AwesomeREA.org

Tool

BinCAT

Static binary code analysis toolkit designed for reverse engineers. Starting from a chosen address and initial state, it computes register and memory values, taint and reconstructed types, with forward and backward analysis and heap use-after-free and double-free detection; bits it cannot determine are shown as unknown. It is driven from an IDA plugin, where analysts can override values or taint, skip functions or replace instructions with NOPs before re-running, or from Python and an .ini configuration for automation.

Requirements and limitations

  • Latest release at review: v1.5, published 2025-02-25; its tag is the reviewed master commit, and the repository has had no commits since. The Linux and Windows release archives bundle the analyzer and the IDA plugin, which is installed by running install_plugin.py from IDA. The plugin requires IDA 7.4 or later with Python 3; the changelog adds IDA 8.3 support in v1.3 and IDA 9.0 support in v1.4.
  • The README lists x86-32, x86-64, ARMv7, ARMv8 and PowerPC as analysis targets; the changelog also records initial RISC-V and initial, incomplete ARMv7 Thumb support. The analyzer runs locally on Linux or Windows (macOS only “maybe”, per the README) or as a Flask web service in the airbusseclab/bincat Docker image that the plugin reaches through its remote URL option. Source builds need OCaml with dune, menhir, ocamlgraph, ppxlib and zarith plus Python 3; Windows builds use Cygwin and an opam mingw64 OCaml switch.
  • Each analysis is described by a versioned .ini file covering the program, its sections and imports, the initial register and memory state and overrides; the IDA plugin generates it from the open database, ELF core dumps can supply the initial state, and the format documentation is partial, with the parser source as its reference. Binaries to analyze come from the user; the tutorial uses the project’s own keygen-me sample.
  • AGPL-3.0 per the README and doc/COPYING; GitHub detects no license because there is no root license file. The OCaml code includes LGPLv2 OCaml runtime code, the plugin includes Apache-2.0 code from python-pyqt5-hexview, and a modified copy of c2newspeak is bundled. Results depend on the configured initial state, skipped functions and overrides; nothing was installed or analyzed.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · airbus-seclab/bincat · Revision 5d0ee3b
  2. README.md#L25-L37 GitHub · airbus-seclab/bincat · Revision 5d0ee3b
  3. README.md#L119-L132 GitHub · airbus-seclab/bincat · Revision 5d0ee3b
  4. CHANGELOG GitHub · airbus-seclab/bincat · Revision 5d0ee3b
  5. doc/manual.md GitHub · airbus-seclab/bincat · Revision 5d0ee3b
  6. doc/ini_format.md GitHub · airbus-seclab/bincat · Revision 5d0ee3b
  7. doc/install_manual.md GitHub · airbus-seclab/bincat · Revision 5d0ee3b
  8. doc/install_docker.md GitHub · airbus-seclab/bincat · Revision 5d0ee3b
  9. doc/windows_build.md GitHub · airbus-seclab/bincat · Revision 5d0ee3b
  10. doc/COPYING GitHub · airbus-seclab/bincat · Revision 5d0ee3b
  11. https://github.com/airbus-seclab/bincat/releases/tag/v1.5