hexcore-remill 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +101 -0
- package/binding.gyp +275 -0
- package/deps/README.md +20 -0
- package/index.d.ts +180 -0
- package/index.js +60 -0
- package/index.mjs +16 -0
- package/package.json +80 -0
- package/src/main.cpp +54 -0
- package/src/remill_wrapper.cpp +481 -0
- package/src/remill_wrapper.h +103 -0
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 HikariSystem
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
ADDED
|
@@ -0,0 +1,101 @@
|
|
|
1
|
+
# hexcore-remill
|
|
2
|
+
|
|
3
|
+
Modern N-API bindings for [Remill](https://github.com/lifting-bits/remill) — lifts machine code to LLVM IR bitcode.
|
|
4
|
+
|
|
5
|
+
Part of [HikariSystem HexCore](https://github.com/LXrdKnowkill/HikariSystem-HexCore).
|
|
6
|
+
|
|
7
|
+
## Supported Architectures
|
|
8
|
+
|
|
9
|
+
| Architecture | Variants |
|
|
10
|
+
|---|---|
|
|
11
|
+
| x86 (32-bit) | `x86`, `x86_avx`, `x86_avx512` |
|
|
12
|
+
| x86-64 | `amd64`, `amd64_avx`, `amd64_avx512` |
|
|
13
|
+
| AArch64 | `aarch64` |
|
|
14
|
+
| SPARC | `sparc32`, `sparc64` |
|
|
15
|
+
|
|
16
|
+
## Usage
|
|
17
|
+
|
|
18
|
+
```javascript
|
|
19
|
+
const { RemillLifter, ARCH } = require('hexcore-remill');
|
|
20
|
+
|
|
21
|
+
const lifter = new RemillLifter(ARCH.AMD64);
|
|
22
|
+
|
|
23
|
+
// push rbp; mov rbp, rsp; pop rbp; ret
|
|
24
|
+
const code = Buffer.from([0x55, 0x48, 0x89, 0xe5, 0x5d, 0xc3]);
|
|
25
|
+
const result = lifter.liftBytes(code, 0x401000);
|
|
26
|
+
|
|
27
|
+
if (result.success) {
|
|
28
|
+
console.log(result.ir); // LLVM IR text
|
|
29
|
+
console.log(result.bytesConsumed); // 6
|
|
30
|
+
}
|
|
31
|
+
|
|
32
|
+
lifter.close();
|
|
33
|
+
```
|
|
34
|
+
|
|
35
|
+
### Async (non-blocking)
|
|
36
|
+
|
|
37
|
+
```javascript
|
|
38
|
+
const result = await lifter.liftBytesAsync(largeBuffer, 0x140001000);
|
|
39
|
+
```
|
|
40
|
+
|
|
41
|
+
### Windows ABI context
|
|
42
|
+
|
|
43
|
+
```javascript
|
|
44
|
+
const lifter = new RemillLifter(ARCH.AMD64, OS.WINDOWS);
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
## API
|
|
48
|
+
|
|
49
|
+
### `new RemillLifter(arch, os?)`
|
|
50
|
+
|
|
51
|
+
Create a lifter for the given architecture. Loads the Remill semantics module.
|
|
52
|
+
|
|
53
|
+
- `arch` — Architecture name (use `ARCH` constants)
|
|
54
|
+
- `os` — OS name for ABI context (optional, defaults to `'linux'`)
|
|
55
|
+
|
|
56
|
+
### `lifter.liftBytes(code, address) → LiftResult`
|
|
57
|
+
|
|
58
|
+
Synchronous lift. Decodes and lifts instructions from the buffer.
|
|
59
|
+
|
|
60
|
+
### `lifter.liftBytesAsync(code, address) → Promise<LiftResult>`
|
|
61
|
+
|
|
62
|
+
Async lift in a worker thread. Use for large buffers (>64KB).
|
|
63
|
+
|
|
64
|
+
### `LiftResult`
|
|
65
|
+
|
|
66
|
+
```typescript
|
|
67
|
+
{
|
|
68
|
+
success: boolean;
|
|
69
|
+
ir: string; // LLVM IR text
|
|
70
|
+
error: string; // Error message if !success
|
|
71
|
+
address: number; // Start address
|
|
72
|
+
bytesConsumed: number; // Bytes consumed from input
|
|
73
|
+
}
|
|
74
|
+
```
|
|
75
|
+
|
|
76
|
+
### `RemillLifter.getSupportedArchs() → string[]`
|
|
77
|
+
|
|
78
|
+
Returns list of supported architecture names.
