AwesomeREA.org

Tool

VulHunt Community Edition

Open-source Community Edition of Binarly REsearch's VulHunt engine for hunting vulnerabilities in POSIX binaries and UEFI firmware on x86 and ARM. Lua rules run on the Rust BIAS framework, which lifts code to Ghidra's P-code and bundles Ghidra's C++ decompiler, and combine taint and dataflow tracking, Weggli-based queries over decompiled code, byte patterns, FLIRT signatures and type libraries; findings are written as JSON with annotated decompiled code. The CLI scans single binaries, Binarly BA2 archives or Binary Ninja databases, and can also run as an MCP server that lets AI assistants open a project, query it with Lua, rename functions and keep notes.

Requirements & limits

  • Release at review: v1.0.0, published 2026-03-07, with Linux x86_64/aarch64, macOS arm64 and Windows x86_64 ZIPs; the reviewed dev commit is 7 commits ahead and its CLI crate declares 1.0.1. The documentation recommends its install scripts or a Docker image built from the repository; source builds need Rust, cargo-make, a recent CMake, Clang 20+ and a patched static LuaJIT 2.1, which cargo-make builds.
  • Scans need auxiliary data from the separate vulhunt-re/data repository (processor specifications and type libraries, fetched with git-lfs and, for source installs, built with bias-lutil and bias-tutil) and a rules directory, such as the community rules repository with POSIX and UEFI rules; the rules, data and agent-skills repositories had no license file at review. The Binary Ninja loader needs a build with the bndb feature, which links against the Binary Ninja 5.2 stable API, and the btp commands need a Binarly Transparency Platform account.
  • Binaries and BA2 archives are supplied by the user. The component loader takes one binary at a time; this repository has no loader for whole UEFI firmware images, since the UEFITool-based loader is published separately and is not part of the reviewed workspace. Binarly describes a commercial Enterprise Edition with further features. Rule findings are analysis aids for manual review, and the reviewed sources report no accuracy evaluation.
  • GPL-3.0 for VulHunt; the BIAS framework crates are dual-licensed MIT OR Apache-2.0 according to README.BIAS.md. Nothing was installed and no binaries were scanned.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary · Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · vulhunt-re/vulhunt · Revision b2fa617
  2. README.md#L115-L159 GitHub · vulhunt-re/vulhunt · Revision b2fa617
  3. Cargo.toml GitHub · vulhunt-re/vulhunt · Revision b2fa617
  4. bias-vulhunt/Cargo.toml GitHub · vulhunt-re/vulhunt · Revision b2fa617
  5. bias-vulhunt-mcp/src/tools.rs GitHub · vulhunt-re/vulhunt · Revision b2fa617
  6. bias-loader-bndb/Cargo.toml GitHub · vulhunt-re/vulhunt · Revision b2fa617
  7. README.BIAS.md GitHub · vulhunt-re/vulhunt · Revision b2fa617
  8. LICENSE GitHub · vulhunt-re/vulhunt · Revision b2fa617
  9. https://github.com/vulhunt-re/vulhunt/releases/tag/v1.0.0
  10. README.md GitHub · vulhunt-re/data · Revision 7015639
  11. https://github.com/vulhunt-re/rules/tree/9da95ac19b0e2a4d9c1b816b9e7dd0b40fe07c7f
  12. https://vulhunt.re/
  13. https://vulhunt.re/docs/user-guide/vulhunt-cli/installation/

More in Native binaries

All 74 entries in Native binaries