Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/gmh5225/awesome-llvm-security/binary-liftingnpx skills add gmh5225/awesome-llvm-security --skill binary-liftinggit clone --depth 1 https://github.com/gmh5225/awesome-llvm-securityWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gmh5225/awesome-llvm-security/binary-lifting)<a href="https://agentmods.dev/skills/gmh5225/awesome-llvm-security/binary-lifting"><img src="https://agentmods.dev/badge/skills/gmh5225/awesome-llvm-security/binary-lifting.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00053 | $0.01160 |
| Opus 5 | $0.00026 | $0.00580 |
| Sonnet 5 | $0.00011 | $0.00232 |
| Haiku 4.5 | $0.00005 | $0.00116 |
Grade A, and why
binary-lifting scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Binary Lifting Skill
This skill covers techniques and tools for lifting binary executables to LLVM IR, enabling advanced analysis, transformation, and recompilation of existing binaries.
Core Concepts
What is Binary Lifting?
Binary lifting is the process of translating low-level machine code (x86, ARM, etc.) into a higher-level intermediate representation (LLVM IR), enabling:
- Static and dynamic analysis
- Deobfuscation and vulnerability research
- Code recompilation and optimization
- Cross-architecture translation
Lifting Pipeline
Binary → Disassembly → IR Generation → Optimization → Analysis/Recompilation
Major Lifting Frameworks
Production-Grade Tools
- RetDec (Avast): Full decompiler with C output, multi-architecture support
- McSema (Trail of Bits): x86/x64 to LLVM IR, function recovery
- revng: Based on QEMU, supports multiple architectures
- reopt (Galois): Focus on correctness and formal methods
Research/Specialized Tools
- Rellume: Fast x86-64 to LLVM lifting for JIT scenarios
- fcd: Pattern-based decompiler with optimization passes
- bin2llvm: QEMU-based binary to LLVM translator
- llvm-mctoll: Microsoft's machine code to LLVM lifter
Language-Specific Lifters
- llvm2c/IR->C: Convert LLVM IR back to C code
- llvm2cranelift: LLVM IR to Cranelift IR
- Leaven: LLVM IR to Go language
- masxinlingvonta: JVM bytecode to LLVM IR
Implementation Techniques
Instruction Semantics Translation
// Example: Translating x86 ADD to LLVM IR
Value* translateADD(IRBuilder<> &builder, Value* op1, Value* op2) {
Value* result = builder.CreateAdd(op1, op2, "add_result");
// Update flags (CF, OF, SF, ZF, etc.)
updateCarryFlag(builder, op1, op2, result);
updateOverflowFlag(builder, op1, op2, result);
updateSignFlag(builder, result);
updateZeroFlag(builder, result);
return result;
}
Control Flow Recovery
- Linear Sweep: Simple but misses code with embedded data
- Recursive Descent: Follow control flow, better coverage
- Speculative Disassembly: Handle indirect jumps/calls
- Machine Learning: Use ML to identify function boundaries
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 150 lines · 53 tokens per session scan A b3b7ac1c01cc
binary-lifting is a skill published in the GitHub repository gmh5225/awesome-llvm-security (877 stars, last pushed 21d ago), licensed MIT. It adds 53 tokens to every session and 1,160 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
th08-semantic
Replace raw TH08 object offsets, anonymous fields, and absolute field views with evidence-backed C++ types and names while preserving accepted VC7 bytes and playable modern-port behavior. Use for semantic cleanup of already-authored source; do not use for new function recovery or target-linked library work.
clangd-graph-rag
This skill enables deep semantic and structural analysis of C/C++ codebases using a pre-built Neo4j GraphRAG. It provides insights into call chains, class hierarchies, macro causality, and type aliases.
porting-from-orig-cpp
Use when reading the vendored C++ tree at origcpp/ to decide what llvmkit should do — porting an LLVM routine or one of its arms, changing a diagnostic message or its caret anchor, reviewing a diff that claims parity, explaining why llvmkit and LLVM answer differently on some input, or judging a fix by whether probe…
rynix
Honest agent guide for the Rynix systems language — compile with rynixc, use MCP tools and NDJSON diagnostics, never invent stub domains or End-style feature/skill keywords.
matlab
Build, review, migrate, and safely plan MATLAB or GNU Octave numerical workflows, including arrays, tabular/time data, tests, projects, graphics, MAT files, and explicit Python interoperability.
ast-grep
Guide for writing ast-grep rules to perform structural code search and analysis. Use when users need to search codebases using Abstract Syntax Tree (AST) patterns, find specific code structures, or perform complex code queries that go beyond simple text search. This skill should be used when users ask to search for…