[{"_1":2,"_182":-5,"_183":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_161":162},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":89,"_112":113,"_150":-5,"_151":11,"_152":21,"_153":11,"_154":-5,"_155":11,"_156":-5,"_157":158,"_159":114,"_160":-7},"canonicalUrl","https://hub.docker.com/r/binaryanalysisplatform/bap-release/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","binaryanalysisplatform","reponame","bap-release","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":21,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2017-02-08T20:43:49.386124Z","description","Official BAP Releases","is_private","last_updated","2017-09-29T18:32:05.933204Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",469,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Overview\n\n[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/BinaryAnalysisPlatform/bap/blob/master/LICENSE)\n[![Join the chat at https://gitter.im/BinaryAnalysisPlatform/bap](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/BinaryAnalysisPlatform/bap?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)\n[![docs](https://img.shields.io/badge/doc-1.3.0-green.svg)](http://binaryanalysisplatform.github.io/bap/api/v1.3.0/argot_index.html)\n[![docs](https://img.shields.io/badge/doc-master-green.svg)](http://binaryanalysisplatform.github.io/bap/api/master/argot_index.html)\n[![Build Status](https://travis-ci.org/BinaryAnalysisPlatform/bap.svg?branch=master)](https://travis-ci.org/BinaryAnalysisPlatform/bap)\n[![pip](https://img.shields.io/badge/pip-1.3.0-green.svg)](https://pypi.python.org/pypi/bap/)\n\nThe Binary Analysis Platform is a reverse engineering and program analysis platform \nthat works with binary code and doesn't require the source code. BAP supports \nmultiple architectures x86, x86-64, and ARMv7, PowerPC, and MIPS. BAP disassembles and lifts binary code into \nthe RISC-like BAP Instruction Language ([BIL](https://github.com/BinaryAnalysisPlatform/bil/releases/download/v0.1/bil.pdf)). \nProgram analysis is performed on BIL representation and is architecture independent in a sense that it will work equally\nwell for all the supported architectures. The platform comes with a set of tools, libraries, and plugins. \nThe main purpose of BAP is to provide a toolkit for automated program analysis. BAP is written \nin [OCaml](https://ocaml.org/) and it is the preferred language to write analysis, we have bindings to \n[C](https://github.com/BinaryAnalysisPlatform/bap-bindings),\n[Python](https://github.com/BinaryAnalysisPlatform/bap-python) and\n[Rust](https://github.com/maurer/bap-rust). The Primus Framework also provide a Lisp-like DSL for writing program analysis tools.\n\nBAP is developed in [CMU, Cylab](https://www.cylab.cmu.edu/) and is sponsored by various grants \nfrom the United States Department of Defense, Siemens AG, and the Korea government, see [sponsors](#Sponsors) for more information. \n\n# Table of contents\n* [Installation](#installation)\n * [Binary](#binary) \n * [Sources](#from-sources)\n* [Usage](#usage)\n * [Shell](#shell)\n * [OCaml](#ocaml) \n * [Python](#python)\n * [C](#c)\n * [baptop](#baptop)\n* [Contributing](#contributing)\n* [Sponsors](#sponsors)\n\n# Installation\n\n## Binary\n\nWe provide binary packages packed for Debian and Red Hat\nderivatives. For other distributions we provide tgz archives. To\ninstall bap on a Debian derivative:\n\n```bash\nwget https://github.com/BinaryAnalysisPlatform/bap/releases/download/v1.3.0/{bap,libbap,libbap-dev}_1.3.0.deb\nsudo dpkg -i {bap,libbap,libbap-dev}_1.3.0.deb\n```\n\n## From sources\n\nThe binary release doesn't contain OCaml runtime, and is suitable only\nif you are not going to extend BAP using OCaml programming language. \nIf you want to write your own analysis in OCaml, we recommend to use the OPAM package manager to\ninstall BAP and the development environment. After you've successfully\n[installed](https://opam.ocaml.org/doc/Install.html) OPAM, run the\nfollowing commands:\n\n```bash\nopam init --comp=4.03.0 # install the compiler\neval `opam config env` # activate opam environment\nopam depext --install bap # install bap\n```\n\nGot any problems? Then visit our [troubleshooting page](https://github.com/BinaryAnalysisPlatform/bap/wiki/Troubleshooting-installation) \nor contact us directly via our Gitter [chat](https://gitter.im/BinaryAnalysisPlatform/bap).