|
|
79
|
+
|
|
80
|
+
## Building from Source
|
|
81
|
+
|
|
82
|
+
```bash
|
|
83
|
+
# Prerequisites: LLVM 15+, CMake 3.21+, Ninja, clang-cl (Windows)
|
|
84
|
+
|
|
85
|
+
# Build Remill deps first (see deps/README.md)
|
|
86
|
+
npm run build
|
|
87
|
+
npm test
|
|
88
|
+
```
|
|
89
|
+
|
|
90
|
+
## Dependencies
|
|
91
|
+
|
|
92
|
+
- [Remill](https://github.com/lifting-bits/remill) — static library
|
|
93
|
+
- [LLVM 18](https://llvm.org/) — static libraries (Core, Support, BitReader, BitWriter, IRReader, etc.)
|
|
94
|
+
- [Intel XED](https://github.com/intelxed/xed) — x86 instruction decoder (used by Remill)
|
|
95
|
+
|
|
96
|
+
**Important:** Must use the same LLVM version as `hexcore-llvm-mc` (currently LLVM 18)
|
|
97
|
+
to avoid symbol conflicts when both are loaded in the same process.
|
|
98
|
+
|
|
99
|
+
## License
|
|
100
|
+
|
|
101
|
+
MIT — Copyright (c) HikariSystem
|
package/binding.gyp
ADDED
|
@@ -0,0 +1,275 @@
|
|
|
1
|
+
{
|
|
2
|
+
"targets": [
|
|
3
|
+
{
|
|
4
|
+
"target_name": "hexcore_remill",
|
|
5
|
+
"cflags!": [
|
|
6
|
+
"-fno-exceptions"
|
|
7
|
+
],
|
|
8
|
+
"cflags_cc!": [
|
|
9
|
+
"-fno-exceptions"
|
|
10
|
+
],
|
|
11
|
+
"sources": [
|
|
12
|
+
"src/main.cpp",
|
|
13
|
+
"src/remill_wrapper.cpp"
|
|
14
|
+
],
|
|
15
|
+
"include_dirs": [
|
|
16
|
+
"<!@(node -p \"require('node-addon-api').include\")",
|
|
17
|
+
"deps/remill/include",
|
|
18
|
+
"deps/llvm/include",
|
|
19
|
+
"deps/xed/include",
|
|
20
|
+
"deps/glog/include",
|
|
21
|
+
"deps/gflags/include"
|
|
22
|
+
],
|
|
23
|
+
"defines": [
|
|
24
|
+
"NAPI_VERSION=8",
|
|
25
|
+
"NAPI_DISABLE_CPP_EXCEPTIONS"
|
|
26
|
+
],
|
|
27
|
+
"conditions": [
|
|
28
|
+
[
|
|
29
|
+
"OS=='win'",
|
|
30
|
+
{
|
|
31
|
+
"libraries": [
|
|
32
|
+
"<(module_root_dir)/deps/remill/lib/remill_bc.lib",
|
|
33
|
+
"<(module_root_dir)/deps/remill/lib/remill_os.lib",
|
|
34
|
+
"<(module_root_dir)/deps/remill/lib/remill_arch.lib",
|
|
35
|
+
"<(module_root_dir)/deps/remill/lib/remill_arch_x86.lib",
|
|
36
|
+
"<(module_root_dir)/deps/remill/lib/remill_arch_aarch64.lib",
|
|
37
|
+
"<(module_root_dir)/deps/remill/lib/remill_arch_sparc32.lib",
|
|
38
|
+
"<(module_root_dir)/deps/remill/lib/remill_arch_sparc64.lib",
|
|
39
|
+
"<(module_root_dir)/deps/remill/lib/remill_arch_sleigh.lib",
|
|
40
|
+
"<(module_root_dir)/deps/remill/lib/remill_version.lib",
|
|
41
|
+
"<(module_root_dir)/deps/remill/lib/decomp.lib",
|
|
42
|
+
"<(module_root_dir)/deps/remill/lib/sla.lib",
|
|
43
|
+
"<(module_root_dir)/deps/remill/lib/slaSupport.lib",
|
|
44
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMAArch64AsmParser.lib",
|
|
45
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMAArch64CodeGen.lib",
|
|
46
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMAArch64Desc.lib",
|
|
47
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMAArch64Disassembler.lib",
|
|
48
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMAArch64Info.lib",
|
|
49
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMAArch64Utils.lib",
|
|
50
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMARMAsmParser.lib",
|
|
51
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMARMCodeGen.lib",
|
|
52
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMARMDesc.lib",
|
|
53
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMARMDisassembler.lib",
|
|
54
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMARMInfo.lib",
|
|
55
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMARMUtils.lib",
|
|
56
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMAggressiveInstCombine.lib",
|
|
57
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMAnalysis.lib",
|
|
58
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMAsmParser.lib",
|
|
59
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMAsmPrinter.lib",
|
|
60
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMBPFAsmParser.lib",
|
|
61
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMBPFCodeGen.lib",
|
|
62
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMBPFDesc.lib",
|
|
63
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMBPFDisassembler.lib",
|
|
64
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMBPFInfo.lib",
|
|
65
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMBinaryFormat.lib",
|
|
66
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMBitReader.lib",
|
|
67
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMBitWriter.lib",
|
|
68
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMBitstreamReader.lib",
|
|
69
