AwesomeREA.org

Tool

Quokka

Quarkslab’s binary exporter, inspired by BinExport, saves a disassembler’s analysis to a protobuf .quokka file so functions, basic blocks, data, cross-references, segments and optionally decompiled code can be used later without the disassembler. Its Python bindings load an export together with the original binary, decode instructions at runtime with Capstone, or optionally lift them to P-code with pypcode, and expose programs, functions and control-flow graphs through one API. The main branch adds Ghidra and Binary Ninja exporters beside the IDA Pro plugin, a parallel quokka-cli batch exporter and name and type edits that can be written back to an IDA database.

Targets
Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v0.6.2, published 2025-12-08 together with quokka-project 0.6.2 on PyPI; its README supports IDA 7.3+, and it ships prebuilt IDA plugins for IDA 7.4 through 9.2 on Windows, Linux and macOS. The reviewed main commit (2026-10-14) is 261 commits later and declares version 1.0.0; the Ghidra and Binary Ninja exporters, quokka-cli and the IDA 9.1+ requirement described here exist only on main, not in a released package.
  • Exporting needs one disassembler. The main-branch C++ plugin targets IDA Pro 9.1+, installs through hcli on 9.2+ or builds with CMake, which fetches the open-source IDA SDK for 9.2+ and needs a separately obtained SDK for older versions; the Java extension needs Ghidra 12.0.3+ and JDK 21+; the Binary Ninja plugin declares version 4.0 build 4911 as its minimum, and headless use there needs a commercial license. The Python bindings need Python 3.10+ on main, or 3.8+ for 0.6.2, with capstone, networkx, protobuf and python-magic.
  • Only the LIGHT export mode works: exports hold block-level data, so loading them needs the original binary for Capstone to decode instructions, and the self-contained FULL mode is planned but not implemented. quokka-cli offers decompiled-code export for IDA only. The README warns that Capstone’s disassembly can differ from the disassembler’s.
  • Test fixtures in tests/dataset are stored with Git LFS: programs built from the included many_types and sig_test sources, a Linux kernel module (nf_nat_pt.ko), a UEFI PEI module (StatusCodeHandlerPei.efi), a puraUpdate executable and their exports; docs/samples adds a qb-crackme sample and its export. Workflows build the IDA plugin, build and test the Ghidra extension, test the Binary Ninja plugin and run the Python tests on Python 3.10–3.13; this review ran nothing.
  • Apache-2.0 license; IDA Pro, Ghidra and Binary Ninja keep their own terms. The reviewed sources establish no REA or AI use.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · quarkslab/quokka · Revision 5afe14b
  2. https://github.com/quarkslab/quokka/releases/tag/v0.6.2
  3. https://github.com/quarkslab/quokka/blob/v0.6.2/README.md
  4. https://pypi.org/project/quokka-project/0.6.2/
  5. pyproject.toml GitHub · quarkslab/quokka · Revision 5afe14b
  6. bindings/python/quokka/version.py GitHub · quarkslab/quokka · Revision 5afe14b
  7. ghidra_extension/README.md GitHub · quarkslab/quokka · Revision 5afe14b
  8. binaryninja_extension/README.md GitHub · quarkslab/quokka · Revision 5afe14b
  9. .gitattributes GitHub · quarkslab/quokka · Revision 5afe14b
  10. .github/workflows/python.yml GitHub · quarkslab/quokka · Revision 5afe14b
  11. LICENSE GitHub · quarkslab/quokka · Revision 5afe14b

More in Native binaries

All 132 entries in Native binaries