Look at things like PIN tool [0], DynamoRIO [1], and Valgrind [2] to do this at runtime or at any of the LLVM based decompilers like dagger [3], libcpu [4], or

Look at things like PIN tool [0], DynamoRIO [1], and Valgrind [2] to do this at runtime or at any of the LLVM based decompilers like dagger [3], libcpu [4], or fracture [5] to do AoT compilation. I'm not sure if QEMU's IR would be a good fit. DynamoRIO and Valgrind IR may also be able to be AoTed if you work hard enough. Of course, stuff like indirect branches and self-modifying code can really throw a wrench in your JITter's gears. [0]: https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool https://software.intel.com/en-us/articles/pin-a-dynamic-bina... [1]: http://www.dynamorio.org/ http://www.dynamorio.org/ [2]: http://valgrind.org/ http://valgrind.org/ [3]: http://dagger.repzret.org/ http://dagger.repzret.org/ [4]: https://github.com/libcpu/libcpu https://github.com/libcpu/libcpu [5]: https://github.com/draperlaboratory/fracture https://github.com/draperlaboratory/fracture