GTIRB: Intermediate Representation for Binaries

TL;DR

GTIRB is a versatile intermediate representation for binary analysis tools that promotes modularity, reusability, and interoperability across different binary formats and analysis domains.

Contribution

It introduces GTIRB, a domain-agnostic intermediate format that enables effective communication and comparison among binary analysis and rewriting tools.

Findings

Supports multiple binary formats like PE and ELF

Facilitates tool modularization and reuse

Enhances communication between binary analysis tools

Abstract

GTIRB is an intermediate representation for binary analysis and rewriting tools including disassemblers, lifters, analyzers, rewriters, and pretty-printers. GTIRB is designed to enable communication between tools in a format that provides the basic information necessary for analysis and rewriting while making no further assumptions about domain (e.g., malware vs. cleanware, or PE vs. ELF) or semantic interpretation (functional vs. operational semantics). This design supports the goals of (1) encouraging tool modularization and re-use allowing researchers and developers to focus on a single aspect of binary analysis and rewriting without committing to any single tool chain and (2) facilitating communication and comparison between tools.