{"id":13530053,"url":"https://github.com/fkie-cad/cwe_checker","last_synced_at":"2025-04-13T03:59:54.129Z","repository":{"id":37734561,"uuid":"152072866","full_name":"fkie-cad/cwe_checker","owner":"fkie-cad","description":"cwe_checker finds vulnerable patterns in binary executables","archived":false,"fork":false,"pushed_at":"2025-04-10T14:40:49.000Z","size":9765,"stargazers_count":1206,"open_issues_count":21,"forks_count":128,"subscribers_count":28,"default_branch":"master","last_synced_at":"2025-04-13T03:59:46.889Z","etag":null,"topics":["binary-analysis","cwe","cwe-checker","ghidra","program-analysis","reverse-engineering","security","security-scanner","static-analyzer","vulnerability-scanner"],"latest_commit_sha":null,"homepage":"https://docs.cwe-checker.io","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"lgpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fkie-cad.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGES.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-10-08T12:03:57.000Z","updated_at":"2025-04-10T22:10:39.000Z","dependencies_parsed_at":"2023-02-12T23:45:38.304Z","dependency_job_id":"b3d19f67-0e4c-49aa-97b3-1a884f0b1d88","html_url":"https://github.com/fkie-cad/cwe_checker","commit_stats":{"total_commits":523,"total_committers":18,"mean_commits":"29.055555555555557","dds":0.5602294455066922,"last_synced_commit":"3c042e6f0a795d32b9dca2591ef035b93281da0a"},"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkie-cad%2Fcwe_checker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkie-cad%2Fcwe_checker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkie-cad%2Fcwe_checker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkie-cad%2Fcwe_checker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fkie-cad","download_url":"https://codeload.github.com/fkie-cad/cwe_checker/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248661706,"owners_count":21141450,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["binary-analysis","cwe","cwe-checker","ghidra","program-analysis","reverse-engineering","security","security-scanner","static-analyzer","vulnerability-scanner"],"created_at":"2024-08-01T07:00:42.635Z","updated_at":"2025-04-13T03:59:54.107Z","avatar_url":"https://github.com/fkie-cad.png","language":"Rust","funding_links":[],"categories":["Projects","💽 Autopilot Firmware","Static Analyzers","Automated Vulnerability Detection","Rust","Rust (42)","Software Tools","vulnerability-scanner","Other","📚 Table of Contents","Program analysis","Reversing"],"sub_categories":["Verification","Firmware Analysis","Social Engineering Tools","Binary Parsing and Analysis Tools","Reverse Engineering","Penetration Testing Report Templates","Analysis Tools"],"readme":"\u003cp align=\"center\"\u003e\n    \u003cimg src=\"doc/images/cwe_checker_logo.png\" alt=\"cwe_checker logo\" width=\"50%\" height=\"50%\"/\u003e\n\u003c/p\u003e\n\n# cwe_checker #\n![Acceptance tests](https://github.com/fkie-cad/cwe_checker/actions/workflows/acceptance-tests.yml/badge.svg?branch=master)\n![Unit tests](https://github.com/fkie-cad/cwe_checker/actions/workflows/unit-tests.yml/badge.svg?branch=master)\n![Docker-Pulls](https://img.shields.io/docker/pulls/fkiecad/cwe_checker.svg)\n[![Documentation](https://img.shields.io/badge/doc-stable-green.svg)](https://docs.cwe-checker.io/index.html)\n\n## What is cwe_checker? ##\ncwe_checker is a suite of checks to detect common bug classes such as Null pointer dereferences and buffer overflows.\nThese bug classes are formally known as [Common Weakness Enumerations](https://cwe.mitre.org/) (CWEs).\nThe checks are based on a variety of anaylsis techniques ranging from simple heuristics to abstract interpretation-based data-flow analysis.\nIts main goal is to aid analysts to quickly find potentially vulnerable code paths.\n\nIts main focus are ELF binaries that are commonly found on Linux and Unix operating systems.\nThe cwe_checker uses [Ghidra](https://ghidra-sre.org/) to disassemble binaries into one common intermediate representation\nand implements its own analyses on this IR.\nHence, the analyses can be run on most CPU architectures that Ghidra can disassemble,\nwhich makes the cwe_checker a valuable tool for firmware analysis.\n\nThe following arguments should convince you to give *cwe_checker* a try:\n-  it is very easy to set up, just build the Docker container!\n-  it analyzes ELF binaries of several CPU architectures including x86, ARM, MIPS, and PPC\n-  it is extensible due to its plugin-based architecture\n-  it is configurable, e.g. apply analyses to new APIs\n-  view results annotated in Ghidra\n-  cwe_checker can be integrated as a plugin into [FACT](https://github.com/fkie-cad/FACT_core)\n\n\u003cp align=\"center\"\u003e\n    \u003cimg src=\"doc/images/example_usage.png\" alt=\"Usage Example\" width=\"80%\" height=\"80%\"/\u003e\n\u003c/p\u003e\n\n## Installation ##\n\n### Using the docker image ###\n\nThe simplest way is to pull the latest Docker image from the [Github container registry](https://github.com/fkie-cad/cwe_checker/pkgs/container/cwe_checker):\n-   `docker pull ghcr.io/fkie-cad/cwe_checker:latest` yields an image based on the current master branch.