Optimizing Lifted Bitcode with Dead Store Elimination

Summary: Trail of Bits intern Tim Alberdingk Thijm built data-flow-based dead store elimination passes for McSema-lifted programs, and applying them to Apache httpd removed 117,059 stores, or 50% of store operations to Remill's register State structure. The passes are now enabled by default, using a ForwardAliasVisitor to map pointers to State slots and LiveSetBlockVisitor and ForwardingBlockVisitor to find and remove dead stores, with the httpd run removing 273,322 instructions in total.
Key Takeaway: Lifted binaries carry a mountain of emulated register writes that LLVM alone cannot prove unnecessary, and cutting half of them from a single program like httpd changes what whole-program analysis of lifted code costs in time and memory.

Read the original at Trail of Bits Blog ↗