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMCFGuard.lib",
|
|
70
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMCodeGen.lib",
|
|
71
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMCodeGenTypes.lib",
|
|
72
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMCore.lib",
|
|
73
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMCoroutines.lib",
|
|
74
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMCoverage.lib",
|
|
75
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDWARFLinker.lib",
|
|
76
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDWARFLinkerClassic.lib",
|
|
77
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDWARFLinkerParallel.lib",
|
|
78
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDWP.lib",
|
|
79
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDebugInfoBTF.lib",
|
|
80
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDebugInfoCodeView.lib",
|
|
81
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDebugInfoDWARF.lib",
|
|
82
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDebugInfoGSYM.lib",
|
|
83
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDebugInfoLogicalView.lib",
|
|
84
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDebugInfoMSF.lib",
|
|
85
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDebugInfoPDB.lib",
|
|
86
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDebuginfod.lib",
|
|
87
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDemangle.lib",
|
|
88
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMDlltoolDriver.lib",
|
|
89
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMExecutionEngine.lib",
|
|
90
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMExtensions.lib",
|
|
91
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMFileCheck.lib",
|
|
92
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMFrontendDriver.lib",
|
|
93
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMFrontendHLSL.lib",
|
|
94
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMFrontendOffloading.lib",
|
|
95
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMFrontendOpenACC.lib",
|
|
96
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMFrontendOpenMP.lib",
|
|
97
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMFuzzMutate.lib",
|
|
98
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMFuzzerCLI.lib",
|
|
99
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMGlobalISel.lib",
|
|
100
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMHexagonAsmParser.lib",
|
|
101
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMHexagonCodeGen.lib",
|
|
102
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMHexagonDesc.lib",
|
|
103
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMHexagonDisassembler.lib",
|
|
104
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMHexagonInfo.lib",
|
|
105
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMHipStdPar.lib",
|
|
106
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMIRPrinter.lib",
|
|
107
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMIRReader.lib",
|
|
108
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMInstCombine.lib",
|
|
109
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMInstrumentation.lib",
|
|
110
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMInterfaceStub.lib",
|
|
111
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMInterpreter.lib",
|
|
112
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMJITLink.lib",
|
|
113
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMLTO.lib",
|
|
114
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMLibDriver.lib",
|
|
115
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMLineEditor.lib",
|
|
116
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMLinker.lib",
|
|
117
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMLoongArchAsmParser.lib",
|
|
118
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMLoongArchCodeGen.lib",
|
|
119
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMLoongArchDesc.lib",
|
|
120
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMLoongArchDisassembler.lib",
|
|
121
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMLoongArchInfo.lib",
|
|
122
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMMC.lib",
|
|
123
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMMCA.lib",
|
|
124
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMMCDisassembler.lib",
|
|
125
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMMCJIT.lib",
|
|
126