\n-   `docker pull ghcr.io/fkie-cad/cwe_checker:stable` yields an image based on the latest stable release version.\n-   `docker pull ghcr.io/fkie-cad/cwe_checker:v0.9` yields an image based on the v0.9 stable release version.\nHowever, it is recommended to switch to newer stable releases as soon as they get published, since improvements between stable versions can be quite significant.\n\nIf you want to build the docker image yourself, just run\n```\ndocker build -t cwe_checker .\n```\nThis way you can also build native Docker images for ARM-based PCs (e.g. newer Apple Macs).\nThe prebuilt Docker images are currently only x86-based.\n\n### Local installation ###\n\nThe following dependencies must be installed in order to build and install the *cwe_checker* locally:\n-   [Rust](https://www.rust-lang.org) \u003e= 1.82\n-   [Ghidra](https://ghidra-sre.org/) \u003e= 10.2\n\nRun `make all GHIDRA_PATH=/path/to/ghidra_folder` (with the correct path to the local Ghidra installation inserted) to compile and install the cwe_checker.\nIf you omit the `GHIDRA_PATH` argument the installer will search your file system for a local installation of Ghidra.\n\n## Usage ##\n\nThe *cwe_checker* takes a binary as input,\nruns several [checks](#checks) based on static analysis on the binary\nand then outputs a list of CWE warnings that have been found during the analysis.\n\nIf you use the official docker image, just run\n```bash\ndocker run --rm -v /PATH/TO/BINARY:/input ghcr.io/fkie-cad/cwe_checker /input\n```\nIf you installed the *cwe_checker* locally, run\n```bash\ncwe_checker BINARY\n```\nIf you use nix flakes, run\n```bash\nnix run github:fkie-cad/cwe_checker -- BINARY\n```\nYou can adjust the behavior of most checks via a configuration file located at `src/config.json`.\nIf you modify it, add the command line flag `--config=src/config.json` to tell the *cwe_checker* to use the modified file.\nFor information about other available command line flags you can pass the `--help` flag to the *cwe_checker*.\n\nThere is _experimental_ support for the analysis of Linux loadable kernel modules\n(LKMs). *cwe_checker* will recognize if you pass an LKM and will execute a\nsubset of the CWE checks available for user-space programs. Analyses are\nconfigurable via a separate [configuration file](src/lkm_config.json).\n\nIf you use the stable version, you can also look at the [online documentation](https://docs.cwe-checker.io/index.html) for more information.\n\n### For Bare-Metal Binaries ###\n\nThe cwe_checker offers experimental support for analyzing bare-metal binaries.\nFor that one needs to provide a bare metal configuration file via the `--bare-metal-config` command line option.\nAn example for such a configuration file can be found at `bare_metal/stm32f407vg.json`\n(which was created and tested for an STM32F407VG MCU).\n\nFor more information take a look at the [online documentation](https://docs.cwe-checker.io/index.html).\n\n## Documentation and Tests ##\n\nThe test binaries for our test suite can be built with `make compile_test_files` (needs Docker to be installed!). The test suite can then be run with `make test`.\n\nSource code documentation can be built with `make documentation`. For the stable version, the documentation can be found [here](https://docs.cwe-checker.io/index.html).\n\n## Implemented Checks \u003ca name=checks\u003e\u003c/a\u003e ##\n\nSo far the following analyses are implemented:\n-   [CWE-78](https://cwe.mitre.org/data/definitions/78.html): OS Command Injection (currently disabled on standard runs)\n-   [CWE-119](https://cwe.mitre.org/data/definitions/119.html) and its variants [CWE-125](https://cwe.mitre.org/data/definitions/125.html) and [CWE-787](https://cwe.mitre.org/data/definitions/787.html): Buffer Overflow\n-   [CWE-134](https://cwe.mitre.org/data/definitions/134.html): Use of Externally-Controlled Format String\n-   [CWE-190](https://cwe.mitre.org/data/definitions/190.html): Integer Overflow or Wraparound\n-   [CWE-215](https://cwe.mitre.org/data/definitions/215.html): Information Exposure Through Debug Information\n-   [CWE-243](https://cwe.mitre.org/data/definitions/243.html): Creation of chroot Jail Without Changing Working Directory\n-   [CWE-332](https://cwe.mitre.org/data/definitions/332.html): Insufficient Entropy in PRNG\n-   [CWE-337](https://cwe.mitre.org/data/definitions/337.html): Predictable Seed in Pseudo-Random Number Generator (PRNG)\n-   [CWE-367](https://cwe.mitre.org/data/definitions/367.html): Time-of-check