AwesomeREA.org

Tool

Pharos

Carnegie Mellon SEI's framework of automated static analysis tools for binary programs, built on LLNL's ROSE compiler infrastructure for disassembly, control-flow analysis and instruction semantics. Its best-known tool, OOAnalyzer, recovers C++ classes, methods and other object-oriented constructs from 32-bit x86 executables built with Microsoft Visual C++ by applying Prolog rules to facts about how object pointers move between functions, as described in a CCS 2018 paper, and exports JSON for an included IDA plugin or the separate Kaiju Ghidra plugin. Other tools find API call sequences (ApiAnalyzer), report static API-call parameters (CallAnalyzer), produce function hashes and YARA signatures for similarity analysis (FN2Hash, FN2Yara) and work out the conditions for reaching one address from another (PathAnalyzer).

Requirements & limits

  • There are no tagged releases; the reviewed master commit is from 2026-08-03. The README calls Pharos a research project under active development whose documentation is incomplete and whose portability has not been actively tested, and it says DumpMASM is no longer maintained, recommending ROSE's own tools instead.
  • The easiest route is the prebuilt ghcr.io/cmu-sei/pharos Docker image, which the GitHub workflow builds for amd64 and arm64 on each push and weekly. Building from source is heavy: C++14 with CMake, Boost, yaml-cpp, SQLite, Z3, SWI-Prolog and ROSE, with the build script pinning ROSE v2.6.0, Z3 4.8.7 and SWI-Prolog 8.5.12. INSTALL.md suggests about 4 GiB of RAM per build CPU for small CPU counts, supports its build script only on the latest Ubuntu, and lists older manually tested configurations on RHEL 7, Ubuntu 19.04 and openSUSE 15.1.
  • Provide the executables to analyze yourself. OOAnalyzer is limited to 32-bit MSVC binaries and has been tested little on 64-bit executables or other compilers; its JSON output feeds the IDA plugin in the repository or the separate Kaiju Ghidra plugin, and very large executables need the extra steps in the oorules notes.
  • The Dockerfile has a test stage that runs ctest against test executables compiled from the sources in tests/, but the GitHub workflow builds only the release image. Nothing was built or run in this review.
  • LICENSE.md is an SEI BSD-style license (Copyright 2021 Carnegie Mellon University) that also restricts use of the CMU and SEI names, which is why GitHub reports NOASSERTION. ROSE, SWI-Prolog, Z3, Boost, yaml-cpp and SQLite keep their own licenses. The reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · cmu-sei/pharos · Revision 782492f
  2. INSTALL.md GitHub · cmu-sei/pharos · Revision 782492f
  3. Dockerfile GitHub · cmu-sei/pharos · Revision 782492f
  4. .github/workflows/docker.yml GitHub · cmu-sei/pharos · Revision 782492f
  5. scripts/build_prereqs.bash GitHub · cmu-sei/pharos · Revision 782492f
  6. CMakeLists.txt GitHub · cmu-sei/pharos · Revision 782492f
  7. tools/ooanalyzer/ooanalyzer.pod GitHub · cmu-sei/pharos · Revision 782492f
  8. tools/ooanalyzer/ida/README.md GitHub · cmu-sei/pharos · Revision 782492f
  9. share/prolog/oorules/README.md GitHub · cmu-sei/pharos · Revision 782492f
  10. tools/apianalyzer/apianalyzer.pod GitHub · cmu-sei/pharos · Revision 782492f
  11. tools/pathanalyzer/pathanalyzer.pod GitHub · cmu-sei/pharos · Revision 782492f
  12. LICENSE.md GitHub · cmu-sei/pharos · Revision 782492f
  13. https://edmcman.github.io/papers/ccs18.pdf
  14. https://github.com/cmu-sei/pharos/pkgs/container/pharos

More in Native binaries

All 77 entries in Native binaries