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMMCParser.lib",
|
|
127
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMMIRParser.lib",
|
|
128
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMMipsAsmParser.lib",
|
|
129
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMMipsCodeGen.lib",
|
|
130
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMMipsDesc.lib",
|
|
131
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMMipsDisassembler.lib",
|
|
132
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMMipsInfo.lib",
|
|
133
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMObjCARCOpts.lib",
|
|
134
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMObjCopy.lib",
|
|
135
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMObject.lib",
|
|
136
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMObjectYAML.lib",
|
|
137
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMOption.lib",
|
|
138
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMOrcDebugging.lib",
|
|
139
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMOrcJIT.lib",
|
|
140
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMOrcShared.lib",
|
|
141
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMOrcTargetProcess.lib",
|
|
142
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMPasses.lib",
|
|
143
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMPowerPCAsmParser.lib",
|
|
144
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMPowerPCCodeGen.lib",
|
|
145
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMPowerPCDesc.lib",
|
|
146
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMPowerPCDisassembler.lib",
|
|
147
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMPowerPCInfo.lib",
|
|
148
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMProfileData.lib",
|
|
149
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMRISCVAsmParser.lib",
|
|
150
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMRISCVCodeGen.lib",
|
|
151
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMRISCVDesc.lib",
|
|
152
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMRISCVDisassembler.lib",
|
|
153
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMRISCVInfo.lib",
|
|
154
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMRISCVTargetMCA.lib",
|
|
155
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMRemarks.lib",
|
|
156
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMRuntimeDyld.lib",
|
|
157
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMScalarOpts.lib",
|
|
158
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSelectionDAG.lib",
|
|
159
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSparcAsmParser.lib",
|
|
160
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSparcCodeGen.lib",
|
|
161
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSparcDesc.lib",
|
|
162
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSparcDisassembler.lib",
|
|
163
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSparcInfo.lib",
|
|
164
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSupport.lib",
|
|
165
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSymbolize.lib",
|
|
166
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSystemZAsmParser.lib",
|
|
167
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSystemZCodeGen.lib",
|
|
168
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSystemZDesc.lib",
|
|
169
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSystemZDisassembler.lib",
|
|
170
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMSystemZInfo.lib",
|
|
171
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMTableGen.lib",
|
|
172
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMTableGenCommon.lib",
|
|
173
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMTableGenGlobalISel.lib",
|
|
174
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMTarget.lib",
|
|
175
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMTargetParser.lib",
|
|
176
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMTextAPI.lib",
|
|
177
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMTextAPIBinaryReader.lib",
|
|
178
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMTransformUtils.lib",
|
|
179
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMVectorize.lib",
|
|
180
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMWebAssemblyAsmParser.lib",
|
|
181
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMWebAssemblyCodeGen.lib",
|
|
182
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMWebAssemblyDesc.lib",
