rev.ng is the name of the core technology we develop. It is fully open source. With rev.ng you can lift a binary to a recompilable LLVM module, recompile it for a different architecture, fuzz it, perform instrumenation and run various analyses we provide or write your own.

Download

Supported platforms

Image formats
ELF, preliminary PE/COFF support.
Architectures
x86, x86-64, ARM, MIPS, s390x, AArch64 (WIP).

Recompilation

Static binary translation
rev.ng can successfully translate large binaries from one architecture to another preserving functionality. As an example, we can translate the Perl interpreter, GCC and Xalan-C++ from x86-64 to x86-64.
Instrumentation
Translated programs can be easily instrumented for any purpose. For a simple example check out the Python script (documented version) instrumenting an arbitrary program to dump the identifier of each syscall before its performed.
Fuzzing
Translated programs can be fuzzed employing coverage-guided fuzzing (the same technique employed by afl). This is possible thanks to the fact that we employ LLVM and libFuzzer (see the dedicated paper).
In-place patching
In case full program translation is not a viable option, we're also building a solution to unobtrusively replace individual functions in an existing program.
Symbolic execution
We plan to offer to our users the possibility to perform symbolic execution on the LLVM IR obtained by rev.ng using KLEE.

Analysis

CFG recovery
rev.ng can recover an highly accurate control-flow graph across multiple architectures, including jump tables due to switch statements, sophisticated and hand-optimized low-level routines and even restrict the set of possible destination for indirect function calls using information about the detect list of arguments and return value.
Function boundaries detection
rev.ng features an accurate algorithm to detect function boundaries which can also identify outlined functions.
Function arguments detection
rev.ng integrates an innovative argument detection technique that is, not only architecture-independent, but also ABI-agnostic, which ensures accurate results when aggressive optimizations are in place.

Extensibility

C++
rev.ng is written in C++ and follows the good practices of the LLVM codebase. Since our internal format is the LLVM IR, the rev.ng-specific knowledge to acquire is very limited.
C
Since LLVM offers a C API, it is possible to interact with rev.ng directly from C and, therefore, from any language featuring a C-comatible FFI.
Python
We maintain our own Python interface to LLVM: llvmcpy. It's great for quick and dirty operations or prototyping analyses.

Explore rev.ng-c features

Why don't you subscribe to our newsletter?
rev.ng Srls - P. IVA: IT02776470359 - Via San Martino 23 - 42121 - Reggio Emilia, Italy -
Twitter - GitHub - Privacy policy
This website doesn't use JavaScript, cookies and it's fully statically generated (inspiration).