\n\n# Usage\n\n## Shell\n\nThe BAP main frontend is a command line utility called `bap`. You can\nuse it to explore the binary, run existing analysis, plugin your own\nbehavior, load traces, and much more.\n\nTo dump a program in various formats use the `--dump` option (or its short\nequivalent, `-d`), For example, let's run `bap` on the\n[x86_64-linux-gnu-echo](https://github.com/BinaryAnalysisPlatform/bap-testsuite/blob/master/bin/x86_64-linux-gnu-echo)\nfile.\n\n```fortran\n$ bap testsuite/bin/x86_64-linux-gnu-echo -d | grep 'sub print_endline' -A44\n00000334: sub print_endline()\n00000301: \n00000302: v483 := RBP\n00000303: RSP := RSP - 8\n00000304: mem := mem with [RSP, el]:u64 <- v483\n00000305: RBP := RSP\n00000307: RSP := RSP - 0x20\n0000030e: mem := mem with [RBP + 0xFFFFFFFFFFFFFFE8, el]:u64 <- RDI\n0000030f: RAX := mem[RBP + 0xFFFFFFFFFFFFFFE8, el]:u64\n00000310: mem := mem with [RBP + 0xFFFFFFFFFFFFFFF8, el]:u64 <- RAX\n00000311: goto %00000312\n\n00000312: \n00000313: RAX := mem[RBP + 0xFFFFFFFFFFFFFFF8, el]:u64\n00000314: RAX := pad:64[pad:32[mem[RAX]]]\n00000315: v545 := low:8[low:32[RAX]]\n0000031b: ZF := 0 = v545\n0000031c: when ~ZF goto %0000032a\n0000031d: goto %0000031e\n\n0000031e: \n0000031f: RDI := pad:64[0xA]\n00000320: RSP := RSP - 8\n00000321: mem := mem with [RSP, el]:u64 <- 0x400731\n00000322: call @putchar with return %00000323\n\n00000323: \n00000324: RSP := RBP\n00000325: RBP := mem[RSP, el]:u64\n00000326: RSP := RSP + 8\n00000327: v693 := mem[RSP, el]:u64\n00000328: RSP := RSP + 8\n00000329: return v693\n\n0000032a: \n0000032b: RAX := mem[RBP + 0xFFFFFFFFFFFFFFF8, el]:u64\n0000032c: RDX := RAX + 1\n0000032d: mem := mem with [RBP + 0xFFFFFFFFFFFFFFF8, el]:u64 <- RDX\n0000032e: RAX := pad:64[pad:32[mem[RAX]]]\n0000032f: RAX := pad:64[extend:32[low:8[low:32[RAX]]]]\n00000330: RDI := pad:64[low:32[RAX]]\n00000331: RSP := RSP - 8\n00000332: mem := mem with [RSP, el]:u64 <- 0x40071C\n00000333: call @putchar with return %00000312\n```\n\nBy default, the `--dump` options used the IR format, but you can\nchoose from various other formats. Use the `--list-formats` option to\nget the list. However, formats are provided by plugins, so just\nbecause you don't see your preferred format listed doesn't mean you\ncan't generate it. Check OPAM for plugins which may provide the format\nyou want to read (the bap-piqi plugin provides protobuf, xml, and\njson, which cover many use cases).\n\nTo discover what plugins are currently available, use the\n`--list-plugins` option. A short description will be printed for each\nplugin. The `--list-plugins` option also accepts a list of tags, that \nwill limit the output to plugins that match with the selected tags. For \nthe list of tags use the `--list-tags` option. You can also use \nthe `opam search bap` command, to get the information about bap packages,\navailable from OPAM.\n\nTo get information about a specific plugin named `` use\nthe `---help` option, e.g., `bap --llvm-help`.\n\nThe `bap` utility works with whole binaries; if you have just few\nbytes with which you would like to tackle, then `bap-mc` is what you\nare looking for.\n\n\n## OCaml\n\nAn idiomatic way of using BAP is to extend it with a plugin. Suppose,\nyou want to write some analysis. For example, let's estimate the ratio\nof jump instructions to the total amount of instructions (a value that\nprobably correlates with a complexity of a program).