Modify IL without changing machine code

[Ephemerua]

Binja's IL is pretty cool, but I found currently the IL cannot be modified, it could only reflect assembly's change.
To do analysis such as deobfuscation, I think it makes sense to be able to modify LLIL or MLIL directly, because it is very cumbersome to directly modify the asm, and different architectures need different patch ways. Besides, most of the time I just want neat pseudo C code rather than a clean binary file.

Does/Will binja provide a ILBuilder API like LLVM's IRBuilder that allows users to construct IL directly?

[brinlyau]

Not a BINJA dev but: can’t you just do an analysis pass? (Also there’s a C-like pseudo codeview now)

…

On Thu, 28 Apr 2022 at 21:53, Ephemerua ***@***.***> wrote: Binja's IL is pretty cool, but I found currently the IL cannot be modified, it could only reflect assembly's change. To do analysis such as deobfuscation, I think it makes sense to be able to modify LLIL or MLIL directly, because it is very cumbersome to directly modify the asm, and different architectures need different patch ways. Besides, most of the time I just want neat pseudo C code rather than a clean binary file. Does/Will binja provide a ILBuilder API like LLVM's IRBuilder that allows users to construct IL directly? — Reply to this email directly, view it on GitHub <#3096>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABECH2IMFLK2NLOQ4FUEBDTVHJ34TANCNFSM5USEW2WA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[psifertex]

Yup! Analysis passes (or workflows as they are called now) enable you to modify the IL and are designed for exactly such a use case as this:

https://github.com/Vector35/binaryninja-api/tree/dev/examples/workflows

[Ephemerua]

Wow thanks!! I will look into that.

[brinlyau]

you should probably not mark my answer as “selected” - mark jordans one until I expand with more info but that may be a couple days bc I’m on mobile :)

[psifertex]

It's the thread that gets selected. You were spot on, I intentionally replied instead of starting a new thread 😉