jadx

JADX jadx - Dex to Java decompiler Command line and GUI tools for producing Java source code from Android Dex and Apk files !WARNING Please note that in most cases jadx can't decompile all 100% of the code, so errors will occur. Check Troubleshooting guide for workarounds. Main features: decompil...

Dna

Dna Dna 是一个基于 LLVM 构建的静态二进制分析框架。值得注意的是，它几乎完全用 C 编写，包括 LLVM、Remill 和 Souper 的托管绑定。 功能 Dna 实现了一种迭代控制流图重建，其灵感主要来自 SATURN 论文。它迭代地应用递归下降、提升（使用 remill）和路径求解，直到恢复完整的控制流图。对于跳转表，我们使用基于 Souper 和 z3 的递归算法来求解可能的跳转表目标集合。迭代探索算法可在此处找到，跳转表求解算法可在此处找到。 一旦控制流图被完全探索，就可以使用此处和此处的算法将其重新编译为 x86 并重新插入到二进制文件中。尽管编译后的代码 绝不...

REpsych

REpsych : 逆向工程中的心理战 github.com/xoreaxeaxeax/repsych // domas // @xoreaxeaxeax 概述 REpsych 工具集是一个概念验证，演示如何通过程序的控制流图（CFG）生成图像。 典型函数的 CFG| REpsych 生成的 CFG ---|--- | 这个项目没有特定的目的（除了表明它可以实现之外），但（非严肃的）可能应用在 DEF CON 演讲 中有所概述。 该程序在所有经过测试的 IDA Pro 逆向工程工具版本上都能可靠运行，并且在其他 CFG 查看器（Hopper、BinNavi、radare2...

REpsych

REpsych : 逆向工程中的心理战 github.com/xoreaxeaxeax/repsych // domas // @xoreaxeaxeax 概述 REpsych 工具集是一个概念验证，演示如何通过程序的控制流图（CFG）生成图像。 典型函数的 CFG| REpsych 生成的 CFG ---|--- | 该项目没有特定的目的（除了展示这是可以做到的），但一些可能（非严肃的）应用已在 DEF CON 演讲中概述。 该工具集可在所有已测试版本的 IDA Pro 逆向工程工具上可靠运行，并且能在其他 CFG 查看器（Hopper、BinNavi、radare2...

panopticon

非推奨 Panopticon プロジェクトはGitlab に移行し、複数のクレートに再構成されました。Qt GUI は Verso に置き換えられました。 プルリクエストはマージしますが、このバージョンに実質的な作業を行う予定はありません。以下のリンクのほとんどは無効です。 Panopticon - フリーでクロスプラットフォームな逆アセンブラ Panopticon は Rust で書かれた、リバースエンジニアリングのためのクロスプラットフォーム逆アセンブラです。AMD64、x86、AVR、MOS 6502 の命令セットを逆アセンブルでき、ELF...

cfgrip

cfgrip PE/ELF x86/x64 CFG 抽出ツール。バイナリを受け取り、逆アセンブルし、すべてのジャンプとコール GOT、ジャンプテーブル、レジスタトレーシング を解決し、完全な制御フローグラフを構造化 JSON としてエクスポートします。 理由 すべての分岐がどこへ向かうのかを正確に知る必要があります。読むためではなく、パッチを当てるためです。JSON を Zydis や AsmJit...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: BPF: Handling jset if a & b ... as a jump in CFG computation. BPFJSET is a conditional jump, and currently, verifier.c:canjump does not take this into account. This can lead to incorrect live registers and incorrect SCC Set of...

NFTDELTA: Detecting Permission Control Vulnerabilities in NFT Contracts through Multi-View Learning

Permission control vulnerabilities in Non-fungible token NFT contracts can result in significant financial losses, as attackers may exploit these weaknesses to gain unauthorized access or circumvent critical permission checks. In this paper, we propose NFTDELTA, a framework that leverages static...

The Code Whisperer: LLM and Graph-Based AI for Smell and Vulnerability Resolution

Code smells and software vulnerabilities both increase maintenance cost, yet they are often handled by separate tools that miss structural context and produce noisy warnings. This paper presents The Code Whisperer, a hybrid framework that combines graph-based program analysis with large language...

Aether Smart Contract Security Analysis Framework 5.0.2

Aether is a Python-based framework for analyzing Solidity smart contracts, generating vulnerability findings, producing Foundry-based proof-of-concept PoC tests, and validating exploits on mainnet forks. It combines Solidity AST parsing, taint analysis, control flow graph analysis, cross-contract...

Aether Smart Contract Security Analysis Framework 6.0

Aether is a Python-based framework for analyzing Solidity smart contracts, generating vulnerability findings, producing Foundry-based proof-of-concept PoC tests, and validating exploits on mainnet forks. It combines Solidity AST parsing, taint analysis, control flow graph analysis, cross-contract...

SAGA: Detecting Security Vulnerabilities Using Static Aspect Analysis

Python is one of the most popular programming languages; as such, projects written in Python involve an increasing number of diverse security vulnerabilities. However, existing state-of-the-art analysis tools for Python only support a few vulnerability types. Hence, there is a need to detect a...

The vulnerability of Siemens Solid Edge, a design and modeling tool, relates to buffer overflow in the stack. This allows an attacker to execute arbitrary code.

The vulnerability of Siemens Solid Edge’s design and simulation tools is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created CFG format file...

EUVD-2021-0439

Malware in sbrugna...

EUVD-2025-27932

Malicious code in bioql PyPI...

CVE-2025-38607

In the Linux kernel, the following vulnerability has been resolved: bpf: handle jset if a & b ... as a jump in CFG computation BPFJSET is a conditional jump and currently verifier.c:canjump does not know about that. This can lead to incorrect live registers and SCC computation. E.g. in the...

UBUNTU-CVE-2025-38607

In the Linux kernel, the following vulnerability has been resolved: bpf: handle jset if a & b ... as a jump in CFG computation BPFJSET is a conditional jump and currently verifier.c:canjump does not know about that. This can lead to incorrect live registers and SCC computation. E.g. in the...

CVE-2025-38607

In the Linux kernel, the following vulnerability has been resolved: bpf: handle jset if a & b ... as a jump in CFG computation BPFJSET is a conditional jump and currently verifier.c:canjump does not know about that. This can lead to incorrect live registers and SCC computation. E.g. in the...

CVE-2025-38607

CVE-2025-38607 refers to a Linux kernel issue in the BPF verifier where BPF_JSET (conditional jump) was not handled correctly in CFG/live register/SCC computation. The described flaw could cause incorrect live-register tracking and SCC analysis due to can_jump() not accounting for jset, potential...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from the bpf module not treating jset as a jump in CFG calculations...