{"id":40490233,"url":"https://github.com/agra-uni-bremen/binsym","last_synced_at":"2026-01-20T18:51:06.966Z","repository":{"id":234466072,"uuid":"641337008","full_name":"agra-uni-bremen/BinSym","owner":"agra-uni-bremen","description":"Symbolic execution for RISC-V machine code based on the formal LibRISCV ISA model","archived":false,"fork":false,"pushed_at":"2025-05-26T07:46:16.000Z","size":123,"stargazers_count":50,"open_issues_count":0,"forks_count":3,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-09-09T00:59:18.878Z","etag":null,"topics":["program-analysis","riscv","riscv32","symbolic-execution"],"latest_commit_sha":null,"homepage":"","language":"Haskell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/agra-uni-bremen.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-05-16T09:06:03.000Z","updated_at":"2025-07-24T05:28:26.000Z","dependencies_parsed_at":null,"dependency_job_id":"5a0c2e69-f4d1-49ca-851b-5728dc81f4f6","html_url":"https://github.com/agra-uni-bremen/BinSym","commit_stats":null,"previous_names":["agra-uni-bremen/binsym"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/agra-uni-bremen/BinSym","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/agra-uni-bremen%2FBinSym","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/agra-uni-bremen%2FBinSym/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/agra-uni-bremen%2FBinSym/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/agra-uni-bremen%2FBinSym/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/agra-uni-bremen","download_url":"https://codeload.github.com/agra-uni-bremen/BinSym/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/agra-uni-bremen%2FBinSym/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28609226,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-20T16:10:39.856Z","status":"ssl_error","status_checked_at":"2026-01-20T16:10:39.493Z","response_time":117,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["program-analysis","riscv","riscv32","symbolic-execution"],"created_at":"2026-01-20T18:51:03.736Z","updated_at":"2026-01-20T18:51:06.285Z","avatar_url":"https://github.com/agra-uni-bremen.png","language":"Haskell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# BinSym\n\nSymbolic execution of [RISC-V] binary code based on formal instruction semantics.\n\n**More information:** https://doi.org/10.23919/DATE64628.2025.10993257\n\n## About\n\nBinSym is a program analysis tool which enables symbolic execution of binary code.\nThe majority of prior work on binary program analysis lifts/transforms binary code\nto an Intermediate Representation (IR) and then analysis this intermediate format.\nBinSym, on the other hand, operates directly on the binary-level and eliminates\nthe need to perform binary lifting. This enables BinSym to capture and reason\nabout low-level interactions (e.g. with the architectural state). Furthermore,\nthrough the utilization of formal instruction semantics, BinSym is more faithful\nto the ISA specification and eliminates the possibilities of errors and inaccuracies\nwhich may occur during the lifting step in prior work.\n\nThe implementation of BinSym is based on our prior work on [LibRISCV].\nSpecifically, BinSym provides actual symbolic semantics for the abstract\ninstruction semantics specified in LibRISCV. Or, in other words, BinSym is a\nsymbolic free monad interpreter for LibRISCV.\n\n## Installation\n\nBinSym has been developed for GHC 9.4.8 (newer versions may work too). Furthermore,\ninstallation requires [z3] to be available as a prerequisite. After installing z3,\none can install BinSym by running the following commands:\n\n\t$ git clone https://github.com/agra-uni-bremen/binsym\n\t$ cd binsym\n\t$ cabal install\n\nThis installs a `riscv-symex` binary into your PATH. This binary can be used for\nsymbolic execution of RV32IM machine code. As described in the next section.\n\n## Usage\n\nIn order to explore 32-bit RISC-V machine code using `riscv-symex`, a symbolic\nvalue needs to be introduced into the simulation. Presently, this can be\nachieved through an `ECALL` which must be used from inside the software (i.e.\nthe software must be modified to make use of this `ECALL`). In order to declare\nan unconstrained symbolic value via an `ECALL`, the following C code can be used:\n\n```C\nvoid\nmake_symbolic(void *ptr, size_t size)\n{\n\t__asm__ volatile (\"li a7, 96\\n\"\n\t                  \"mv a0, %0\\n\"\n\t                  \"mv a1, %1\\n\"\n\t                  \"ecall\\n\"\n\t                  : /* no output operands */\n\t                  : \"r\" (ptr), \"r\" (size)\n\t                  : \"a7\", \"a0\", \"a1\");\n}\n```\n\nBinSym executes the code until it finds the first invalid instruction;\ntherefore, in order to terminate an execution path use something along the\nlines of `.word 0xffff` in your startup assembly file. A simple example\nprogram, which enumerates prime numbers symbolically, is available in the\n`examples/prime-numbers` directory. Presently, BinSym always explores the\ninput space in its entirety. Furthermore, no error detection techniques\nhave been integrated with BinSym yet.\n\n## How To Cite\n\nThis work was published in the [proceedings of DATE'25](https://doi.org/10.23919/DATE64628.2025.10993257), it can be cited as follows:\n\n```\n@misc{tempel2024binsym,\n\tauthor    = {Sören Tempel and Tobias Brandt and Christoph Lüth and Christian Dietrich and Rolf Drechsler},\n\tbooktitle = {2025 Design, Automation \\\u0026 Test in Europe Conference \\\u0026 Exhibition (DATE)}\n\ttitle     = {Accurate and Extensible Symbolic Execution of Binary Code based on Formal ISA Semantics},\n\tyear      = {2025},\n\tdoi       = {10.23919/DATE64628.2025.10993257},\n}\n```\n\n[RISC-V]: https://riscv.org/\n[LibRISCV]: https://github.com/agra-uni-bremen/libriscv\n[z3]: https://github.com/Z3Prover/z3\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fagra-uni-bremen%2Fbinsym","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fagra-uni-bremen%2Fbinsym","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fagra-uni-bremen%2Fbinsym/lists"}