From bytes to artifacts

Follow the bytes through HydIR

When you open an ELF, HydIR first records what is in the file. It then follows control flow for a selected function, lifts the instructions it understands, and checks generated output with trusted fixtures. A stop at one step does not undo what an earlier step found.

1. Inventory the ELF

The native importer reads a little-endian x86-64 ELF and records file-derived sections, load mappings, symbols, imports, and relocations. Ordinary inspection does not pretend that an empty call or reference list proves there are none; recovery state is explicit. The desktop's broader disassembly scan marks uncertain uncovered regions.

2. Recover a bounded CFG

For a selected function symbol or analyst-supplied entry and byte extent, iced-x86 decodes reachable instructions and follows direct branches. Recovery rejects overlapping instructions and edges outside the declared extent. The CFG retains instruction addresses, original bytes, edge kinds, and scope provenance.

3. Lift supported machine state

The scalar lift accepts an explicit SysV AMD64 u64(u64,u64) assertion. It tracks the supported registers and flags across CFG blocks, rejects reads that may be uninitialized, and emits LLVM IR with explicit joins. Wrapping arithmetic does not acquire LLVM no-overflow promises that the machine operation did not provide.

4. Emit and test scoped outputs

The first-party C path consumes only HydIR's supported raw scalar IR grammar. It may produce labels, gotos, and SSA edge copies; a simple recognized branch can become structured C. Demo scripts verify generated IR where LLVM tools are available and compare compiled outputs with trusted originals on finite input sets. Validation executes those originals, so it is restricted to trusted fixtures.

Another path: whole-executable rebuilding is not a consequence of a successful scalar function lift. It requires complete supported text coverage in a static freestanding program, bounded mapped data, and checked read/write/exit syscall behavior. It emits a new executable and a separate report.

Interfaces and ownership

The egui workbench and hydirctl use the native analysis path. hydird exposes authenticated loopback projects with immutable revisions and artifacts; the Python SDK covers the implemented remote subset. Local ELF opening stays local until a separate upload action. Local analyst facts live in a private on-device ledger; remote project facts live in the service ledger and do not automatically sync.

Read the max2 worked example in the blogs, or inspect the source tree and SDK reference.