AwesomeREA.org

Tool

Ponce

IDA Pro plugin, described by its repository as the winner of the 2016 IDA plugin contest, that brings the Triton framework's taint analysis and symbolic execution into IDA's debugger for x86 and x64 programs. After the analyst taints or symbolizes registers, memory or inputs such as argv or a buffer read with fread, Ponce single-steps the debugged program, analyzes each instruction with Triton and renames the functions that the input influences. Its symbolic engine can solve a branch condition, or negate it and inject a satisfying input into memory, while execution snapshots restore earlier state to try that input; builds with Hex-Rays support also show the results in decompiler pseudocode.

Requirements & limits

  • Latest release at review: v0.3.7, published 2023-06-01, with prebuilt Windows, Linux and macOS zips; the Windows zip holds Ponce.dll and Ponce64.dll builds for IDA 7.0 through 8.1, with none for later IDA releases. The README says Ponce works with any IDA version from 7.0 and that the binary built for the installed IDA version must be used. The reviewed master commit of 2025-06-06 adds only a work-in-progress CI fix after that release.
  • Installation copies the matching build into IDA's plugins folder; the README lists native Windows, Linux and OS X support. Source builds use CMake 3.15+, the IDA SDK for the target version (IDASDK_ROOT_DIR) and Triton, which the CI installs through vcpkg; pseudocode feedback also needs hexrays.hpp from an IDA installation that includes the Hex-Rays decompiler, otherwise -DBUILD_HEXRAYS_SUPPORT=OFF. The repository contains no SDK files, and its CI clones the SDK archives from a separate repository that is not public, so source builds rely on the user's own SDK.
  • Ponce analyzes a program the analyst runs under IDA's debugger, stepping one instruction at a time; the README cites about 3,000 instructions per second in the authors' tests, and common library functions such as printf are blacklisted from analysis by default. The limitations page says symbolic memory indexes can lose track of the input, Triton handles floating-point instructions poorly, and concolic execution only analyzes instructions that actually execute.
  • Ponce's own terms are a BSD-style license, and LICENSE also reproduces Triton's BSD and Z3's MIT licenses; GitHub does not classify the file. No REA connection is established, and nothing was installed or run for this review.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · illera88/Ponce · Revision 6858676
  2. docs/usage/symbolic-and-taint-engines.md GitHub · illera88/Ponce · Revision 6858676
  3. docs/usage/enable-disable.md GitHub · illera88/Ponce · Revision 6858676
  4. docs/usage/blacklist.md GitHub · illera88/Ponce · Revision 6858676
  5. docs/misc/ponce-limitations.md GitHub · illera88/Ponce · Revision 6858676
  6. docs/misc/building.md GitHub · illera88/Ponce · Revision 6858676
  7. CMakeLists.txt GitHub · illera88/Ponce · Revision 6858676
  8. .github/workflows/ci-windows.yml GitHub · illera88/Ponce · Revision 6858676
  9. LICENSE GitHub · illera88/Ponce · Revision 6858676
  10. https://github.com/illera88/Ponce/releases/tag/v0.3.7

More in Native binaries

All 95 entries in Native binaries