How can i Lifting x86_64 assembly code to LLVM-IR?

Question

I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting instructions to the LLVM-IR level? For example, where can I look at code that just translate one pop rsp instruction to LLVM-IR? Since I didn't find anything like that.

Maybe someone has articles where this is described or can someone suggest with an example?

Answer 1

Here is a list of similar tools you could try:

1. MeSema relies on IDA Pro to disassemble a binary file and produce a control flow graph. Then it can convert the control flow graph into LLVM IR.
2. llvm-mctoll is easy to use, but SIMD instructions such as SSE, AVX, and Neon cannot be raised.
3. retdec is a retargetable machine-code decompiler
4. reopt is a general purpose decompilation and recompilation tool, support x86-64 Linux programs.