\n\nSo, let's do it. Create an empty folder, then open your\n[favorite text editor](https://github.com/BinaryAnalysisPlatform/bap/wiki/Emacs)\nand write the following program in a `jmp.ml` file:\n\n```ocaml\nopen Core_kernel.Std\nopen Bap.Std\n\nlet counter = object\n inherit [int * int] Term.visitor\n method! enter_term _ _ (jmps,total) = jmps,total+1\n method! enter_jmp _ (jmps,total) = jmps+1,total\nend\n\nlet main proj =\n let jmps,total = counter#run (Project.program proj) (0,0) in\n printf \"ratio = %d/%d = %g\\n\" jmps total (float jmps /. float total)\n\n\nlet () = Project.register_pass' main\n```\n\nBefore we run it, let's go through the code. The `counter` object is a\nvisitor that has a state consisting of a pair of counters. The first\ncounter keeps track of the number of jmp terms, and the second counter\nis incremented every time we enter any term. The `main` function\njust runs the counter. Finally, we register it with the\n`Project.register_pass'` function. Later the function can be invoked\nfrom a command line, and it will get a project data structure, that\ncontains all the information that was recovered from a binary.\n\nTo compile the plugin simply run the following command:\n\n```\nbapbuild jmp.plugin\n```\n\nIt is easier to run the pass, if it is installed, so let's do it:\n\n```\nbapbundle install jmp.plugin\n```\n\nNow we can test it:\n```\n$ bap /bin/true --pass=jmp\nratio = 974/7514 = 0.129625\n$ bap /bin/ls --pass=jmp\nratio = 8917/64557 = 0.138126\n```\n\n## Python\n\nOK, If the previous example doesn't make any sense to you, then you\ncan try our\n[Python bindings](https://github.com/BinaryAnalysisPlatform/bap-python).\nInstall them with `pip install bap` (you still need to install `bap`\nbeforehand). Here is the same example, but in Python:\n\n```python\nimport bap\nfrom bap.adt import Visitor\n\nclass Counter(Visitor) :\n def __init__(self):\n self.jmps = 0\n self.total = 0\n\n def enter_Jmp(self,jmp):\n self.jmps += 1\n\n def enter_Term(self,t):\n self.total += 1\n\nproj = bap.run('/bin/true')\ncount = Counter()\ncount.run(proj.program)\nprint(\"ratio = {0}/{1} = {2}\".format(count.jmps, count.total,\n count.jmps/float(count.total)))\n```\n\n## C\n\nThe same program in C will take too much space, and will not fit into\nthe README format, but this is an example, of a simple diassembler in C:\n\n```c\n#include \n#include \n\nchar data[] = \"\\x48\\x8d\\x00\";\n\nint main(int argc, const char **argv) {\n bap_init(argc, argv);\n\n if (bap_load_plugins() < 0) {\n fprintf(stderr, \"Failed to load BAP plugins\\n\");\n return 1;\n }\n\n bap_disasm_basic_t *dis = bap_disasm_basic_create(BAP_ARCH_X86_64);\n\n if (!dis) {\n fprintf(stderr, \"can't create a disassembler: %s\\n\", bap_error_get());\n }\n\n const int len = sizeof(data) - 1;\n bap_code_t *code = bap_disasm_basic_next(dis, data, sizeof(data) - 1, 0x80000);\n if (!code) {\n fprintf(stderr, \"can't disassemble instruction: %s\\n\", bap_error_get());\n return 1;\n }\n bap_code_print(code);\n bap_release(code);\n bap_disasm_basic_close(dis);\n return 0;\n}\n```\n\nThe example can be compiled with the following command (assuming that\nthe code is in the `example.c` file):\n\n```\nmake LDLIBS=-lbap example\n```\n\n\n\n## baptop\n\nBAP also ships an interactive toplevel, aka REPL. This is a shell-like\nprogram that will interactively evaluate OCaml instructions and\nprint the results. Just run:\n\n```bash\n$ baptop\n```\n\nNow, you can play with BAP. The following example will open a file,\nbuild callgraph of a program, and a control flow graph with a\ndominance tree of a function.