Automatic Generation of Assembly to IR Translators Using Compilers

Translating low-level machine instructions into higher-level intermediate representation (IR) is one of the central steps in many binary translation, analysis and instrumentation systems. Most of these systems manually build the machine instruction to IR mapping table needed for such a translation. As a result, these systems often suffer from two problems: (a) a great deal of manual effort is required to support new architectures, and (b) even for existing architectures, lack of support for recent instruction set extensions, e.g., Valgrind’s lack of support for AVX, FMA4 and SSE4.1 for x86 processors. To overcome these difficulties, we propose a novel approach based on learning the assembly-to-IR mapping automatically. Modern compilers such as GCC and LLVM embed knowledge about these mappings in their code generators. By leveraging this knowledge, our approach can greatly reduce the implementation effort required for lifting binary code to IR. Moreover, such an approach is architecture-neutral, being able to support numerous architectures for which GCC (or other compilers) already have a backend. While coverage can be a challenge in learning-based approaches, note that in this problem domain, there is virtually an endless supply of training data that can be obtained by translating vast quantities of open-source code using compilers such as GCC and LLVM. We present experimental results that demonstrate the promise of our approach. Already, our implementation can support multiple architectures (x86, ARM and AVR), handle binaries of significant size (openssl and binutils), and be applied to multiple compilers (GCC and LLVM).