AwesomeREA.org

Tool

BARF

Python binary analysis framework that loads ELF and PE programs, disassembles 32- and 64-bit x86 and 32-bit ARM code with Capstone and translates it into the REIL intermediate language, so its analyses do not depend on the source architecture. Modules recover control-flow and call graphs, emulate REIL and turn code fragments into Z3 or CVC4 formulas for checking constraints on registers and memory; release 0.6.0 added basic symbolic execution. Bundled command-line tools recover CFGs and call graphs, replay x86 execution traces and search, classify and verify ROP gadgets.

Targets
Binary
Category
Binary analysis libraries
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Inactive since 2019: the reviewed master commit, dated 2019-11-24, is tagged v0.6.0 and is the last commit; 0.6.0 is also the newest PyPI release of barf. GitHub does not mark the repository archived, and it has tags but no GitHub release entries, although the README links a v0.6.0 release page. setup.py classifies it as alpha, and the README still calls it under development.
  • setup.py and the Travis CI configuration target Python 2.7 and 3.6, with Python 3 support added in 0.6.0. The README says all packages were tested on Ubuntu 16.04 x86_64, and the Dockerfile installs it on Ubuntu 18.04 through Python 2 pip. Dependencies include Capstone 3.0.5rc2+, pefile, pyelftools, networkx, pydot and pyparsing, plus at least one of the Z3 or CVC4 solvers; Graphviz is needed for graph output and PyAsmJIT for some tests. Compatibility with current Python, Capstone or Z3 releases was not tested.
  • Binaries come from the analyst. The repository bundles small sample binaries built from included C sources under examples/misc/samples and tests, and two challenge binaries for its worked examples: Flare-On 2015 challenge #2 (examples/flareon-2015/2/bin/very_success) and kao's toy project (examples/kaos-toy-project/bin/toyproject.exe). The Sphinx manual is in Spanish and refers to an install.sh script that is not present at the reviewed commit.
  • BSD 2-Clause license, copyright 2014 Fundación Dr. Manuel Sadosky. The README describes checking instruction translations by running code natively through PyAsmJIT and in the REIL emulator and comparing the final contexts; that nose test suite was not run, and no binaries were analyzed.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · programa-stic/barf-project · Revision 9547ef8
  2. README.md#L196-L320 GitHub · programa-stic/barf-project · Revision 9547ef8
  3. setup.py GitHub · programa-stic/barf-project · Revision 9547ef8
  4. CHANGELOG.md GitHub · programa-stic/barf-project · Revision 9547ef8
  5. .travis.yml GitHub · programa-stic/barf-project · Revision 9547ef8
  6. Dockerfile GitHub · programa-stic/barf-project · Revision 9547ef8
  7. doc/manual/source/installation/index.rst GitHub · programa-stic/barf-project · Revision 9547ef8
  8. examples GitHub · programa-stic/barf-project · Revision 9547ef8
  9. LICENSE GitHub · programa-stic/barf-project · Revision 9547ef8
  10. https://pypi.org/project/barf/0.6.0/

More in Native binaries

All 158 entries in Native binaries