AwesomeREA.org

Tool

Mergen

Function-level lifter that symbolically lifts one x86-64 function from a Windows PE binary into LLVM IR, then iterates LLVM and custom passes to a fixpoint so obfuscated or virtualized code reduces to simpler control flow and semantics for analysis. Its scope document lists 119 instruction handlers, two-way branches and tested jump-table shapes; README examples lift small test functions the authors protected with VMProtect and Themida, and the IR can be compiled for viewing in a decompiler.

Requirements & limits

  • Latest release at review: v0.7, published 2026-03-29, with Windows lifter and microtest executables for the iced and Zydis decoder backends. The reviewed main commit, dated 2026-05-08, is 150 commits past the later v0.8 tag, which has no release. docs/SCOPE.md limits support to x86-64 PE files and one function per run: 32-bit x86, other formats and architectures, self-modifying code, floating-point or AVX code beyond the listed SSE2 integer instructions and whole-binary lifting are unsupported, and general-purpose decompilation is a non-goal.
  • The lifter takes a PE file and the target function's address, with optional --outline addresses; analysts supply their own binaries. The VMProtect check runs against local protected samples that are not committed, and the reviewed tree holds source, assembly and C test sources and documentation rather than prebuilt executables. Output is LLVM IR text plus output_diagnostics.json, which records unresolved indirect jumps and returns.
  • Developed and CI-tested mainly on Windows with CMake, Ninja, clang-cl using MSVC headers and libraries, LLVM 18 and Rust/Cargo for the default iced backend; the Zydis-only lane builds from a vendored Zydis 4.1.0 amalgamation, and linux-pe is a git submodule. A secondary Ubuntu 22.04 Dockerfile builds and exports a Linux lifter.
  • docs/SCOPE.md reports 115 of 119 handlers covered by a Unicorn-generated oracle suite, 33 semantic samples with 177 runtime cases checked under lli, golden IR hashes and Windows build lanes in CI, and says reliability on protected code varies by protection level. The README's branch example still says jumps with more than two targets are unsupported, while the newer scope document lists tested jump-table shapes. These gates cover the project's own compiled samples, not arbitrary protected software; nothing was built or run for this review.
  • LICENSE is GPL-3.0; the vendored Zydis source and the submodule keep their own licenses. Lifted IR still needs analyst validation, and the reviewed sources establish no REA use.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · NaC-L/Mergen · Revision 1998057
  2. docs/SCOPE.md GitHub · NaC-L/Mergen · Revision 1998057
  3. docs/BUILDING.md GitHub · NaC-L/Mergen · Revision 1998057
  4. docs/REWRITE_BASELINE.md GitHub · NaC-L/Mergen · Revision 1998057
  5. ARCHITECTURE.md GitHub · NaC-L/Mergen · Revision 1998057
  6. README.md#L181 GitHub · NaC-L/Mergen · Revision 1998057
  7. lifter/core/Utils.cpp GitHub · NaC-L/Mergen · Revision 1998057
  8. Dockerfile GitHub · NaC-L/Mergen · Revision 1998057
  9. .gitmodules GitHub · NaC-L/Mergen · Revision 1998057
  10. LICENSE GitHub · NaC-L/Mergen · Revision 1998057
  11. https://github.com/NaC-L/Mergen/releases/tag/v0.7

More in Native binaries

All 105 entries in Native binaries