TCG (Tiny Code Generator) intermediate representation

[Google Scholar]

Notes: QEMU, binary lifter, ISA specification
Papers:

Several binary lifter tools use the TCG API from QEMU as an intermediate representation. In effect, they are using QEMU as an ISA specification for the ISA being emulated.

QEMU, rev.ng reverse engineering tool

  • Rev.Ng: A unified binary analysis framework to recover CFGs and function boundaries [difederico:cc:2017]