Time-of-use (TOCTOU) Race Condition\n-   [CWE-416](https://cwe.mitre.org/data/definitions/416.html): Use After Free and its variant [CWE-415](https://cwe.mitre.org/data/definitions/415.html): Double Free\n-   [CWE-426](https://cwe.mitre.org/data/definitions/426.html): Untrusted Search Path\n-   [CWE-467](https://cwe.mitre.org/data/definitions/467.html): Use of sizeof() on a Pointer Type\n-   [CWE-476](https://cwe.mitre.org/data/definitions/476.html): NULL Pointer Dereference\n-   [CWE-560](https://cwe.mitre.org/data/definitions/560.html): Use of umask() with chmod-style Argument\n-   [CWE-676](https://cwe.mitre.org/data/definitions/676.html): Use of Potentially Dangerous Function\n-   [CWE-782](https://cwe.mitre.org/data/definitions/782.html): Exposed IOCTL with Insufficient Access Control\n-   [CWE-789](https://cwe.mitre.org/data/definitions/789.html): Memory Allocation with Excessive Size Value\n\nPlease note that both false positives and false negatives are to be expected due to shortcuts and the nature of static analysis as well as over-approximation.\nYou can find information on the inner workings of each check as well as known reasons for false positives and false negatives on the [check-specific documentation pages](https://docs.cwe-checker.io/cwe_checker_lib/checkers/index.html).\n\n## Integration into other tools ##\n\ncwe_checker comes with a script for Ghidra,\nwhich parses the output of the cwe_checker and annotates the found CWEs in the disassembler for easier manual analysis.\nThe script is located at `ghidra_plugin/cwe_checker_ghidra_plugin.py`, usage instructions are contained in the file.\n\n\u003cp align=\"center\"\u003e\n    \u003cimg src=\"doc/images/example_ghidra_integration.png\" alt=\"Ghidra Integration\" width=\"90%\" height=\"90%\"/\u003e\n\u003c/p\u003e\n\nThe cwe_checker is also integrated as a plugin in [FACT](https://github.com/fkie-cad/FACT_core).\nIf you want to integrate the cwe_checker into your own analysis toolchain, you can use the `--json` command line flag (in combination with either the `--quiet` or the `--out=...` command line options) to generate the CWE warnings in an easily parseable JSON output format.\n\n## How does cwe_checker work internally? ##\n\nBuilding the documentation using `cargo doc --open --document-private-items --no-deps` will give you more information about the internal structure of the cwe_checker.\nHowever, the best documentation is still the source code itself.\nIf you have questions, be sure to ask them on our [discussions page](https://github.com/fkie-cad/cwe_checker/discussions)!\nWe are constantly striving to improve extensibility and documentation and your questions will help us to achieve that!\n\nTo get a quick/initial overview of its internals you can also look at the slides of conference presentations on the *cwe_checker* in the *doc* folder.\nWe presented cwe_checker at the following conferences so far:\n-   [Pass The SALT 2019](https://2019.pass-the-salt.org/talks/74.html) ([slides](doc/slides/cwe_checker_pts19.pdf))\n-   [Black Hat USA 2019](https://www.blackhat.com/us-19/arsenal/schedule/index.html#cwe_checker-hunting-binary-code-vulnerabilities-across-cpu-architectures-16782) ([slides](doc/slides/cwe_checker_BlackHatUSA2019.pdf))\n-   [Black Hat USA 2022](https://www.blackhat.com/us-22/arsenal/schedule/#cwe_checker-architecture-independent-binary-vulnerability-analysis-26960) ([slides](doc/slides/cwe_checker_BlackHatUSA2022.pdf))\n\n## Contribute ##\n\nContributions are always welcome. Just fork it and open a pull request!\n\n## Acknowledgements ##\n\nThis project is partly financed by [German Federal Office for Information Security (BSI)](https://www.bsi.bund.de).\n\nA special thanks goes out to the BAP community (especially the official gitter) for answering questions and discussing solutions.\n\n## License ##\n```\n    Copyright (C) 2018 - 2024  Fraunhofer FKIE  (firmware-security@fkie.fraunhofer.de)\n\n    This library is free software; you can redistribute it and/or\n    modify it under the terms of the GNU Library General Public\n    License as published by the Free Software Foundation; either\n    version 3 of the License, or (at your option) any later version.\n\n    This library is distributed in the hope that it will be useful,\n    but WITHOUT ANY WARRANTY; without even the implied warranty of\n    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU\n    Library General Public License for more details.\n\n    You should have received a copy of the GNU General Public License\n    along with this program.  If not, see \u003chttp://www.gnu.org/licenses/\u003e.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffkie-cad%2Fcwe_checker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffkie-cad%2Fcwe_checker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffkie-cad%2Fcwe_checker/lists"}