Skip to content
STIMSMITH

Binary Translation

Concept WIKI v1 · 7/3/2026

Binary translation is a technique for translating executable code from one instruction set architecture (ISA) to another. The provided evidence corpus, drawn from a survey on ISA specification, lists numerous tools and research efforts relevant to or directly employing binary translation, including dynamic translators such as QEMU and related works.

Binary Translation

Overview

Binary translation refers to the process of translating executable program code from one instruction set architecture (ISA) to another, or to an intermediate representation, in order to execute or analyze the program on a different platform or within a different toolchain. Binary translation can be performed statically (ahead of execution) or dynamically (at runtime), and is foundational to emulation, virtualization, cross-architecture software execution, and certain forms of binary analysis and lifting.

Role in ISA Specification Work

Binary translation is closely tied to the broader topic of specifications of instruction set architectures. ISA specifications describe the semantics of machine instructions in a form that can be used to drive code generation, analysis, verification, and translation. Several research efforts cited in ISA-specification literature either apply binary translation directly or inform its practice:

  • Binary translation using peephole superoptimizers (Bansal and Aiken, OSDI 2008) applies superoptimization techniques to the problem of translating binary code.
  • UQBT: Adaptable binary translation at low cost (Cifuentes et al., IEEE Computer, 2000) describes a low-cost, adaptable binary translation system.
  • Reverse interpretation + mutation analysis = automatic retargeting (Collberg et al., PLDI 1997) uses reverse interpretation for retargeting, a form of translation between machine representations.
  • Automatic derivation of code generators (Cattell, PhD thesis 1978; TOPLAS 1980) derives code generators from machine descriptions, an antecedent to modern translator construction.
  • Automatic checking of instruction specifications (Fernandez, ICSE 1997) and related work ensure that machine descriptions used for translation and code generation are correct.
  • Automatically generating instruction selectors using declarative machine descriptions (Dias and Ramsey, POPL 2010) automates code generation from declarative ISA specifications.
  • Specifying the semantics of machine instructions (Cifuentes, IWPC 1998) provides semantic descriptions of machine instructions useful for translators.

Related Tools and Systems

The ISA-specification literature connects binary translation to a number of concrete systems and tools:

  • QEMU: a machine emulator and virtualizer that relies on dynamic binary translation; its translated intermediate form is the TCG (Tiny Code Generator) Intermediate Representation, which implements the binary translation infrastructure used in QEMU.
  • Binary lifters that produce intermediate representations suitable for translation, retargeting, or further analysis, including:
    • BinRec binary lifter
    • Dagger binary lifter
    • LLVM-MCtoLL binary lifter
    • McSema binary lifter
    • Remill binary lifting library
    • reopt binary lifter
    • rev.ng reverse engineering tool
  • Binary analysis platforms, such as BAP, that consume translated or lifted code.
  • Disassemblers and decoders, including Capstone and zydis, which support translation workflows by recovering instruction encodings.
  • CPU verification efforts, where translated or lifted representations are used to verify processor behavior.

Specification Languages and Binary Translation

Several ISA specification languages referenced in the evidence either directly support or are used in conjunction with binary translation:

  • Arm Architecture Specification Language (ASL)
  • L3 specification language
  • LISA
  • nML (used in Describing instruction set processors using nML, Fauth et al., EDTC 1995)
  • Sail ISA specification language
  • Specification language for encoding and decoding (SLED)
  • Instruction Set Processor (ISP) / ISPS notation (Barbacci et al., CMU 1972; IEEE 1981)

These specification languages can be used to generate translators, decode machine instructions, or provide formal semantics to verify translation correctness.

See Also

LINKED ENTITIES

5 links
TCG (Tiny Code Generator) Intermediate Representation IMPLEMENTS
QEMU USES
Binary Analysis RELATED
Instruction Set Architecture RELATED
CPU Verification RELATED

CITATIONS

5 sources
5 citations
[1] Binary translation is a technique for translating executable code between instruction set architectures or to an intermediate representation. Specifications of instruction set architectures
[2] The TCG (Tiny Code Generator) Intermediate Representation is the IR used by QEMU for binary translation and is listed as a related tool in the ISA-specification evidence. Specifications of instruction set architectures
[3] QEMU, binary lifters (BinRec, Dagger, LLVM-MCtoLL, McSema, Remill, reopt, rev.ng), disassemblers (Capstone, zydis), and the BAP binary analysis platform are connected to binary translation workflows in the ISA-specification literature. Specifications of instruction set architectures
[4] Research on binary translation includes Bansal and Aiken's binary translation using peephole superoptimizers and Cifuentes et al.'s UQBT adaptable binary translation system, as listed in the ISA-specification references. Specifications of instruction set architectures
[5] Reverse interpretation with mutation analysis (Collberg et al., PLDI 1997) and automatic derivation of code generators (Cattell, 1978/1980) are cited in the evidence as foundational techniques related to binary translation. Specifications of instruction set architectures