|
|
183
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMWebAssemblyDisassembler.lib",
|
|
184
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMWebAssemblyInfo.lib",
|
|
185
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMWebAssemblyUtils.lib",
|
|
186
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMWindowsDriver.lib",
|
|
187
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMWindowsManifest.lib",
|
|
188
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMX86AsmParser.lib",
|
|
189
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMX86CodeGen.lib",
|
|
190
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMX86Desc.lib",
|
|
191
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMX86Disassembler.lib",
|
|
192
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMX86Info.lib",
|
|
193
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMX86TargetMCA.lib",
|
|
194
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMXRay.lib",
|
|
195
|
+
"<(module_root_dir)/deps/llvm/lib/LLVMipo.lib",
|
|
196
|
+
"<(module_root_dir)/deps/xed/lib/xed.lib",
|
|
197
|
+
"<(module_root_dir)/deps/xed/lib/xed-ild.lib",
|
|
198
|
+
"<(module_root_dir)/deps/glog/lib/glog.lib",
|
|
199
|
+
"<(module_root_dir)/deps/gflags/lib/gflags_static.lib"
|
|
200
|
+
],
|
|
201
|
+
"msvs_settings": {
|
|
202
|
+
"VCCLCompilerTool": {
|
|
203
|
+
"ExceptionHandling": 1,
|
|
204
|
+
"RuntimeLibrary": 0,
|
|
205
|
+
"AdditionalOptions": [
|
|
206
|
+
"/EHsc",
|
|
207
|
+
"/std:c++17",
|
|
208
|
+
"/bigobj"
|
|
209
|
+
]
|
|
210
|
+
},
|
|
211
|
+
"VCLinkerTool": {
|
|
212
|
+
"AdditionalDependencies": [
|
|
213
|
+
"Advapi32.lib",
|
|
214
|
+
"Shell32.lib",
|
|
215
|
+
"Ole32.lib",
|
|
216
|
+
"Uuid.lib",
|
|
217
|
+
"ws2_32.lib",
|
|
218
|
+
"psapi.lib",
|
|
219
|
+
"dbghelp.lib",
|
|
220
|
+
"version.lib",
|
|
221
|
+
"ntdll.lib",
|
|
222
|
+
"synchronization.lib",
|
|
223
|
+
"bcrypt.lib",
|
|
224
|
+
"Shlwapi.lib"
|
|
225
|
+
]
|
|
226
|
+
}
|
|
227
|
+
},
|
|
228
|
+
"defines": [
|
|
229
|
+
"_CRT_SECURE_NO_WARNINGS",
|
|
230
|
+
"_SCL_SECURE_NO_WARNINGS",
|
|
231
|
+
"_SILENCE_CXX17_ITERATOR_BASE_CLASS_DEPRECATION_WARNING",
|
|
232
|
+
"NOMINMAX",
|
|
233
|
+
"GLOG_NO_ABBREVIATED_SEVERITIES",
|
|
234
|
+
"GOOGLE_GLOG_DLL_DECL=",
|
|
235
|
+
"GFLAGS_IS_A_DLL=0",
|
|
236
|
+
"GLOG_USE_GLOG_EXPORT",
|
|
237
|
+
"GLOG_STATIC_DEFINE"
|
|
238
|
+
]
|
|
239
|
+
}
|
|
240
|
+
],
|
|
241
|
+
[
|
|
242
|
+
"OS=='linux'",
|
|
243
|
+
{
|
|
244
|
+
"libraries": [
|
|
245
|
+
"-lpthread",
|
|
246
|
+
"-ldl",
|
|
247
|
+
"-lz"
|
|
248
|
+
],
|
|
249
|
+
"cflags": [
|
|
250
|
+
"-fPIC"
|
|
251
|
+
],
|
|
252
|
+
"cflags_cc": [
|
|
253
|
+
"-fPIC",
|
|
254
|
+
"-std=c++17",
|
|
255
|
+
"-fexceptions"
|
|
256
|
+
]
|
|
257
|
+
}
|
|
258
|
+
],
|
|
259
|
+
[
|
|
260
|
+
"OS=='mac'",
|
|
261
|
+
{
|
|
262
|
+
"xcode_settings": {
|
|
263
|
+
"GCC_ENABLE_CPP_EXCEPTIONS": "YES",
|
|
264
|
+
"CLANG_CXX_LIBRARY": "libc++",
|
|
265
|
+
"MACOSX_DEPLOYMENT_TARGET": "10.15",
|
|
266
|
+
"OTHER_CPLUSPLUSFLAGS": [
|
|
267
|
+
"-std=c++17"
|
|
268
|
+
]
|
|
269
|
+
}
|
|
270
|
+
}
|
|
271
|
+
]
|
|
272
|
+
]
|
|
273
|
+
}
|
|
274
|
+
]
|
|
275
|
+
}
|
package/deps/README.md
ADDED
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
# Dependencies
|
|
2
|
+
|
|
3
|
+
This directory should contain the pre-compiled native dependencies.
|
|
4
|
+
|
|
5
|
+
## For CI (GitHub Actions)
|
|
6
|
+
Dependencies are automatically downloaded from the GitHub Release
|
|
7
|
+
asset `remill-deps-win32-x64.zip` during the prebuild workflow.
|
|
8
|
+
|
|
9
|
+
## For local development
|
|
10
|
+
Run the full rebuild pipeline from the monorepo:
|
|
11
|
+
```powershell
|
|
12
|
+
cd extensions/hexcore-remill
|
|
13
|
+
python _rebuild_mt.py
|
|
14
|
+
```
|
|
15
|
+
|
|
16
|
+
Or download the deps zip from the latest release:
|
|
17
|
+
```powershell
|
|
18
|
+
gh release download v0.1.0 -p "remill-deps-win32-x64.zip" -R LXrdKnowkill/hexcore-remill
|
|
19
|
+
Expand-Archive remill-deps-win32-x64.zip -DestinationPath .
|
|
20
|
+
```
|
package/index.d.ts
ADDED
|
@@ -0,0 +1,180 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* HexCore Remill - TypeScript Definitions
|
|
3
|
+
* N-API bindings for Remill — lifts machine code to LLVM IR bitcode
|
|
4
|
+
*
|
|
5
|
+
* Copyright (c) HikariSystem. All rights reserved.
|
|
6
|
+
* Licensed under MIT License.
|
|
7
|
+
*/
|
|
8
|
+
|
|
9
|
+
/// <reference types="node" />
|
|
10
|
+
|
|
11
|
+
/**
|
|
12
|
+
* Architecture name constants.
