binsnake / omill

What is omill?

omill takes remill-lifted LLVM IR from x86_64 Windows PE binaries and transforms it into clean, recompilable native code. It lowers memory intrinsics and state structs, recovers control flow and ABI, and handles deobfuscation like lazy imports and MBA expressions. Built in C++ on LLVM 21, it offers CLI tools: omill-lift for direct binary lifting from PE files, omill-opt for pipeline runs on bitcode, and ollvm-obf for generating obfuscated test inputs.

Why is it gaining traction?

In the crowded binary lifting space on GitHub—think remill forks or Binary Ninja plugins—omill stands out with Windows-specific deobf for real-world PE malware, resolving IAT calls and hash-based imports automatically. Developers grab github binary releases for its end-to-end workflow from unpacked EXE to optimized IR, skipping manual CFG tweaks. Like a binary load lifter droid from Star Wars hauling obfuscated code to readability.

Who should use this?

Reverse engineers analyzing OLLVM-obfuscated Windows malware or packed EXEs. Malware analysts needing to lift and deobfuscate specific functions for dynamic analysis. Remill users wanting recompilable output without fighting state structs or unresolved jumps.

Verdict

Grab it if you're deep in x86_64 Windows reversing—CLI tools deliver fast wins on deobf—but at 44 stars and 1.0% credibility, it's early-stage with solid tests yet thin docs. Pair with liftfuzz for validation; expect weekly improvements on complex obf.