AwesomeREA.org

Tool

Binary Analysis Platform (BAP)

OCaml binary analysis platform from Carnegie Mellon University. Its bap command loads a program, disassembles it, lifts instructions into an architecture-neutral intermediate representation, builds the control-flow graph and runs analysis passes, while objdump, raw-loader and mc modes handle linear disassembly, raw code blobs and single encodings. The README lists x86, x86-64, ARM, MIPS and PowerPC support, an interpreter, a microexecution interpreter, a symbolic executor and the Primus Lisp language for analyses, function stubs and SMT-solver queries; analyses are written as OCaml plugins or by embedding BAP as a library, with C bindings and minimal Python support in separate repositories.

Requirements and limitations

  • Latest stable release at review: v2.5.0, published 2022-07-11, with x86_64 Debian and RPM packages, tgz archives and sigs.zip/sigs.tar.gz signature archives; a v2.6.0-alpha development build dates from 2023-01-07. The reviewed master commit (2026-05-07) is 60 commits ahead of v2.5.0 and its opam packages carry version dev; the commit before it dates from April 2025. This entry pins it for documentation only.
  • The binary packages omit the OCaml development environment, so writing analyses needs a source install. The README recommends opam with OCaml 4.14.1 (opam install bap), offers a rolling testing opam repository that follows master, and also documents dune builds from a clone; the opam dependencies keep core_kernel and base below v0.16. The LLVM backend needs llvm-config (conf-bap-llvm 1.8+). The Ghidra and radare2 integrations, which the README calls experimental, and the Z3-based symbolic executor come with the bap-extra meta-package; IDA Pro integration is a separate package.
  • Input is a user-supplied executable, or a raw code blob opened with --loader=raw and a base address. The tree also has RISC-V, SystemZ and Thumb packages beyond the README's architecture list. Lifted output depends on per-architecture semantics coverage; the 2.5.0 changelog adds a --print-missing option to list unlifted instructions.
  • MIT license; contributions to the repository are accepted under MIT, while separately hosted plugins may use any license, including a proprietary one. The README names ForAllSecure Mayhem, Draper's CBAT tools and Fraunhofer FKIE's CWE Checker as projects built on BAP. No packages were installed and no binaries were analyzed.

About this entry

Type
Tool
Category
Binary analysis libraries
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · BinaryAnalysisPlatform/bap · Revision 034bbd0
  2. README.md#L24-L124 GitHub · BinaryAnalysisPlatform/bap · Revision 034bbd0
  3. dune-project GitHub · BinaryAnalysisPlatform/bap · Revision 034bbd0
  4. bap-llvm.opam GitHub · BinaryAnalysisPlatform/bap · Revision 034bbd0
  5. CHANGES.md GitHub · BinaryAnalysisPlatform/bap · Revision 034bbd0
  6. LICENSE GitHub · BinaryAnalysisPlatform/bap · Revision 034bbd0
  7. https://github.com/BinaryAnalysisPlatform/bap/releases/tag/v2.5.0
  8. https://github.com/BinaryAnalysisPlatform/bap/releases/tag/v2.6.0-alpha
  9. https://github.com/BinaryAnalysisPlatform/bap/compare/v2.5.0...034bbd09646a589d5eb1f10b740177d628da80fd