|
|
13
|
+
*
|
|
14
|
+
* These map to Remill's internal architecture identifiers.
|
|
15
|
+
* Pass one of these to the RemillLifter constructor.
|
|
16
|
+
*/
|
|
17
|
+
export const ARCH: {
|
|
18
|
+
/** 32-bit x86 (IA-32) */
|
|
19
|
+
readonly X86: 'x86';
|
|
20
|
+
/** 32-bit x86 with AVX extensions */
|
|
21
|
+
readonly X86_AVX: 'x86_avx';
|
|
22
|
+
/** 32-bit x86 with AVX-512 extensions */
|
|
23
|
+
readonly X86_AVX512: 'x86_avx512';
|
|
24
|
+
/** 64-bit x86 (AMD64 / x86-64) */
|
|
25
|
+
readonly AMD64: 'amd64';
|
|
26
|
+
/** 64-bit x86 with AVX extensions */
|
|
27
|
+
readonly AMD64_AVX: 'amd64_avx';
|
|
28
|
+
/** 64-bit x86 with AVX-512 extensions */
|
|
29
|
+
readonly AMD64_AVX512: 'amd64_avx512';
|
|
30
|
+
/** 64-bit ARM (AArch64 / ARMv8-A) */
|
|
31
|
+
readonly AARCH64: 'aarch64';
|
|
32
|
+
/** 32-bit SPARC (SPARCv8) */
|
|
33
|
+
readonly SPARC32: 'sparc32';
|
|
34
|
+
/** 64-bit SPARC (SPARCv9) */
|
|
35
|
+
readonly SPARC64: 'sparc64';
|
|
36
|
+
};
|
|
37
|
+
|
|
38
|
+
/**
|
|
39
|
+
* OS name constants for lifting context.
|
|
40
|
+
*
|
|
41
|
+
* The OS affects ABI conventions used during lifting (calling conventions,
|
|
42
|
+
* TLS access patterns, etc.). Defaults to LINUX if not specified.
|
|
43
|
+
*/
|
|
44
|
+
export const OS: {
|
|
45
|
+
readonly LINUX: 'linux';
|
|
46
|
+
readonly MACOS: 'macos';
|
|
47
|
+
readonly WINDOWS: 'windows';
|
|
48
|
+
readonly SOLARIS: 'solaris';
|
|
49
|
+
};
|
|
50
|
+
|
|
51
|
+
/**
|
|
52
|
+
* Result of a lift operation.
|
|
53
|
+
*/
|
|
54
|
+
export interface LiftResult {
|
|
55
|
+
/** Whether the lift succeeded */
|
|
56
|
+
success: boolean;
|
|
57
|
+
/** LLVM IR text representation of the lifted code */
|
|
58
|
+
ir: string;
|
|
59
|
+
/** Error message if success is false */
|
|
60
|
+
error: string;
|
|
61
|
+
/** Start address of the lifted code */
|
|
62
|
+
address: number;
|
|
63
|
+
/** Number of input bytes that were successfully consumed */
|
|
64
|
+
bytesConsumed: number;
|
|
65
|
+
}
|
|
66
|
+
|
|
67
|
+
/**
|
|
68
|
+
* Remill lifter class.
|
|
69
|
+
*
|
|
70
|
+
* Creates a lifter instance bound to a specific architecture. The lifter
|
|
71
|
+
* translates raw machine code bytes into LLVM IR text, which can then be
|
|
72
|
+
* analyzed, optimized, or passed to a decompiler like Rellic.
|
|
73
|
+
*
|
|
74
|
+
* Each lifter owns an LLVM context and a loaded semantics module, so it
|
|
75
|
+
* is relatively heavyweight. Reuse instances when lifting multiple blocks
|
|
76
|
+
* of the same architecture.
