Breaking Down Binary Ninja’s Low Level IL

Summary: Trail of Bits' Josh explains Binary Ninja's Low Level IL, an intermediate representation that lifts assembly into a tree-structured form so dataflow analysis can run architecture-agnostically across x86-64, ARM, and MSP430. He notes the translation is one-to-many, with instructions like x86's repne cmpsb generating branches and loops in LLIL, and describes a Python API for traversing instruction trees.
What you should know: Trail of Bits used the LLIL to solve 2,000 CTF challenge binaries by identifying a buffer to overflow and a canary value that had to remain intact in each - the same static-analysis approach a team can point at binaries it has no source for.

Read the original at Trail of Bits Blog ↗