QEMU

QEMU
[Google Scholar]

Notes: TCG IR, ISA specification
Papers:

rev.ng reverse engineering tool, S2E verifier, TCG (Tiny Code Generator) intermediate representation