Enabling Vulnerability Detection in RISC-V based Binaries through Lifting RISC-V ISA to LLVM

Kurzfassung

Binary analysis techniques are commonly used to identify security vulnerabilities in software. However, many established analysis tools rely on intermediate representations that are primarily designed for specific architectures or require dedicated front ends. The growing relevance of the RISC-V instruction set architecture therefore motivates the development of approaches that enable the analysis of RISC-V binaries using existing analysis infrastructures. This thesis investigates the lifting of RISC-V binaries to LLVM IR as a foundation for subsequent vulnerability detection. A prototype lifting pipeline was developed that processes RISC-V ELF binaries in multiple stages. First, executable code and function information are extracted from the input binary. The contained instructions are then identified using a custom decoder and transformed into an internal representation. Based on the decoded instructions, basic blocks and a control-flow graph are constructed. SSA form is subsequently generated using a dominator-based approach, including the placement of φ-nodes and variable renaming. Finally, the resulting repre­ sentation is translated into LLVM IR. The implementation focuses on the RV64I base instruction set and supports a selected subset of instructions identified through an analysis of representative compiled pro­grams. The generated LLVM IR was evaluated using several test programs and compared with the expected program structure and behavior. The results demonstrate that the implemented pipeline can successfully reconstruct control flow and translate supported RISC-V instructions into valid LLVM IR for the considered examples. The prototype also reveals limitations of the current approach, particularly regarding incomplete instruction coverage, indirect control-flow transfers, interprocedural analy­sis, and the simplified memory model. Consequently, the presented implementation does not perform vulnerability detection directly, but provides a basis for integrating RISC-V binaries into LLVM-based analysis frameworks. Future work can extend the instruction coverage, improve the modelling of memory and control flow, and connect the generated LLVM IR to established vulnerability detection techniques.