Functions

1. Lift x86 instructions to IR(intermediate representation) (SSA Form Based)
2. IR Optimization
3. Dynamic symbolic analysis with IR

Libraries

1. Zydis
2. Z3

IR Optimization

Dead Store Elimination

• Example
  (1) VMProtect Mutation Code
  
  
  (2) Optimized Code
  
  
  

Dynamic Symbolic Analysis with IR

Solve CTF with Dynamic Symbolic Analysis + Z3

(1) First Char

0x71 -> q

(2) Second Char

0x65 -> e

(3) Third Char

0x7a->z

(4) Fourth Char

0x6a->j

(5) Fifth Char

0x64->d


....

(6) Last Char

0x76->v

(7) Flag