, rbx
ctx.processing(inst)
# Convert Triton AST to LLVM IR
ast = ctx.getRegisterAst(ctx.registers.rax)
llvm_ir = triton_ast_to_llvm(ast)
Deobfuscation via Lifting
Approach
- Lift obfuscated binary to LLVM IR
- Apply optimization passes to simplify
- Use custom passes for specific obfuscation patterns
- Re-emit cleaned code
Useful Optimization Passes
- Dead Store Elimination (DSE)
- Global Value Numbering (GVN)
- Constant Propagation
- Instruction Combining
- Loop Simplification
VMP/VM Handler Recovery
- Identify dispatcher patterns
- Extract VM bytecode semantics
- Convert handlers to native IR
- Example: TicklingVMProtect for VMProtect analysis
Best Practices
- Architecture Support: Handle endianness, calling conventions, ABI differences
- Memory Modeling: Accurate memory layout for global/stack variables
- External Dependencies: Handle library calls and system calls
- Validation: Compare execution traces of original vs lifted code
- Incremental Lifting: Support partial program analysis
Dynamic Binary Lifting
Runtime Translation
- Instrew: Fast instrumentation through LLVM
- QBDI: QuarkslaB Dynamic Binary Instrumentation
- binopt: Runtime optimization of binary code
JIT Recompilation
Lift frequently executed code paths for runtime optimization:
- Profile-guided lifting
- Hot path detection
- Speculative optimization
Resources
For a complete list of lifting tools and research papers, refer to the LIFT section in the main README.md.
Getting Detailed Information
When you need detailed and up-to-date resource links, tool lists, or project references, fetch the latest data from:
https://raw.githubusercontent.com/gmh5225/awesome-llvm-security/refs/heads/main/README.md
This README contains comprehensive curated lists of:
- Binary lifting frameworks and tools (LIFT section)
- Related research papers and documentation
- Implementation examples and tutorials
FAQ
What does the binary-lifting skill do?
Expertise in binary lifting techniques - converting machine code to LLVM IR for analysis, decompilation, and recompilation. Use this skill when working on reverse engineering, binary analysis, deobfuscation, or converting binaries to higher-level representations.
How do I install binary-lifting?
Run npx skills add https://github.com/gmh5225/awesome-llvm-security --skill binary-lifting in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/binary-lifting/ (personal) or .claude/skills/binary-lifting/ (project).
Which AI agents can use binary-lifting?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is binary-lifting safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains binary-lifting?
It is published by gmh5225 in gmh5225/awesome-llvm-security. It has 75 recorded installs.
More from gmh5225/awesome-llvm-security
llvm-obfuscation
gmh5225/awesome-llvm-security
Open the skill to read its SKILL.md instructions.
compiler-development
gmh5225/awesome-llvm-security
Open the skill to read its SKILL.md instructions.
llvm-optimization
gmh5225/awesome-llvm-security
Open the skill to read its SKILL.md instructions.
llvm-learning
gmh5225/awesome-llvm-security
Comprehensive learning resources and tutorials for LLVM, Clang, and compiler development. Use this skill when helping users learn LLVM internals, find educational resources, or understand compiler concepts.
static-analysis
gmh5225/awesome-llvm-security
Expertise in LLVM-based static analysis including dataflow analysis, pointer analysis, taint tracking, and program verification. Use this skill when implementing security scanners, bug finders, code quality tools, or performing program analysis research.
mlir-development
gmh5225/awesome-llvm-security
Expertise in MLIR (Multi-Level Intermediate Representation) and CIR (Clang IR) development for domain-specific compilation and high-level optimizations. Use this skill when building ML compilers, domain-specific languages, or working with multi-level compilation pipelines.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.