Hello everyone,
I have been working on Fission, an open-source reverse engineering and binary decompilation workspace written primarily in Rust.
Fission uses Sleigh language definitions for instruction decoding and P-Code semantics, then processes the lifted representation through its own Rust-based pipeline:
binary loading
→ static facts and provenance
→ Sleigh decoding and P-Code lifting
→ NIR
→ normalization and semantic recovery
→ HIR
→ control-flow structuring
→ pseudocode rendering and quality reports
The main objective is to keep decompiler output mechanically traceable and semantically defensible. When the output is incorrect or unreadable, I try to fix the problem in the layer that owns the relevant behavior rather than adding presentation-specific workarounds in the final renderer.
Rust has been useful for this project because the system contains many boundaries between loaders, intermediate representations, transformation passes, analysis results, emulation state, and user-facing output. Explicit ownership and typed interfaces help make those boundaries easier to review.
That said, Rust also introduces real costs. Compile times, generic complexity, and the design of mutation-heavy graph and IR transformations require careful trade-offs. I do not consider Rust automatically superior for every part of the system, and I would be especially interested in feedback on places where the current design may be unnecessarily complicated.
The workspace currently includes:
- binary loading and static analysis infrastructure
- Sleigh-based decoding and P-Code lifting
- separate NIR and HIR representations
- CFG, dominance, post-dominance, SCC, and region-based structuring
- a P-Code emulator
- deterministic execution recording and replay
- taint tracking
- early concolic path-exploration infrastructure
- CLI, TUI, and desktop-facing components
- regression and quality-reporting automation
Most of my current work is focused on x86 and x86-64 decompilation correctness, deterministic output, control-flow structuring, and readable pseudocode.
The project is still research-heavy and under active development. Some components, particularly symbolic and concolic execution, are experimental and incomplete. I would rather be explicit about those limitations than present the project as more mature than it currently is.
I would appreciate concrete feedback on:
- the separation between NIR and HIR
- crate and ownership boundaries
- pass-pipeline organization
- approaches to deterministic graph transformations
- measuring decompiler quality beyond cosmetic output changes
- compile-time and runtime trade-offs in a large Rust workspace
- areas where the implementation could be simplified or made more idiomatic
Repository:
Thank you for taking a look.