McSema: I’m liftin’ it

Summary: Trail of Bits held a hackathon that overhauled McSema, its x86 machine code to LLVM bitcode translator, moving it from a custom-modified LLVM 3.5 to a stock LLVM 3.8 and dropping its Boost dependency. The update simplified the build system, replaced the bin_descend disassembler with a single IDA Pro-based decoder, added mcsema-disass and mcsema-lift commands, and introduced an integration testing framework and new documentation.
Bottom line: McSema is used to find and retroactively harden binary programs against security bugs and to independently validate vendor source code, so its move to a stock LLVM 3.8 and a single IDA Pro decoder changes the tooling those binary-analysis and fuzzing workflows now depend on.

Read the original at Trail of Bits Blog ↗