Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/KeenSecurityLab/BinAbsInspector
BinAbsInspector: Vulnerability Scanner for Binaries
https://github.com/KeenSecurityLab/BinAbsInspector
abstract-interpretation binary-analysis ghidra reverse-engineering security static-analyzer vulnerability-scanner
Last synced: about 1 month ago
JSON representation
BinAbsInspector: Vulnerability Scanner for Binaries
- Host: GitHub
- URL: https://github.com/KeenSecurityLab/BinAbsInspector
- Owner: KeenSecurityLab
- License: gpl-3.0
- Created: 2022-03-26T03:13:33.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2024-05-14T02:09:35.000Z (4 months ago)
- Last Synced: 2024-05-15T00:26:32.131Z (4 months ago)
- Topics: abstract-interpretation, binary-analysis, ghidra, reverse-engineering, security, static-analyzer, vulnerability-scanner
- Language: Java
- Homepage:
- Size: 779 KB
- Stars: 1,520
- Watchers: 26
- Forks: 223
- Open Issues: 18
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-hacking-lists - KeenSecurityLab/BinAbsInspector - BinAbsInspector: Vulnerability Scanner for Binaries (Java)
- StarryDivineSky - KeenSecurityLab/BinAbsInspector
README
# What is BinAbsInspector?
BinAbsInspector (Binary Abstract Inspector) is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at [Keenlab](https://keenlab.tencent.com/). It is based on abstract interpretation with the support from Ghidra. It works on Ghidra's Pcode instead of assembly. Currently it supports binaries on x86,x64, armv7 and aarch64.
# Installation
+ Install Ghidra according to [Ghidra's documentation](https://github.com/NationalSecurityAgency/ghidra#install)
+ Install [Z3](https://github.com/Z3Prover/z3) (tested version: 4.8.15)
+ Note that generally there are two parts for Z3 library: one is Java package, the other one is native library. The Java package is already included in "/lib" directory, but we suggest that you replace it with your own Java package for version compatibility.
+ For Windows, download a pre-built package from [here](https://github.com/Z3Prover/z3/releases), extract the zip file and add a PATH environment variable pointing to `z3-${version}-win/bin`
+ For Linux, install with package manager is NOT recommended, there are two options:
1. You can download suitable pre-build package from [here](https://github.com/Z3Prover/z3/releases), extract the zip file and copy `z3-${version}-glibc-${version}/bin/*.so` to `/usr/local/lib/`
2. or you can build and install z3 according to [Building Z3 using make and GCC/Clang](https://github.com/Z3Prover/z3#building-z3-using-make-and-gccclang)
+ For MacOS, it is similar to Linux.
+ Download the extension zip file from [release page](https://github.com/KeenSecurityLab/BinAbsInspector/releases)
+ Install the extension according to [Ghidra Extension Notes](https://ghidra-sre.org/InstallationGuide.html#GhidraExtensionNotes)
# Building
Build the extension by yourself, if you want to develop a new feature, please refer to [development guide](https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Developer-Guide).
+ Install Ghidra and Z3
+ Install [Gradle 7.x](https://gradle.org/releases/) (tested version: 7.4)
+ Pull the repository
+ Run `gradle buildExtension` under repository root
+ The extension will be generated at `dist/${GhidraVersion}_${date}_BinAbsInspector.zip`
# Usage
You can run BinAbsInspector in headless mode, GUI mode, or with docker.
+ With Ghidra headless mode.
```
$GHIDRA_INSTALL_DIR/support/analyzeHeadless -import -postScript BinAbsInspector "@@"
```
`` -- Ghidra project path.
`` -- Ghidra project name.
`` -- The argument for our analyzer, provides following options:
| Parameter | Description |
| ----------------------------------------- | --------------------------------------|
| `[-K ]` | KSet size limit [K](https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Technical-Details#kset) |
| `[-callStringK ]` | Call string maximum length [K](https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Technical-Details#context)|
| `[-Z3Timeout ]` | Z3 timeout |
| `[-timeout ]` | Analysis timeout |
| `[-entry
]` | Entry address |
| `[-externalMap ]` | External function model config |
| `[-json]` | Output in json format |
| `[-disableZ3]` | Disable Z3 |
| `[-all]` | Enable all checkers |
| `[-debug]` | Enable debugging log output |
| `[-check "[;...]"]` | Enable specific checkers |
+ With Ghidra GUI
1. Run Ghidra and import the target binary into a project
2. Analyze the binary with default settings
3. When the analysis is done, open `Window -> Script Manager` and find `BinAbsInspector.java`
4. Double-click on `BinAbsInspector.java` entry, set the parameters in configuration window and click OK
5. When the analysis is done, you can see the CWE reports in console window, double-click the addresses from the report can jump to corresponding address
+ With Docker
```shell
git clone [email protected]:KeenSecurityLab/BinAbsInspector.git
cd BinAbsInspector
docker build . -t bai
docker run -v $(pwd):/data/workspace bai "@@" -import <file>
```
# Implemented Checkers
So far BinAbsInspector supports following checkers:
+ [CWE78](https://cwe.mitre.org/data/definitions/78.html) (OS Command Injection)
+ [CWE119](https://cwe.mitre.org/data/definitions/119.html) (Buffer Overflow (generic case))
+ [CWE125](https://cwe.mitre.org/data/definitions/125.html) (Buffer Overflow (Out-of-bounds Read))
+ [CWE134](https://cwe.mitre.org/data/definitions/134.html) (Use of Externally-Controlled Format string)
+ [CWE190](https://cwe.mitre.org/data/definitions/190.html) (Integer overflow or wraparound)
+ [CWE367](https://cwe.mitre.org/data/definitions/367.html) (Time-of-check Time-of-use (TOCTOU))
+ [CWE415](https://cwe.mitre.org/data/definitions/415.html) (Double free)
+ [CWE416](https://cwe.mitre.org/data/definitions/416.html) (Use After Free)
+ [CWE426](https://cwe.mitre.org/data/definitions/426.html) (Untrusted Search Path)
+ [CWE467](https://cwe.mitre.org/data/definitions/467.html) (Use of sizeof() on a pointer type)
+ [CWE476](https://cwe.mitre.org/data/definitions/476.htmll) (NULL Pointer Dereference)
+ [CWE676](https://cwe.mitre.org/data/definitions/676.html) (Use of Potentially Dangerous Function)
+ [CWE787](https://cwe.mitre.org/data/definitions/787.html) (Buffer Overflow (Out-of-bounds Write))
# Project Structure
The structure of this project is as follows, please refer to [technical details](https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Technical-Details) or the [Chinese version article](https://keenlab.tencent.com/zh/2022/04/20/2022-BinAbsInspector-public-release/) for more details.
```
├── main
│ ├── java
│ │ └── com
│ │ └── bai
│ │ ├── checkers checker implementatiom
│ │ ├── env
│ │ │ ├── funcs function modeling
│ │ │ │ ├── externalfuncs external function modeling
│ │ │ │ └── stdfuncs cpp std modeling
│ │ │ └── region memory modeling
│ │ ├── solver analyze core and grpah module
│ │ └── util utilities
│ └── resources
└── test
```
You can also build the javadoc with `gradle javadoc`, the API documentation will be generated in `./build/docs/javadoc`.
# Acknowledgement
We employ [Ghidra](https://ghidra-sre.org/) as our foundation and frequently leverage [JImmutable Collections](http://brianburton.github.io/java-immutable-collections/) for better performance.
Here we would like to thank them for their great help!