|
|
77
|
+
*
|
|
78
|
+
* @example
|
|
79
|
+
* ```typescript
|
|
80
|
+
* import { RemillLifter, ARCH, OS } from 'hexcore-remill';
|
|
81
|
+
*
|
|
82
|
+
* // Lift x86-64 code
|
|
83
|
+
* const lifter = new RemillLifter(ARCH.AMD64);
|
|
84
|
+
* const code = Buffer.from([0x55, 0x48, 0x89, 0xe5, 0x5d, 0xc3]);
|
|
85
|
+
* const result = lifter.liftBytes(code, 0x401000);
|
|
86
|
+
*
|
|
87
|
+
* if (result.success) {
|
|
88
|
+
* console.log(result.ir);
|
|
89
|
+
* console.log(`Consumed ${result.bytesConsumed} bytes`);
|
|
90
|
+
* } else {
|
|
91
|
+
* console.error(result.error);
|
|
92
|
+
* }
|
|
93
|
+
*
|
|
94
|
+
* lifter.close();
|
|
95
|
+
* ```
|
|
96
|
+
*
|
|
97
|
+
* @example
|
|
98
|
+
* ```typescript
|
|
99
|
+
* // Lift with Windows ABI context
|
|
100
|
+
* const lifter = new RemillLifter(ARCH.AMD64, OS.WINDOWS);
|
|
101
|
+
* ```
|
|
102
|
+
*
|
|
103
|
+
* @example
|
|
104
|
+
* ```typescript
|
|
105
|
+
* // Async lifting for large buffers
|
|
106
|
+
* const lifter = new RemillLifter(ARCH.AMD64);
|
|
107
|
+
* const largeCode = fs.readFileSync('section.bin');
|
|
108
|
+
* const result = await lifter.liftBytesAsync(largeCode, 0x140001000);
|
|
109
|
+
* lifter.close();
|
|
110
|
+
* ```
|
|
111
|
+
*/
|
|
112
|
+
export class RemillLifter {
|
|
113
|
+
/**
|
|
114
|
+
* Create a new Remill lifter for the given architecture.
|
|
115
|
+
*
|
|
116
|
+
* @param arch - Architecture name (use ARCH constants)
|
|
117
|
+
* @param os - OS name for ABI context (optional, defaults to 'linux')
|
|
118
|
+
* @throws Error if architecture is unsupported or semantics fail to load
|
|
119
|
+
*/
|
|
120
|
+
constructor(arch: string, os?: string);
|
|
121
|
+
|
|
122
|
+
/**
|
|
123
|
+
* Lift raw machine code bytes to LLVM IR (synchronous).
|
|
124
|
+
*
|
|
125
|
+
* Decodes and lifts instructions starting at the given address.
|
|
126
|
+
* Stops at the first instruction that cannot be decoded or lifted.
|
|
127
|
+
*
|
|
128
|
+
* For large buffers (>64KB), prefer `liftBytesAsync()`.
|
|
129
|
+
*
|
|
130
|
+
* @param code - Buffer containing raw machine code
|
|
131
|
+
* @param address - Virtual address of the first byte
|
|
132
|
+
* @returns Lift result with LLVM IR text
|
|
133
|
+
*/
|
|
134
|
+
liftBytes(code: Buffer | Uint8Array, address: number | bigint): LiftResult;
|
|
135
|
+
|
|
136
|
+
/**
|
|
137
|
+
* Lift raw machine code bytes to LLVM IR (asynchronous).
|
|
138
|
+
*
|
|
139
|
+
* Runs the lifting in a background thread to avoid blocking the
|
|
140
|
+
* event loop. Use this for large code sections.
|
|
141
|
+
*
|
|
142
|
+
* @param code - Buffer containing raw machine code
|
|
143
|
+
* @param address - Virtual address of the first byte
|
|
144
|
+
* @returns Promise resolving to lift result
|
|
145
|
+
*/
|
|
146
|
+
liftBytesAsync(code: Buffer | Uint8Array, address: number | bigint): Promise<LiftResult>;
|
|
147
|
+
|
|
148
|
+
/**
|
|
149
|
+
* Get the architecture name this lifter was created with.
|
|
150
|
+
* @returns Architecture name string
|
|
151
|
+
*/
|
|
152
|
+
getArch(): string;
|
|
153
|
+
|
|
154
|
+
/**
|
|
155
|
+
* Release native resources (LLVM context, semantics module).
|
|
156
|
+
*
|
|
157
|
+
* Always call this when done to prevent memory leaks.
|
|
158
|
+
* The lifter cannot be used after calling close().
|
|
159
|
+
*/
|
|
160
|
+
close(): void;
|
|
161
|
+
|
|
162
|
+
/**
|
|
163
|
+
* Check if the lifter is still open and usable.
|
|
164
|
+
* @returns true if open
|
|
165
|
+
*/
|
|
166
|
+
isOpen(): boolean;
|
|
167
|
+
|
|
168
|
+
/**
|
|
169
|
+
* Get list of supported architecture names.
