The HydIR project
What is HydIR?
HydIR is an open-source binary analysis and transformation workbench written in Rust. It connects executable bytes to Ghidra P-code, native intermediate representations, C views, and the evidence behind each result.
Get started → Browse documentation →
Latest articles and explainers# Ghidra P-code, Explained 2026-09-30 Binary lifting
From Bitvectors to Behavior 2026-09-21 Mathematics
From Graphs to Code 2026-09-21 Compiler theory
All articles →
How HydIR works# Start with one ELF. Follow static analysis, a recorded execution, or bounded symbolic exploration. Select a path to highlight its inputs and outputs.
All connections Ghidra path Native path Seeded execution Frida observation Triton exploration
Inside HydIR: bytes, state, and evidence ELF bytes feed a managed Ghidra frontend or independent native frontend. Their artifacts support bounded analysis. Explicit seeds enable concrete execution; type models inform native typed views. Frida records one input-specific execution. Triton explores bounded instruction paths and produces candidate models. These routes remain separate from LLVM and native C generation. explicit execution inputs one binary identity typed-view evidence
ELF bytes + SHA-256 source addresses / selected function same bytes, distinct workflows Execution seed register values + known RAM used by concrete tracing AnalysisModel types / prototypes / objects evidence for typed C views Ghidra-backed analysis Managed Ghidra → raw P-code snapshot / CFG / source-linked operations Choose: trace / slice / bounded LLVM tracing needs a seed; each route has limits Coverage / results / explicit stops Independent native analysis ProgramSpec / FunctionIndex function extents + discovery evidence MachineIR → StateIR → FunctionIR machine effects / SSA / ABI evidence CIR → C views LLVM export optional Inspect artifacts and their evidence Desktop · CLI · Python SDK · authenticated service 04 / observe one execution 05 / explore a bounded model
Frida · concrete observation
ELF + InputSpec + selected address argv / files / explicit budgets
Run the isolated Linux observer Windows uses the separately installed WSL2 worker
DynamicTrace: witnessed path events binary-bound, input-specific, bounded output
Inspect / compare / recover targets Ghidra comparison needs a validated snapshot
One run does not enumerate every possible target. Triton · symbolic exploration
Selected x86-64 function + state concrete seed / selected symbolic inputs
Optional Python / Triton bridge instruction semantics / bounded path exploration
Expressions → conditions → solver candidates under the supplied state and limits
Inspect model / validate concretely concrete validation is a separate operation
Not an LLVM or native C generation stage. Read the evidence before making a claim artifact identity · inputs · budgets · stops · validation Static analysis, concrete observation, and symbolic exploration establish different claims. Inspect each artifact with its inputs and limits. Arrows indicate artifact or input dependencies. Trace, slice, and LLVM are alternative Ghidra operations. Native LLVM exports from FunctionIR; native C generation uses CIR. Frida witnesses one input-specific run; optional comparisons and rediscovery use validated Ghidra evidence. Triton operates on bounded machine-instruction paths, independently of LLVM and native C generation. A solver candidate needs separate concrete validation. Explore the full architecture .
Ghidra analysis and call tracing Raw P-code, saved projects, slices, and bounded LLVM. Native decompilation and typed models MachineIR through CIR, DWARF evidence, and editable analysis facts. Frida observation and native replay Input-specific events, Windows WSL worker, captured state, and recipes. Transformation and patch artifacts LLVM experiments, restricted replacement, and rebuild contracts. CLI, Python SDK, and authenticated service Digest-checked artifacts and revisioned project operations. Know what the output establishes# HydIR keeps recovery, semantic fidelity, observed execution, and rewrite readiness separate. Unknown targets and opaque effects remain visible. Read the evidence and release gates alongside generated code.
