{"id":42602811,"url":"https://github.com/toolchainz/jingle","last_synced_at":"2026-05-08T01:08:15.550Z","repository":{"id":240959904,"uuid":"803720962","full_name":"toolCHAINZ/jingle","owner":"toolCHAINZ","description":"SMT Modeling and Configurable Program Analysis for Ghidra's PCODE","archived":false,"fork":false,"pushed_at":"2026-04-04T13:18:03.000Z","size":877,"stargazers_count":35,"open_issues_count":7,"forks_count":5,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-04-04T14:50:44.935Z","etag":null,"topics":["ghidra","p-code","reverse-engineering","rust","sleigh","smt","z3"],"latest_commit_sha":null,"homepage":"https://crates.io/crates/jingle","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/toolCHAINZ.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-05-21T09:05:02.000Z","updated_at":"2026-04-04T13:15:47.000Z","dependencies_parsed_at":"2026-03-02T01:15:19.053Z","dependency_job_id":null,"html_url":"https://github.com/toolCHAINZ/jingle","commit_stats":{"total_commits":9,"total_committers":1,"mean_commits":9.0,"dds":0.0,"last_synced_commit":"a17d75ce9d3f1c2a37d26335e329d69c7d135261"},"previous_names":["toolchainz/jingle"],"tags_count":68,"template":false,"template_full_name":null,"purl":"pkg:github/toolCHAINZ/jingle","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/toolCHAINZ%2Fjingle","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/toolCHAINZ%2Fjingle/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/toolCHAINZ%2Fjingle/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/toolCHAINZ%2Fjingle/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/toolCHAINZ","download_url":"https://codeload.github.com/toolCHAINZ/jingle/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/toolCHAINZ%2Fjingle/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31403952,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-04T10:20:44.708Z","status":"ssl_error","status_checked_at":"2026-04-04T10:20:06.846Z","response_time":60,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ghidra","p-code","reverse-engineering","rust","sleigh","smt","z3"],"created_at":"2026-01-29T01:28:55.187Z","updated_at":"2026-04-04T15:01:07.778Z","avatar_url":"https://github.com/toolCHAINZ.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n\u003cimg src=\"./jingle.svg\" width=\"350\"/\u003e\n\n🎶 \u003cspan style=\"font-style: italic; font-family: serif\"\u003eJingle bells, Jingle bells, Jingle all the `SLEIGH`\u003c/span\u003e 🎶\n\n\u003c/div\u003e\n\n# `jingle`: SMT Modeling for `p-code`\n`jingle` provides SMT modeling Ghidra's `p-code`. It represents states of\nthe `p-code` Virtual Machine as expressions on the `QF_ABV` logic, and represents `p-code` operations as relations between these states. It additionally implements the Configurable\nProgram Analysis algorithm over pcode allowing for quickly implementing flexible custom analyses.\n\n**ALPHA SOFTWARE:  this software is suitable for research usage but is not yet ready to be used in production.**\n\nThis repository contains a [Cargo Workspace](https://doc.rust-lang.org/book/ch14-03-cargo-workspaces.html) for three\nrelated crates:\n\n* [`jingle_sleigh`](./jingle_sleigh): a Rust FFI in front of [Ghidra](https://github.com/NationalSecurityAgency/ghidra)'\n  s\n  code translator: `SLEIGH`. `SLEIGH` is written in C++ and can be\n  found [here](https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Features/Decompiler/src/decompile/cpp).\n  This crate contains a private internal low-level API to `SLEIGH` and exposes an idiomatic high-level API to consumers.\n* [`jingle`](./jingle): defines SMT modeling of p-code states and operations using [z3.rs](https://github.com/prove-rs/z3.rs) as well as a small program analysis framework. `jingle` implements [Configurable Program Analysis](https://doi.org/10.1007/978-3-319-10575-8_16), allowing for flexible custom program analysis, as well as pre-built analyses for building SMT models of unwound p-code programs.\n* [`jingle_python`](./jingle_python): a set of [pyo3](https://pyo3.rs) bindings for `jingle`. These bindings expose a \n  simple interface to both SLEIGH and our logical modeling of `p-code` in SMT. SMT formulae are exposed wrapped in\n  their \"native\" python z3 classes, allowing easy integration with other tools. These bindings are _especially_ raw and\n  subject to change and do not yet expose any of the program analysis APIs.\n\n## Usage\n\nIn order to use `jingle` in your project, you can just `cargo add` it:\n\n```sh\ncargo add jingle\n```\n\nWhile `jingle` can be configured to work with a single set `sleigh` architecture,\nthe default way to use it is to point it to an existing `ghidra` installation.\n[Install ghidra](https://ghidra-sre.org) and use the installation root when instantiating the `SleighBuilder`. \nThe only thing ghidra is used for here is as a standardized folder layout for `sleigh` architectures.\n`jingle` has no code dependency on ghidra outside of the bundled `sleigh` C++ code.\n\n### CLI \n\nYou can install a simple CLI demonstrating jingle's modeling by running\n\n```sh\ncargo install --features bin jingle\n```\n\nIf you are using the [CLI](./jingle),\nthen provide the path to ghidra as an argument in your first run.\n\nThe CLI produces disassembly, pcode, and SMT models for small hex-encoded instruction encodings. Note that the CLI uses an older version of `jingle`'s modeling that does not support arbitrary control flow.\n\n\n## Development\n\nIf you're working directly with the `jingle` source distribution,\nyou will need to manually download a copy of the `ghidra` source tree\nin order to build `jingle` or `jingle_sleigh`\n\nIf you're working with `git`, this can be done using the existing submodule.\nSimply run\n\n```shell\ngit submodule init \u0026\u0026 git submodule update\n```\n\nIf you are for some reason using a zipped source distribution,\nthen you can run the following:\n\n```shell\ncd jingle_sleigh\ngit clone https://github.com/NationalSecurityAgency/ghidra.git\n```\n\nIf you are using `jingle` as a cargo `git` or `crates.io` dependency,\nthis step is not necessary. `cargo` will handle all this in the `git` case\nand we will vendor the necessary `ghidra` sources into all `crates.io` releases.\n\n# Research Paper\n\n`jingle` was initially developed in support of our research paper, _Synthesis of Code-Reuse Attacks from `p-code` Programs_,\npresented at [Usenix Security 2025](https://www.usenix.org/conference/usenixsecurity25/presentation/denhoed).\n\nIf you found the paper or the implementation useful, you can cite it with the following BibTeX:\n\n```bibtex\n@inproceedings{10.5555/3766078.3766099,\nauthor = {DenHoed, Mark and Melham, Tom},\ntitle = {Synthesis of code-reuse attacks from p-code programs},\nyear = {2025},\nisbn = {978-1-939133-52-6},\npublisher = {USENIX Association},\naddress = {USA},\nbooktitle = {Proceedings of the 34th USENIX Conference on Security Symposium},\narticleno = {21},\nnumpages = {17},\nlocation = {Seattle, WA, USA},\nseries = {SEC '25}\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftoolchainz%2Fjingle","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftoolchainz%2Fjingle","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftoolchainz%2Fjingle/lists"}