\n\n```ocaml\nopen Core_kernel.Std;;\nopen Bap.Std;;\nopen Graphlib.Std;;\nlet rooter = Rooter.Factory.find \"byteweight\" |> Option.value_exn;;\nlet proj = Project.create ~rooter (Project.Input.file \"/bin/true\") |> ok_exn;;\nlet prog = Project.program proj;;\nlet cg = Program.to_graph prog;;\nlet sub = Term.first sub_t prog |> Option.value_exn;;\nlet cfg = Sub.to_cfg sub;;\nmodule G = Graphs.Ir;;\nlet entry = Option.value_exn (Term.first blk_t sub);;\nlet dom_tree = Graphlib.dominators (module G) cfg (G.Node.create entry);;\n```\n\nNote: if you do not want to use `baptop` or `utop`, then you can\nexecute the following in any OCaml top-level:\n\n```ocaml\n#use \"topfind\";;\n#require \"bap.top\";;\n```\n\n# Learning\n\nOther than\n[API](https://binaryanalysisplatform.github.io/bap/api/master/argot_index.html)\ndocumentation, we have\n[blog](https://binaryanalysisplatform.github.io/) and\n[wiki](https://github.com/BinaryAnalysisPlatform/bap/wiki/), where you\ncan find some useful information. Also, we have a permanently manned\nchat in case of emergency. Look at the badge on top of the README\nfile, and feel free to join.\n\n# Contributing\n\nBAP is a framework, so you don't need to change its code to extend\nit.We use the dependency injection principle with many injection\npoints to allow the user to alter BAP behavior. However, bugs happen,\nso if you have any problems, questions or suggestions, please, don't\nhesitate to use our issue tracker. Submitting a pull request with a\nproblem fix will make us really happy. However, we will only accepted\npull requests that have MIT license.\n\nIf you wrote analysis with BAP, then don't hesitate to\n[release](https://opam.ocaml.org/doc/Packaging.html) it to OPAM, for\nthe benefit of the community.\n\n# Sponsors\n\n* [DARPA VET Project](https://www.darpa.mil/program/vetting-commodity-it-software-and-firmware)\n* [Siemens AG](https://www.siemens.com/us/en/home.html)\n* Institute for Information & communications Technology Promotion(IITP) grant funded by the Korea government(MSIT)\n (No.2015-0-00565,Development of Vulnerability Discovery Technologies for IoT Software Security)\n \nPlease, [contact us](https://www.cylab.cmu.edu/partners/index.html) if you would like to become a sponsor.\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",9365551229,"orgData",{"_90":91,"_92":93,"_94":95,"_96":33,"_97":98,"_99":100,"_101":102,"_103":104,"_105":106,"_107":108,"_109":108,"_110":108,"_111":21},"id","4da0512567274cb7bc3ed490d405faaa","uuid","4da05125-6727-4cb7-bc3e-d490d405faaa","type","organization","orgname","full_name","Binary Analysis Platform (BAP)","location","5000 Forbes Avenue, Pittsburgh, PA, 15203","company","Carnegie Mellon University, Cylab","profile_url","http://bap.ece.cmu.edu","date_joined","2015-08-12T18:54:08.026967Z","gravatar_url","","gravatar_email","badge","is_active","recentTags",[114],{"_115":44,"_116":117,"_118":119,"_90":120,"_121":122,"_50":139,"_140":117,"_141":33,"_142":56,"_57":143,"_144":145,"_146":130,"_147":139,"_148":66,"_149":21},"content_type","creator",400252,"full_size",947865492,8029567,"images",[123],{"_124":125,"_126":127,"_128":108,"_129":130,"_131":132,"_133":134,"_135":108,"_136":-5,"_137":119,"_63":66,"_138":-5},"architecture","amd64","digest","sha256:4eaca8e80079605dd2113b3b43b948c9f26a366dc26cbbed4704db863aefbefd","features","last_pulled","2026-10-11T18:58:17.334952936Z","last_pushed","2017-09-29T18:32:06Z","os","linux","os_features","os_version","size","variant","2017-09-29T18:32:05.332615Z","last_updater","last_updater_username","media_type","latest","repository",1236458,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":163,"_170":171,"_157":180,"_181":11},{"_40":164,"_42":165,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":166,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":167,"_79":21,"_80":169,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":168},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_172":64,"_173":-5,"_174":-5,"_175":176},"count","next","previous","results",[177],{"_115":44,"_116":117,"_118":119,"_90":120,"_121":178,"_50":139,"_140":117,"_141":33,"_142":56,"_57":143,"_144":145,"_146":130,"_147":139,"_148":66,"_149":21},[179],{"_124":125,"_126":127,"_128":108,"_129":130,"_131":132,"_133":134,"_135":108,"_136":-5,"_137":119,"_63":66,"_138":-5},[],"canDeleteTags","actionData","errors"]

binaryanalysisplatform/bap-release

Tags for binaryanalysisplatform/bap-release