|
|
170
|
+
* @returns Array of architecture name strings
|
|
171
|
+
*/
|
|
172
|
+
static getSupportedArchs(): string[];
|
|
173
|
+
}
|
|
174
|
+
|
|
175
|
+
/**
|
|
176
|
+
* Module version string.
|
|
177
|
+
*/
|
|
178
|
+
export const version: string;
|
|
179
|
+
|
|
180
|
+
export default RemillLifter;
|
package/index.js
ADDED
|
@@ -0,0 +1,60 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* HexCore Remill - Native Node.js Bindings
|
|
3
|
+
* Lifts machine code to LLVM IR bitcode via Remill
|
|
4
|
+
*
|
|
5
|
+
* Copyright (c) HikariSystem. All rights reserved.
|
|
6
|
+
* Licensed under MIT License.
|
|
7
|
+
*
|
|
8
|
+
* @example
|
|
9
|
+
* const { RemillLifter, ARCH } = require('hexcore-remill');
|
|
10
|
+
*
|
|
11
|
+
* const lifter = new RemillLifter(ARCH.AMD64);
|
|
12
|
+
* const code = Buffer.from([0x55, 0x48, 0x89, 0xe5, 0xc3]);
|
|
13
|
+
* const result = lifter.liftBytes(code, 0x401000);
|
|
14
|
+
*
|
|
15
|
+
* if (result.success) {
|
|
16
|
+
* console.log(result.ir);
|
|
17
|
+
* }
|
|
18
|
+
*
|
|
19
|
+
* lifter.close();
|
|
20
|
+
*/
|
|
21
|
+
|
|
22
|
+
'use strict';
|
|
23
|
+
|
|
24
|
+
const platformDir = './prebuilds/' + process.platform + '-' + process.arch + '/';
|
|
25
|
+
|
|
26
|
+
let binding;
|
|
27
|
+
const errors = [];
|
|
28
|
+
|
|
29
|
+
// prebuildify uses binding.gyp target name (underscore)
|
|
30
|
+
// prebuild-install uses package name (hyphen)
|
|
31
|
+
// Try both conventions for maximum compatibility
|
|
32
|
+
const candidates = [
|
|
33
|
+
{ label: 'prebuild (underscore)', path: platformDir + 'hexcore_remill.node' },
|
|
34
|
+
{ label: 'prebuild (hyphen)', path: platformDir + 'hexcore-remill.node' },
|
|
35
|
+
{ label: 'build/Release', path: './build/Release/hexcore_remill.node' },
|
|
36
|
+
{ label: 'build/Debug', path: './build/Debug/hexcore_remill.node' },
|
|
37
|
+
];
|
|
38
|
+
|
|
39
|
+
for (const candidate of candidates) {
|
|
40
|
+
try {
|
|
41
|
+
binding = require(candidate.path);
|
|
42
|
+
break;
|
|
43
|
+
} catch (e) {
|
|
44
|
+
errors.push(` ${candidate.label}: ${e.message}`);
|
|
45
|
+
}
|
|
46
|
+
}
|
|
47
|
+
|
|
48
|
+
if (!binding) {
|
|
49
|
+
throw new Error(
|
|
50
|
+
'Failed to load hexcore-remill native module.\n' +
|
|
51
|
+
'Errors:\n' + errors.join('\n')
|
|
52
|
+
);
|
|
53
|
+
}
|
|
54
|
+
|
|
55
|
+
module.exports = binding;
|
|
56
|
+
module.exports.default = binding.RemillLifter;
|
|
57
|
+
module.exports.RemillLifter = binding.RemillLifter;
|
|
58
|
+
module.exports.ARCH = binding.ARCH;
|
|
59
|
+
module.exports.OS = binding.OS;
|
|
60
|
+
module.exports.version = binding.version;
|
package/index.mjs
ADDED
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* HexCore Remill - ESM Wrapper
|
|
3
|
+
* ECMAScript Module support for modern Node.js
|
|
4
|
+
*
|
|
5
|
+
* Copyright (c) HikariSystem. All rights reserved.
|
|
6
|
+
* Licensed under MIT License.
|
|
7
|
+
*/
|
|
8
|
+
|
|
9
|
+
import { createRequire } from 'module';
|
|
10
|
+
const require = createRequire(import.meta.url);
|
|
11
|
+
|
|
12
|
+
const remill = require('./index.js');
|
|
13
|
+
|
|
14
|
+
export const { RemillLifter, ARCH, OS, version } = remill;
|
|
15
|
+
|
|
16
|
+
export default RemillLifter;
|