Public | Automated Build

Last pushed: 2 months ago
Short Description
Binary code static analyser, with IDA integration. Value and taint analysis, type reconstruction.
Full Description

Introduction

What is BinCAT?

BinCAT is a static Binary Code Analysis Toolkit, designed to help reverse
engineers, directly from IDA.

It features:

  • value analysis (registers and memory)
  • taint analysis
  • type reconstruction and propagation
  • backward and forward analysis

In action

You can check BinCAT in action here:

Check the tutorial out to see the corresponding tasks.

Quick FAQ

Supported host platforms:

  • IDA plugin: all, version 6.9 or later (BinCAT uses PyQt, not PySide)
  • analyzer (local or remote): Linux, Windows, macOS (maybe)

Supported CPU for analysis (for now):

  • x86-32

Installation

Analyzer

The analyzer can be used locally or through a Web service.

On Windows, the binary distribution includes the analyzer.

On Linux:

IDA Plugin

Only IDA v6.9 or later are supported

Install for Windows

  • Unzip BinCAT
  • In IDA, click on "File -> Script File..." menu (or type ALT-F7)
  • Select windows_install.py
  • BinCAT is now installed in your IDA user dir

Or install manually.

Linux install

Installation instructions

BinCAT should work with IDA on Wine, once pip is installed:

Using BinCAT

Quick start

  • Load the plugin by using the Ctrl-Shift-B shortcut, or using the
    Edit -> Plugins -> BinCAT menu

  • Select an instruction in any IDA view, then use the Ctrl-Shift-A shortcut,
    or the BinCAT -> Analyze from here context menu

Configuration

Global options can be configured through the Edit/BinCAT/Options menu.

Default config and options are stored in $IDAUSR/idabincat/conf.

Options

  • Use remote bincat: select if you are running docker in a Docker container
  • Remote URL: http://localhost:5000 (or the URL of a remote BinCAT server)
  • Autostart: autoload BinCAT at IDA startup
  • Save to IDB: default state for the save to idb checkbox

Analyzer configuration files

Default config for analyzer.

Documentation

A manual is provided.

A tutorial is provided to help you try BinCAT's features.
It makes use of a sample binary and screenshots.

Log levels

  1. basic info
  2. more info
  3. debug
  4. advanced debug

Article and presentations about BinCAT

Licenses

BinCAT is released under the GNU Affero General Public
Licence
.

The BinCAT OCaml code includes code from the original Ocaml runtime, released
under the LGPLv2.

The BinCAT IDA plugin includes code from
python-pyqt5-hexview
by Willi Ballenthin, released under the Apache License 2.0.

Docker Pull Command
Owner
airbusseclab
Source Repository

Comments (0)