Skip to content

Added lli.yml#475

Open
m3rcer wants to merge 6 commits into
LOLBAS-Project:masterfrom
m3rcer:master
Open

Added lli.yml#475
m3rcer wants to merge 6 commits into
LOLBAS-Project:masterfrom
m3rcer:master

Conversation

@m3rcer

@m3rcer m3rcer commented Nov 3, 2025

Copy link
Copy Markdown

The lli tool is LLVM's official LLVM IR interpreter / JIT compiler launcher. It provides a CLI interface to execute .bc (bitcode) or .ll (IR) files directly, without needing to compile them to native binaries. Due to its presence in official Visual Studio and LLVM toolchains, it can already be present and trusted in many developer based environments, enabling low-friction trusted interpreter payload execution.

Internally, lli supports multiple execution engines, including:

  • Interpreter (pure IR execution)
  • MCJIT (legacy JIT compiler)
  • ORCJIT / ORC Lazy JIT (modern modular JIT framework)

@m3rcer m3rcer requested a review from a team as a code owner November 3, 2025 17:45

@wietze wietze left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @m3rcer could you fix the issues flagged by the CI/CD? Also, could you provide a sample payload of how this could be weaponised? Thanks

@wietze

wietze commented Jun 15, 2026

Copy link
Copy Markdown
Member

Another nudge from me. I installed LLVM tools on the latest version of Visual Studio 2026 Community and it no longer seems to contain lli.exe. Let me know if this needs updating or whether we can close it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants