Binary Analysis Craft!

Overview

logo

BinCraft - Binary Analysis Craft

BinCraft is a future binary analysis toolkit.

Features:

  • Layered Architecture: composed by multiple libraries that can be used seperatedly.
  • Written in Rust: high performance, safe interface, no VM.
  • Python API: easy scripting. In the future, C API will also be provided, allows to bind to more programming languages.
  • Extensible: with sleigh DSL, new architecture is easy to add.
  • (Currently In Development) SQL based binary analysis

BinCraft is seperated into multiple parts, while currently only the first one, sleighcraft is working.

NOTE:

this project is still in early stage. Large scale API modifications, bugs are expected. Documentations are yet to be complete. Star us, we will try our best to make it complete and better. 🥺 Please, do it.

SleighCraft

SleighCraft is a decoder (or, linear disassembler) based on ghidra's decompiler implementation. Sleighcraft can be used in Rust or Python, with both high-level and low-level API.

In general, sleighcraft is just like capstone but with IR and more archs.

Features:

  • Rust based API and Python scripting API.
  • Decoding with IR as the semantic meaning.
  • Archs: 110 architectures.

️️ ✔️ : provided

❌ : not provided

🚧 : in construction

🤔 : not sure, maybe not

Comparison with capstone:

Feature SleighCraft Capstone Engine
disassemble ✔️ ✔️
IR ✔️ ️ ❌
C API 🚧 ✔️
custom architecture ️ ✔️ ❌

Architectures comparision with capstone (according to capstone arch list):

Arch Names SleighCraft Capstone Engine
6502 ✔️ 🤔
6805 ✔️ 🤔
8051 ✔️ 🤔
8048 ✔️ 🤔
8085 ✔️ 🤔
68000 ✔️ 🤔
aarch64(armv8) ✔️ ️️ ✔️
arm ✔️ ️️ ✔️
cp1600 ✔️ 🤔
cr16 ✔️ 🤔
avr8 ✔️ ️️ 🤔
dalvik ✔️ 🤔
jvm ✔️ 🤔
mips ✔️ ️️ ✔️
powerpc ✔️ ️️ ✔️
sparc ✔️ ️️ ✔️
tricore ✔️ 🤔
riscv ✔️ 🤔
z80 ✔️ 🤔
System Z ❌ ✔️
xCore ❌ ✔️

How to install

Rust

Use cargo:

sleighcraft = { git = "https://github.com/ret2lab/bincraft" }

The repo is a bit large to submit on crates-io (because of predefined sla files), but save you the complex of compiling sleigh files yourself.

Python

# quick install it with pip
$ pip3 install bincraft

# or download binaries than choose the corresponding architecture
$ pip3 install bincraft-0.1.0-cp39-cp39-Arch.whl

# or manual, to do this, you need to have rust compiler installed and maturin
# better with rustup.
$ pip3 install maturin
$ maturin build
$ pip3 install bincraft-0.1.0-cp39-cp39-Arch.whl

How to Use

One could refer to doc.rs to see how Rust binding can be used.

Python binding:

from bincraft import Sleigh

code = [0x90, 0x31, 0x32] # code to disassemble

# init the sleigh engine Sleigh(arch, code)
sleigh = Sleigh("x86", code)

# now we are prepared to disassemble!
# disasm(start_addr)
for asm in sleigh.disasm(0):
    addr = asm.addr()
    mnem = asm.mnemonic()
    body = asm.body()

    # quite like capstone, right?
    print(f'Addr: {addr}\t  mnemonic: {mnem}\t body: {body}')

    # but! we also have the IR!
    pcodes = asm.pcodes()
    for pcode in pcodes:
        opcode = pcode.opcode()
        vars = pcode.vars()
        print(f'opcode: {opcode}\t vars: {vars}\t')
    print()

Rust (kinda low level):

// Overall procedure:
// 1. get the spec, this is where we know how to decode anything
// 2. get a loader, this is where we fill the input bytes to the engine.
// A predefined loader is provided: `PlainLoadImage`, which sets
// the things to decode by using a single buf.
// 3. set the AssemblyEmit and PcodeEmit instance, these are two
// traits that defines the callback at the decode time.
// 4. do the decode
use sleighcraft::*;
let mut sleigh_builder = SleighBuilder::default();
let spec = arch("x86").unwrap();
let buf = [0x90, 0x32, 0x31];
let mut loader = PlainLoadImage::from_buf(&buf, 0);
sleigh_builder.loader(&mut loader);
sleigh_builder.spec(spec);
let mut asm_emit = CollectingAssemblyEmit::default();
let mut pcode_emit = CollectingPcodeEmit::default();
sleigh_builder.asm_emit(&mut asm_emit);
sleigh_builder.pcode_emit(&mut pcode_emit);
let mut sleigh = sleigh_builder.try_build().unwrap();

sleigh.decode(0).unwrap();

println!("{:?}", asm_emit.asms);
println!("{:?}", pcode_emit.pcode_asms);

A more detailed documentation of Rust API is still under development.

QueryCraft (In-Development)

QueryCraft is a SQL based binary analysis, its goal is to allow analyzer write SQL to fetch information (both raw and analyzed) from binary.

This is a currently in development future.

Demo only support for disassembly bytes into table is available. One can do this using the demo:

sqlite> .load ./libquerycraft.so
sqlite> select qc_disasm("bytes", X'319090', "x86", "qc_out_asm", "qc_out_pcode");
1
sqlite> select * from qc_out_asm;
ram|0|XOR|word ptr [BX + SI + 0x90],DX
sqlite> select * from qc_out_pcode;
ram|0|INT_ADD|register|12|2|register|24|2||||unique|4736|2|
ram|0|INT_ADD|unique|4736|2|const|144|2||||unique|4992|2|
ram|0|CALLOTHER|const|0|4|register|262|2|unique|4992|2|unique|14336|4|
ram|0|COPY|const|0|1|||||||register|512|1|
ram|0|COPY|const|0|1|||||||register|523|1|
ram|0|LOAD|const|94230195853072|8|unique|14336|4||||unique|30848|2|
ram|0|INT_XOR|unique|30848|2|register|8|2||||unique|30848|2|
ram|0|STORE|const|94230195853072|8|unique|14336|4|unique|30848|2||||
ram|0|LOAD|const|94230195853072|8|unique|14336|4||||unique|30848|2|
ram|0|INT_SLESS|unique|30848|2|const|0|2||||register|519|1|
ram|0|LOAD|const|94230195853072|8|unique|14336|4||||unique|30848|2|
ram|0|INT_EQUAL|unique|30848|2|const|0|2||||register|518|1|
ram|0|LOAD|const|94230195853072|8|unique|14336|4||||unique|30848|2|
ram|0|INT_AND|unique|30848|2|const|255|2||||unique|55552|2|
ram|0|POPCOUNT|unique|55552|2|||||||unique|55680|1|
ram|0|INT_AND|unique|55680|1|const|1|1||||unique|55808|1|
ram|0|INT_EQUAL|unique|55808|1|const|0|1||||register|514|1|

In the Future

Currently we are in the early stage of the project. But we have already planned several goals in the future:

  • decoder (linear disassembler) with IR (based on ghidra)
  • encoder (single instruction assemble) (based on ghidra)
  • universal binary analysis algorithms (CFG generation, data flow information)
  • C API/More language bindings
  • PCode emulator
  • Analysis Framework
  • symbolic execution
  • customizable (with DSL, like sleigh to decoder) loader

About Us

This is a project started by StarCrossTech PortalLab.

Any contribution through pull request is welcome. ✌️

You might also like...
Pharos Static Binary Analysis Framework

Automated static analysis tools for binary programs

Binary data analysis and visualization tool
Binary data analysis and visualization tool

Veles - A new age tool for binary analysis It is a very difficult task for a human to notice subtle patterns in large amounts of binary data, however,

Maat is an open-source Dynamic Symbolic Execution and Binary Analysis framework
Maat is an open-source Dynamic Symbolic Execution and Binary Analysis framework

About Maat is an open-source Dynamic Symbolic Execution and Binary Analysis framework. It provides various functionalities such as symbolic execution,

Terrain Analysis Using Digital Elevation Models (TauDEM) software for hydrologic terrain analysis and channel network extraction.

TauDEM (Terrain Analysis Using Digital Elevation Models) is a suite of Digital Elevation Model (DEM) tools for the extraction and analysis of hydrolog

Your binary serialization library

Bitsery Header only C++ binary serialization library. It is designed around the networking requirements for real-time data delivery, especially for ga

Fast Binary Encoding is ultra fast and universal serialization solution for C++, C#, Go, Java, JavaScript, Kotlin, Python, Ruby, Swift

Fast Binary Encoding (FBE) Fast Binary Encoding allows to describe any domain models, business objects, complex data structures, client/server request

Simple Binary Encoding (SBE) - High Performance Message Codec

Simple Binary Encoding (SBE) SBE is an OSI layer 6 presentation for encoding and decoding binary application messages for low-latency financial applic

A simple C library for compressing lists of integers using binary packing

The SIMDComp library A simple C library for compressing lists of integers using binary packing and SIMD instructions. The assumption is either that yo

Binary Serialization

Binn Binn is a binary data serialization format designed to be compact, fast and easy to use. Performance The elements are stored with their sizes to

Binary visualization tool primarily aimed at videogame reverse engineering & research.
Binary visualization tool primarily aimed at videogame reverse engineering & research.

binviz Binary visualization tool. Allows you to load a binary and pan/zoom around its content. Each byte (or 4 bytes in 4-byte mode) is represented by

Utility to convert any binary file into C source that can be compiled and linked to the executable.

bin2c Utility to convert any binary file into C source that can be compiled and linked to the executable. bin2o Utility to convert any binary file int

Zmeya is a header-only C++11 binary serialization library designed for games and performance-critical applications

Zmeya Zmeya is a header-only C++11 binary serialization library designed for games and performance-critical applications. Zmeya is not even a serializ

Orbit, the Open Runtime Binary Instrumentation Tool, is a standalone C/C++ profiler for Windows and Linux
Orbit, the Open Runtime Binary Instrumentation Tool, is a standalone C/C++ profiler for Windows and Linux

Orbit, the Open Runtime Binary Instrumentation Tool, is a standalone C/C++ profiler for Windows and Linux. Its main purpose is to help developers visualize the execution flow of a complex application.

A lightweight and simpling iOS binary decryptor

FlexDecrypt's source code is pretty FAT, bundling the whole swift runtime to just achieve a simple mremap_encrypted.

A Binary Genetic Traits Lexer

BinLex a Genetic Binary Trait Lexer Library and Utility The purpose of BinLex is to extract basic blocks and functions as traits from binaries. Most p

Tilck is an educational monolithic x86 kernel designed to be Linux-compatible at binary leve
A simple processor emulator written in c++ that can parse and execute x32 code. x32 is binary code made by me for this processor.

A SIMPLE PROCESSOR EMULATOR AND CODE EXECUTOR The Repository This is a fairly new project and is still heavy in development. If you find and bugs feel

VMPImportFixer is a tool aimed to resolve import calls in a VMProtect'd (3.x) binary.
VMPImportFixer is a tool aimed to resolve import calls in a VMProtect'd (3.x) binary.

VMPImportFixer VMPImportFixer is a tool aimed to resolve import calls in a VMProtect'd (3.x) binary. Information VMPImportFixer attempts to resolve al

C++ Simplistic Binary Stream

C++ Simplistic Binary Stream Bare minimal header-only binary stream based on C++ file streams where the stream operator can be overloaded for your cus

Comments
  • Tool requirement: binary generation from API

    Tool requirement: binary generation from API

    The Sleigh engine is the core of ghidra decompiler. It can deal with the binary stream, disassemble it into instructions and lift it into IRs.

    However, its restriction is that it can only deal with the binary stream instead of text streams. Sometimes we are given the text streams, and we know the underlining semantic of each text instruction. To deal with such situation, the usage of sleigh engine is hard.

    A possible solution of this is to write a tool (possibly in Python?) that could generate the binary according to the text instructions and a sleigh specification that could further translate the binary back to the text format.

    This allows the sleigh engine to be bypassed and let the ghidra do the rest of the job as it is.

    What we need:

    • [ ] API design
    • [ ] instruction choice algorithm (choose the binary format of each instruction when instructions are fed into the API)
    • [ ] sleigh generation algorithm
    • [ ] complete tool
    opened by Escapingbug 1
Owner
PortalLab
StarCross Technology PortaLab 星阑科技PortalLab实验室 (Previous Ret2Lab)
PortalLab
This is like Inverting Binary Tree, but instead of a Binary Tree it's a File Tree.

Invert File Tree in C++ This is like Inverting Binary Tree, but instead of the Binary Tree it's a File Tree. This is intended as a simple exercise to

Tsoding 11 Jun 18, 2021
A Binary Genetic Traits Lexer

BinLex a Genetic Binary Trait Lexer Library and Utility The purpose of BinLex is to extract basic blocks and functions as traits from binaries. Most p

c3rb3ru5 297 Sep 27, 2022
WIP runtime binary patcher for Aroma

Example plugin This is just a simple example plugin which can be used as a template. Building For building you need: wups wut libutils for common func

Ash 4 Sep 19, 2021
Binary Search tree

eng Binary tree Task: Create a binary search tree, the information part of which will be a symbol, make direct and symmetric traversals, search for th

Andrey 0 Nov 25, 2021
C++ DataFrame for statistical, Financial, and ML analysis -- in modern C++ using native types, continuous memory storage, and no pointers are involved

C++ DataFrame for statistical, Financial, and ML analysis -- in modern C++ using native types, continuous memory storage, and no pointers are involved

Hossein Moein 1.6k Oct 1, 2022
A Pipeline for LC-MS/MS Metabolomics Data Process and Analysis

NP³ MS Workflow A Pipeline for LC-MS/MS Metabolomics Data Process and Analysis Overview The NP³ MS workflow is a software system with a collection of

null 3 Feb 15, 2022
Binary Analysis Craft!

BinCraft - Binary Analysis Craft BinCraft is a future binary analysis toolkit. Features: Layered Architecture: composed by multiple libraries that can

PortalLab 62 Aug 25, 2022
Probabilistic Risk Analysis Tool (fault tree analysis, event tree analysis, etc.)

SCRAM SCRAM is a Command-line Risk Analysis Multi-tool. This project aims to build a command line tool for probabilistic risk analysis. SCRAM is capab

Olzhas Rakhimov 112 Sep 6, 2022
CRAFT: A Benchmark for Causal Reasoning About Forces and inTeractions

CRAFT This repository contains the codes used to generate the CRAFT dataset as described in the paper: CRAFT: A Benchmark for Causal Reasoning About F

null 10 Apr 12, 2022
This is like Inverting Binary Tree, but instead of a Binary Tree it's a File Tree.

Invert File Tree in C++ This is like Inverting Binary Tree, but instead of the Binary Tree it's a File Tree. This is intended as a simple exercise to

Tsoding 11 Jun 18, 2021