BinAbsInspector

什么是 BinAbsInspector？ BinAbsInspector（二进制抽象检查器）是一款用于自动化逆向工程和二进制漏洞扫描的静态分析器，是 Keenlab 孵化的一项长期研究项目。它基于抽象解释，并依托 Ghidra 的支持。它使用 Ghidra 的 Pcode 而非汇编语言。目前支持 x86、x64、armv7 和 aarch64 架构的二进制文件。 安装 根据 Ghidra 的文档安装 Ghidra 安装 Z3（测试版本：4.8.15） 注意：Z3 库通常包含两部分：Java 包和原生库。Java 包已包含在 "/lib" 目录中，但我们建议您替换为自己的 Java...

CVE-2026-53671 PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a TCTX-typed base register as a silent no-op: domemstore in src/crab/ebpftransformer.cpp only models TSTACK stores, and the...

PT-2026-84840

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...

BinAbsInspector - Vulnerability Scanner For Binaries

BinAbsInspector Binary Abstract Inspector is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It works on Ghidra's Pcode...

Static Analysis Tool: Bindead

The tool is based on the dynamic instrumentation framework PIN from Intel. Currently PIN is only working with the x86 architecture. Additionally, bintrace currently is limited to the Linux platform but will be ported to Windows when there is the need to. Actually, building for Windows might work...