Introducing Nyxstone: An LLVM-based (Dis)assembly Framework Product June 26, 2024 Darius Hartlief and Tim Blazytko At Emproof, our mission is to enhance the security and integrity of embedded systems through innovative binary rewriting techniques. We are committed to providing advanced solutions that protect (embedded) software against reverse engineering and exploitation. Our flagship product, Emproof Nyx, achieves this by offering static binary instrumentation to add protection measures such as code obfuscation, anti-debugging and anti-tamper checks as well as exploit mitigations such as stack canaries and control-flow integrity into customer binaries. Binary rewriting is a compiler and programming-language agnostic approach, which provides us with a high level of flexibility to modify and harden customer code. At a high-level, binary rewriting follows three main steps: First, the existing binary is lifted into an intermediate representation, which is architecture-independent. Next, transformations are applied to this lifted representation. Finally the transformed representation is lowered to machine code and written back into the binary. To be able to effectively implement the first and third steps, Emproof Nyx heavily relies on functionality for assembling and disassembling instructions. Initially, we relied on two established solutions for these tasks, namely Capstone for disassembling and Keystone for assembling. While these solutions were a good fit in the beginning, we shortly noticed that these frameworks are not well-suited for our needs, especially since Keystone lacked important features and is also error-prone. It often emitted machine code that was slightly incorrect and did not report errors during the assembly process properly. Another missing feature was the support of labels in the assembler: Any label referenced in the assembly needs to be a part of it and can not be defined to reference an address. To tackle these problems, we decided that we nee...
First seen: 2025-09-04 05:59
Last seen: 2025-09-04 05:59