{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/NaC-L/Mergen/blob/199805706ac00e156cc7e2a53ccc647c380f1786/docs/SCOPE.md",
    "https://github.com/NaC-L/Mergen/blob/199805706ac00e156cc7e2a53ccc647c380f1786/docs/BUILDING.md",
    "https://github.com/NaC-L/Mergen/blob/199805706ac00e156cc7e2a53ccc647c380f1786/docs/REWRITE_BASELINE.md",
    "https://github.com/NaC-L/Mergen/blob/199805706ac00e156cc7e2a53ccc647c380f1786/ARCHITECTURE.md",
    "https://github.com/NaC-L/Mergen/blob/199805706ac00e156cc7e2a53ccc647c380f1786/README.md#L181",
    "https://github.com/NaC-L/Mergen/blob/199805706ac00e156cc7e2a53ccc647c380f1786/lifter/core/Utils.cpp",
    "https://github.com/NaC-L/Mergen/blob/199805706ac00e156cc7e2a53ccc647c380f1786/Dockerfile",
    "https://github.com/NaC-L/Mergen/blob/199805706ac00e156cc7e2a53ccc647c380f1786/.gitmodules",
    "https://github.com/NaC-L/Mergen/blob/199805706ac00e156cc7e2a53ccc647c380f1786/LICENSE",
    "https://github.com/NaC-L/Mergen/releases/tag/v0.7"
  ],
  "category": "native-analysis",
  "description_en": "Function-level lifter that symbolically lifts one x86-64 function from a Windows PE binary into LLVM IR, then iterates LLVM and custom passes to a fixpoint so obfuscated or virtualized code reduces to simpler control flow and semantics for analysis. Its scope document lists 119 instruction handlers, two-way branches and tested jump-table shapes; README examples lift small test functions the authors protected with VMProtect and Themida, and the IR can be compiled for viewing in a decompiler.",
  "description_zh": "函数级提升器：对 Windows PE 二进制中的单个 x86-64 函数进行符号化提升，生成 LLVM IR，再反复运行 LLVM 与自定义优化 pass 直至收敛，使经混淆或虚拟化的代码化简为更清晰的控制流和语义，便于分析。其范围文档列出 119 个指令处理器，支持双向分支和若干已测试的跳转表形态；README 示例提升的是作者自己用 VMProtect 和 Themida 保护的小型测试函数，输出的 IR 可编译后在反编译器中查看。",
  "entry_url": "https://awesomerea.org/resources/mergen/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/mergen/",
  "evidence_url": "https://github.com/NaC-L/Mergen/blob/199805706ac00e156cc7e2a53ccc647c380f1786/README.md",
  "group": "tools",
  "id": "mergen",
  "json_url": "https://awesomerea.org/resources/mergen/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/mergen/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/mergen/index.md",
  "name": "Mergen",
  "name_zh": "Mergen 反混淆 LLVM IR 提升器",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v0.7, published 2026-03-29, with Windows lifter and microtest executables for the iced and Zydis decoder backends. The reviewed main commit, dated 2026-05-08, is 150 commits past the later v0.8 tag, which has no release. docs/SCOPE.md limits support to x86-64 PE files and one function per run: 32-bit x86, other formats and architectures, self-modifying code, floating-point or AVX code beyond the listed SSE2 integer instructions and whole-binary lifting are unsupported, and general-purpose decompilation is a non-goal.",
    "The lifter takes a PE file and the target function's address, with optional --outline addresses; analysts supply their own binaries. The VMProtect check runs against local protected samples that are not committed, and the reviewed tree holds source, assembly and C test sources and documentation rather than prebuilt executables. Output is LLVM IR text plus output_diagnostics.json, which records unresolved indirect jumps and returns.",
    "Developed and CI-tested mainly on Windows with CMake, Ninja, clang-cl using MSVC headers and libraries, LLVM 18 and Rust/Cargo for the default iced backend; the Zydis-only lane builds from a vendored Zydis 4.1.0 amalgamation, and linux-pe is a git submodule. A secondary Ubuntu 22.04 Dockerfile builds and exports a Linux lifter.",
    "docs/SCOPE.md reports 115 of 119 handlers covered by a Unicorn-generated oracle suite, 33 semantic samples with 177 runtime cases checked under lli, golden IR hashes and Windows build lanes in CI, and says reliability on protected code varies by protection level. The README's branch example still says jumps with more than two targets are unsupported, while the newer scope document lists tested jump-table shapes. These gates cover the project's own compiled samples, not arbitrary protected software.",
    "LICENSE is GPL-3.0; the vendored Zydis source and the submodule keep their own licenses. Lifted IR still needs analyst validation."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v0.7，发布于 2026-03-29，提供 iced 与 Zydis 两种解码后端的 Windows 版 lifter 和微测试可执行文件。所审阅的 main 分支提交日期为 2026-05-08，比随后打上的 v0.8 标签多 150 个提交，而该标签没有对应的发布版本。docs/SCOPE.md 将支持范围限定为 x86-64 PE 文件，且每次只处理一个函数：不支持 32 位 x86、其他文件格式与架构、自修改代码、所列 SSE2 整数指令之外的浮点或 AVX 代码，也不支持提升整个二进制；通用反编译不在项目目标之内。",
    "lifter 接收一个 PE 文件和目标函数地址，可用 --outline 指定不内联的地址；待分析的二进制须由分析者自行提供。VMProtect 检查使用的是未提交到仓库的本地受保护样本；所审阅的源码树只含源码、汇编和 C 测试源码及文档，没有预构建的可执行文件。输出为 LLVM IR 文本和 output_diagnostics.json，后者记录未能解析的间接跳转与返回。",
    "主要在 Windows 上开发并进行 CI 测试，需要 CMake、Ninja、使用 MSVC 头文件和库的 clang-cl 以及 LLVM 18，默认的 iced 后端还需要 Rust/Cargo；仅用 Zydis 的构建路线使用仓库附带的 Zydis 4.1.0 合并源码，linux-pe 以 git 子模块引入。另有一个次要的 Ubuntu 22.04 Dockerfile，用于构建并导出 Linux 版 lifter。",
    "docs/SCOPE.md 报告：119 个处理器中有 115 个由 Unicorn 生成的预言（oracle）测试集覆盖，CI 用 lli 运行 33 个语义样本共 177 个运行时用例，并检查黄金 IR 哈希和 Windows 构建；文档还指出，对受保护代码的可靠性随保护级别而异。README 的分支示例仍称不支持超过两个目标的跳转，而较新的范围文档已列出若干经测试的跳转表形态。这些检查针对项目自行编译的样本，不涵盖任意受保护软件。",
    "LICENSE 为 GPL-3.0；附带的 Zydis 源码和子模块保留各自的许可证。提升得到的 IR 仍需分析者核实。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/NaC-L/Mergen",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}