Comments on: A Quick Survey on Intermediate Representations for Program Analysis

By: dan

dan — Mon, 25 May 2009 17:56:27 +0000

Hi Gera, I didn’t notice DynamoRio could be used as a standalone library, thanks for pointing it out!

By: gera

gera — Sun, 24 May 2009 02:48:43 +0000

I think DynamoRio’s is also worth taking a look. It has a “…standalone library for IA-32/AMD64 disassembly, decoding, encoding, and general instruction manipulation…”

Start with: http://www.burningcutlery.com/dynamorio/docs/page_standalone.html

PS: Silvio! I can’t believe it! I’m so happy to hear from you! Hi! :-)

By: dan

dan — Fri, 10 Apr 2009 07:44:34 +0000

Hi Silvio, thanks for these new pointers ! Dammit, everybody is using his own IR nowadays… :)

By: silviocesare

silviocesare — Fri, 10 Apr 2009 05:18:45 +0000

Hi :)

Good work!

Not sure if this will be useful to you, but QEMU (since 0.10.0) uses a generic IR for all(?) its architectures now called TCG (Tiny Code Generator). I don’t know of anyone using this IR for anything other than QEMU which might limit its usefullness.

The Valgrind IR (VEX) is also used as a first stage in generating Vine, the IR used by the BitBlaze project. The reason for not using Vine directly AFAIK is because VEX doesn’t calculate the status flags explicitly (it stores operands/results for lazy evaluation). Explicit status flags calculation is very useful for the BitBlaze project in generating constraints etc in symbolic execution. Vine is documented in a paper on the BitBlaze homepage.

–
Silvio