Tool

Rellic

Trail of Bits implementation of the pattern-independent structuring algorithm from the No More Gotos paper, turning LLVM bitcode into goto-free C as a small, hackable decompiler back end that interoperates with LLVM and Remill. rellic-decomp translates a bitcode module to C in batch, rellic-xref serves a web interface for choosing refinement passes and linking C AST nodes to the bitcode that produced them, and rellic-headergen emits C layouts of data structures from a module's DWARF metadata. Machine code must first be lifted to bitcode by another tool; a bundled IDA script uses Anvill for that step.

Targets: Binary
Category: Binary analysis libraries
Relationship: Foundation tool
Sources reviewed: 2026-10-19

Requirements & limits

Latest release at review: v0.2.3, published 2023-04-04, with LLVM 15 builds: deb and tgz packages for Ubuntu 20.04 and a tgz package for macOS 11. The reviewed master commit (2025-11-03) is 13 commits ahead and comments out the AnghaBench CI cron jobs; the code commits before it date from April 2024.
The README supports Linux, tested on Ubuntu 22.04, and also documents a macOS build. Building needs CMake 3.21+, LLVM and Clang 16, Z3 4.7.1+, gflags and glog, most of which come from Trail of Bits' prebuilt cxx-common packages; scripts/build.sh downloads the rest and produces a deb package. Docker images on Docker Hub and the GitHub Package Registry are parameterized by Ubuntu and LLVM version.
Input is an LLVM bitcode module built with the same LLVM version as the decompiler. C sources can be compiled with clang -emit-llvm, but executables need a separate lifter such as Remill or Anvill. The README's examples show output whose control flow and variable types differ from the original source, and its AnghaBench 1,000-program test only checks that bitcode translates to C, not the readability or behavior of the result.
Apache-2.0 license. The roundtrip tests compile C to IR and back and check that the result builds and behaves roughly like the original. By default rellic-xref listens on all addresses, on port 80.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · lifting-bits/rellic · Revision 370abaa
README.md#L179-L326 GitHub · lifting-bits/rellic · Revision 370abaa
docs/NoMoreGotos.pdf GitHub · lifting-bits/rellic · Revision 370abaa
tools/xref/README.md GitHub · lifting-bits/rellic · Revision 370abaa
tools/headergen/README.md GitHub · lifting-bits/rellic · Revision 370abaa
tools/plugins/ida-rellic.py GitHub · lifting-bits/rellic · Revision 370abaa
CMakeLists.txt GitHub · lifting-bits/rellic · Revision 370abaa
LICENSE GitHub · lifting-bits/rellic · Revision 370abaa
https://github.com/lifting-bits/rellic/releases/tag/v0.2.3
https://github.com/lifting-bits/rellic/compare/v0.2.3...370abaad86ae5adad82f85b81aff14557462b7f2

More in Native binaries

All 269 entries in Native binaries