Return vtil-cli version + supported architectures.

Reports WARN (not ERROR) when the vtil-cli binary is not found — the Python server itself always loads. The fallback chain: $RE_VTIL_CLI_PATH -> <server>/bin/vtil-cli -> PATH.

Lift arch / code to VTIL intermediate language.

Args: arch: target architecture — one of x86, x86_64, aarch64, arm32 code: machine-code bytes, base64-encoded (base64 is transport-friendly; the CLI decodes back to bytes before passing to VTIL's lifters) base_address: where the code is mapped in virtual memory (default 0x400000 — the ELF .text convention)

Returns::

{"arch": "x86_64", "base_address": 0x400000,
 "il": {"blocks": [{"vaddr": N, "instructions": [...]}]}}

Each lifted instruction is one of VTIL's IL primitives (mov, add, sub, jmp, if, vmov, etc.). The structure is enough for optimize and emit to work on the output.

On a missing binary, returns {"status": "WARN", "error": "vtil-cli not built", ...} so the agent knows to retry after install.sh.

Run VTIL optimization passes over a lifted IL tree.

Args: il: the IL tree produced by :func:lift_handler passes: list of pass names to apply in order. The canonical set is dead_store_elimination, branch_folding, mem_dependency; pass names are the C++ enum names in VTIL's optimizer::pass_index.

Returns::

{"il": <optimized il>, "passes_applied": [...]}

The output IL is in the same shape as the input — drop-in replacement for downstream emit calls.

Emit a pseudo-C reading of a lifted IL tree.

The output is best-effort — VTIL's emulator walks the IL and produces a C-like pseudocode that an analyst can read. The quality is much lower than IDA Hex-Rays or Ghidra's decompiler; the use case is a quick first-pass read of a VM handler body, not a full decompilation.

Args: il: the IL tree (raw from lift_handler or optimized via :func:optimize)

Returns::

{"code": "C-like pseudocode...", "il_block_count": N}

Run the curated default pass set on a lifted IL tree.

The canonical pass order comes from data/ollvm-pass-catalog.json::_meta.default_pass_order and is curated for the encrypted-VM bytecode handler-lift case (MBA-fold + opaque-predicate-eval + control-flow-unflatten on top of the d810-ng default set).

Args: il: the IL tree produced by :func:lift_handler passes: optional override; when None, the curated default order is used. default_preset: "d810-ng" (the curated set), or "none" to disable simplification entirely.

Returns::

{"il": <optimized il>, "passes_applied": [...],
 "preset": "d810-ng"}