Bin Abs Inspector

Abstract

1. Introduction

BinAbsInspector (Binary Abstract Inspector) is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It works on Ghidra's Pcode instead of assembly. Currently it supports binaries on x86,x64, armv7 and aarch64.

Build the extension by yourself, if you want to develop a new feature, please refer to development guide.

2. Objective

BinAbsInspector: Vulnerability Scanner for Binaries

This project demonstrates how Java can be applied to a real-world Cybersecurity & Ethical Hacking problem.

4. Technology Stack

5. System Requirements

General requirements for this technology stack — check the README for exact versions.

• JDK 11 or later
• Maven / Gradle
• IntelliJ IDEA, Eclipse or Android Studio
• Git (to clone the repository)

6. Installation & Setup

git clone https://github.com/KeenSecurityLab/BinAbsInspector.git
cd BinAbsInspector

1. Install Ghidra according to Ghidra's documentation
2. Install Z3 (tested version: 4.8.15)
3. For Windows, download a pre-built package from here, extract the zip file and add a PATH environment variable pointing to z3-${version}-win/bin
4. For Linux, install with package manager is NOT recommended, there are two options:
5. You can download suitable pre-build package from here, extract the zip file and copy z3-${version}-glibc-${version}/bin/.so to /usr/local/lib/
6. or you can build and install z3 according to Building Z3 using make and GCC/Clang
7. For MacOS, it is similar to Linux.
8. Download the extension zip file from release page

$GHIDRA_INSTALL_DIR/support/analyzeHeadless <projectPath> <projectName> -import <file> -postScript BinAbsInspector "@@<scriptParams>"

git clone git@github.com:KeenSecurityLab/BinAbsInspector.git
cd BinAbsInspector
docker build . -t bai
docker run -v $(pwd):/data/workspace bai "@@<script parameters>" -import <file>

Full setup instructions are in the project README.

7. Future Enhancements

Suggested extensions you can add to make this your own project.

• Add logging and alert notifications (email / Telegram)
• Write a threat model document for the tool
• Package it with Docker for safe lab testing

8. Viva / Review Questions

Common questions examiners ask for projects in this domain.

1. Which threat or attack does this project defend against?
2. What detection or protection technique is used and what are its limits?
3. How are false positives and false negatives handled?
4. Which cryptographic algorithms or security standards are involved?
5. What legal and ethical rules apply when testing a tool like this?

9. Source Code & License

This project is developed by KeenSecurityLab and published on GitHub under the GNU General Public License v3.0. Please follow the license terms and credit the original author when you use or modify this code.