Sigil.re — static devirtualization & an interactive RE workbench

Beyond the listing

Most disassemblers read the bytes. Sigil runs the semantics.

The same lifter that powers the listing feeds a normalization pipeline and a faithful JIT — so recovery is grounded in what the machine actually does, not pattern-matched against a specific protector. Where a budget or timeout is hit, Sigil records honest residue instead of a plausible-but-wrong answer.

Static devirtualization

Recover virtualized functions without ever running the sample — VM handlers lifted, dispatch unrolled, control flow rebuilt straight from the bytes.

In development

Faithful JIT semantics

remill → LLVM 21 → MCJIT models x86-64 exactly, not an approximate emulator. The IR you read is the semantics the CPU executes.

Shipping

Semantic deobfuscation

MBA, opaque predicates, junk and flattening dissolve under LLVM-driven passes — with a residue report that tells you exactly what didn't fold.

Shipping

Programmable & agent-drivable

A scriptable JIT emulator and an MCP interface so external agents can drive analysis end to end — designed, and on the near roadmap.

Planned

Showcase

The workbench, on a real binary.

Every view drives the live analysis model — functions stream in as they're discovered, and nothing blocks while a large image analyzes. Click any frame to open it full size.

Linear disassembly listing with syntax highlighting, function boundaries, imports and data rows — 01Annotated disassembly
A linear listing: syntax-highlighted code, `startp/endp` boundaries, resolved imports, strings and data — streamed in as analysis runs.

Cross-references dock listing every call site into a function — 02Cross-references
Every incoming and outgoing edge for the current location — direction, address, and kind — one click from the call site.

Split view: disassembly on the left, normalized LLVM IR on the right, with the normalize residue report in the console — 03Lift & normalize · split view
Lift a function to LLVM IR and run the normalize pipeline — the optimized IR beside the listing, with a live residue report (`lowered 67 reads / 56 writes… control:5`). Early, and honest about what's left.

Strings dock with recovered ASCII and UTF-16 literals, filterable — 04String recovery
Recovered ASCII and UTF-16 literals, filterable and navigable — with the string data rendered inline in the listing.

Disassembly with named stack variables and resolved import calls — 05Stack analysis
Frame reconstruction names operands `var_/arg_`, renameable across every reference, with imports resolved to their symbols.

Interactive definition control forcing a function, with a consistency issue flagged inline — 06Definition control
IDA-style steering — make / undefine functions, undefine code, analyze-from — with recovery inconsistencies flagged inline (`[!] no clean return`).

Pipeline

Binary in, binary out.

Recovery starts at the original entry point — the unpacked OEP, not a deep nested VM — carrying a 1:1 machine-state snapshot so the static lifter is always seeded correctly.

Protected PE

A packed, virtualized binary — the untouched input bytes.

→

Unpack to OEP

Resolve the packer stub and snapshot state at the original entry.

→

Lift to LLVM IR

remill raises each reachable instruction to faithful IR.

→

Normalize

Passes fold MBA, kill opaque predicates, flatten VM dispatch.

→

OUT

Clean binary

Re-emitted through LIEF — deobfuscated and analyzable.

Current features

What works today.

The workbench is usable now on real x86-64 PE images — the shipping surface while the devirtualization engine hardens.

Disassembly & views

Linear listing with syntax highlighting, streamed live
Graph CFG — layered blocks, routed edges, draggable
Toggle & follow — Binja-style spacebar, click-to-follow, history
Overview entropy band + live analysis frontier

Analysis & navigation

Cross-references, strings, sections, entry points
Stack frames + var_/arg_ naming
Globals & imports detected and resolved
Progressive analysis — never blocks the UI

Recovery & editing

Lift to LLVM IR + normalize pipeline, on demand
Definition control — make/undefine/analyze-from
Rename & comment · full undo/redo · block colours
.s1g projects, save/discard-on-close, settings

Roadmap

Where it's going.

The workbench ships today; the engine and the automation layer are the frontier. Dated loosely — direction over deadlines.

Nowshipping

Interactive workbench — listing, CFG, xrefs, strings, sections, entry points
Definition control, undo/redo, projects & settings
Lift + normalize to LLVM IR with a residue report
Stack analysis and variable naming

Nextin progress

Complete static devirtualization — emit a clean, runnable binary
Deeper normalization — drive residue toward zero
Programmable JIT emulator — scriptable, faithful execution under MCJIT
MCP interface — agent-driven analysis (designed)

Laterplanned

Time-travel debugging over the JIT — record & replay emulated execution
ELF & Mach-O containers; further architectures
Automation & collaboration — scriptable pipelines, shared projects
…and a few differentiators we're keeping quiet for now

Status · in development

Not public yet — but say hello.

Sigil is research-grade tooling for authorized reverse engineering, hardening toward a release. If you work on hard targets, want to follow along, or think it fits your team, reach out.

sidewinder@sigil.re

Sigil is intended for reverse engineering you are authorized to perform — your own binaries, security research, and in-scope bug-bounty work. Use it lawfully and within the terms of the targets you analyze.

A disassembler with an engine behind it.